Lucene search
+L

213662 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.211 views

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

6.1CVSS6.2AI score0.01663EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.94 views

WordPress Asgaros Forum <1.15.13 - SQL Injection

WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

9.8CVSS8.3AI score0.12559EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.79 views

AccessAlly <3.5.7 - Sensitive Information Leakage

WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file "resource/frontend/product/product-shortcode.php" which is responsible for the accessallyorderform shortcode dumps serialize$SERVER, which contains all environment variables. The leakage occurs on all...

7.5CVSS7.2AI score0.05404EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.83 views

WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection

WordPress Paytm Donation plugin through 1.3.2 is susceptible to authenticated SQL injection. The plugin does not sanitize, validate, or escape the id GET parameter before using it in a SQL statement when deleting donations. An attacker can possibly obtain sensitive information, modify data, and/o...

7.2CVSS7.2AI score0.0654EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.67 views

WordPress Transposh Translation <1.0.8 - Cross-Site Scripting

WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in...

6.1CVSS6.9AI score0.01567EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.107 views

Cacti - Cross-Site Scripting

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. id: CVE-2021-26247 info: name: Cacti - Cross-Site Scripting author: dhiyaneshDK severity: medium descriptio...

6.1CVSS6.3AI score0.07124EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.36 views

WordPress ProfilePress <= 3.1.3 - Privilege Escalation

ProfilePress plugin before 3.1.4 allows privilege escalation. Due to insufficient validation in the profile update functionality, authenticated users can supply arbitrary usermeta fields, including wpcapabilities, during profile updates. This enables a user to escalate their privileges to...

9.8CVSS8.1AI score0.0412EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.100 views

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. id: CVE-2021-40149 info: name: Reolink E1 Zoom Camera =3.0.0.716 - Private Key Disclosure author: For3stCo1d severity: medium description: | Reolink E1 Zoom Camera versions 3.0.0.716 and...

5.9CVSS7AI score0.07931EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.46 views

WordPress Automatic Plugin - Unauthenticated Options Change

WordPress Automatic Plugin versions 3.53.2 and below contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the processform.php script. The vulnerable script uses updateoption on all POST parameters without authentication or capability...

9.8CVSS8.2AI score0.16408EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.193 views

GenieACS => 1.2.8 - OS Command Injection

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check. id: CVE-2021-46704 info:...

9.8CVSS8.1AI score0.21901EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.87 views

EyouCMS 1.5.4 Open Redirect

EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function. id: CVE-2021-39501 info: name: EyouCMS 1.5.4 Open Redirect author: 0xAkoko severity: medium description: EyouCMS 1.5.4 is vulnerable to an Open Redirect...

6.1CVSS6.3AI score0.03588EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.95 views

WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues. id: CVE-2021-24435 info: name: WordPress Titan Framework plugin =...

6.1CVSS6.3AI score0.01714EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.37 views

Odoo Apps - Cross-Site Scripting via Prototype Pollution

jquery-bbq 1.2.1 contains a prototype pollution caused by improperly controlled modification of object prototype attributes, letting malicious users inject properties into Object.prototype, exploit requires malicious user interaction. id: CVE-2021-20086 info: name: Odoo Apps - Cross-Site Scriptin...

8.8CVSS7.7AI score0.06104EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.72 views

WordPress FoodBakery <2.2 - Cross-Site Scripting

WordPress FoodBakery before 2.2 contains an unauthenticated reflected cross-site scripting vulnerability. It does not properly sanitize the foodbakeryradius parameter before outputting it back in the response. id: CVE-2021-24389 info: name: WordPress FoodBakery 2.2 - Cross-Site Scripting author:...

6.1CVSS6.2AI score0.03753EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.33 views

Gitea < 1.4.3 - Open Redirect

Gitea before version 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs. The vulnerability exists in the redirectto parameter used on the login page /user/login. Due to improper validation of the redirect URL, an attacker can craft a malicious link that...

6.1CVSS6.4AI score0.00952EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.58 views

Easy Social Feed < 6.2.7 - Cross-Site Scripting

Easy Social Feed 6.2.7 is susceptible to reflected cross-site scripting because the plugin does not sanitize and escape a parameter before outputting it back in an admin dashboard page, leading to it being executed in the context of a logged admin or editor. id: CVE-2021-25120 info: name: Easy...

6.1CVSS6.2AI score0.02909EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.116 views

Php-mod/curl Library <2.3.2 - Cross-Site Scripting

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...

6.1CVSS6.3AI score0.01261EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.28 views

QVIS NVR/DVR - Remote Code Execution

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. id: CVE-2021-41419 info: name: QVIS NVR/DVR - Remote Code Execution author: me9187 severity: critical description: | QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java...

9.8CVSS8.3AI score0.08697EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.63 views

Noptin < 1.6.5 - Open Redirect

Noptin 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. id: CVE-2021-25033 info: name: Noptin 1.6.5 - Open Redirect author: dhiyaneshDk severity: medium...

6.1CVSS6.3AI score0.02303EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.79 views

Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request. id: CVE-2021-46424 info: name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete author: gy741 severity:...

9.4CVSS8.2AI score0.36459EPSS
SaveExploits3References5
Rows per page
Query Builder