Lucene search
+L

214936 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.64 views

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

6.1CVSS6.2AI score0.16044EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.62 views

Draytek VigorConnect 6.0-B3 - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id: CVE-2021-201...

7.8CVSS7.7AI score0.96308EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.40 views

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

4.3CVSS5.8AI score0.08693EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.59 views

WP-FaceThumb 0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the paginationwpfacethumb parameter. id: CVE-2012-2371 info: name: WP-FaceThumb 0.1 - Cross-Site Scripting author: daffainfo severity:...

4.3CVSS5.8AI score0.12848EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.116 views

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

8.1CVSS6.5AI score0.08143EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.89 views

WOOF WordPress plugin - Cross-Site Scripting

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. id: CVE-2021-25085 info: name: WOOF WordPress plugin - Cross-Site Scripting author: Maximus Decimus severity: medium...

6.1CVSS6.3AI score0.01651EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.65 views

WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting

WordPress Bello Directory & Listing theme before 1.6.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape the listinglistview, btbblistingfieldmylat, btbblistingfieldmylng, btbblistingfielddistancevalue, btbblistingfieldmylatdefault,...

6.1CVSS6.2AI score0.10769EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.54 views

WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting

WordPress Contact Form 7 Skins plugin 2.5.0 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the tab parameter before outputting it back in an admin page. id: CVE-2021-25063 info: name: WordPress Contact Form 7 Skins =2.5.0 - Cross-Site Scripting...

6.1CVSS6.2AI score0.0208EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.32 views

Chamilo model.ajax.php - SQL Injection

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. id: CVE-2021-34187 info: name: Chamilo model.ajax.php - SQL Injection author: DhiyaneshDK severity: critical description: | main/inc/ajax/model.ajax.php in Chamilo...

9.8CVSS8.2AI score0.16181EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.90 views

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...

7.8CVSS7.3AI score0.20514EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.102 views

Online Event Booking and Reservation System 2.3.0 - SQL Injection

Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS8.2AI score0.16046EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.333 views

phpfastcache - phpinfo Resource Exposure

phpinfo is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache. id: CVE-2021-37704 info: name: phpfastcache - phpinfo Resource Exposure author: whoever severity: medium description: phpinfo is susceptible to resource exposure in unprotected compos...

5.4CVSS5.5AI score0.06132EPSS
SaveExploits1References6
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.104 views

WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting

WordPress iQ Block Country plugin 1.2.11 and prior contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

5.5CVSS6AI score0.01215EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.88 views

Akkadian Provisioning Manager - Information Disclosure

Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped. id: CVE-2021-31581 info: name: Akkadian Provisionin...

7.9CVSS5.5AI score0.01207EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.70 views

Pascom CPS - Local File Inclusion

Pascom packaged with Cloud Phone System CPS versions before 7.20 contain a known local file inclusion vulnerability. id: CVE-2021-45968 info: name: Pascom CPS - Local File Inclusion author: dwisiswant0 severity: high description: | Pascom packaged with Cloud Phone System CPS versions before 7.20...

7.5CVSS7.2AI score0.10385EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.48 views

Vehicle Service Management System - Stored Cross-Site Scripting

A Stored Cross Site Scripting XSS vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel. id: CVE-2021-46068 info: name: Vehicle Service Management System - Stored Cross-Site Scripting author: TenBird severity: medium description: | A Stored Cross...

4.8CVSS5.5AI score0.02736EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.114 views

SysAid 20.4.74 - Cross-Site Scripting

SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via the KeepAlive.jsp stamp parameter. id: CVE-2021-31862 info: name: SysAid 20.4.74 - Cross-Site Scripting author: jas37 severity: medium description: SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via...

6.1CVSS6.2AI score0.03985EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.60 views

Contact Form Entries < 1.2.4 - Cross-Site Scripting

The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...

6.1CVSS6.3AI score0.0682EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.69 views

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php id: CVE-2021-4449 info: name: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload author: 0xnemian severity: critical description: | ZoomSounds plugin for WordPress contains a file upload vulnerability in...

9.8CVSS8.2AI score0.05439EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.124 views

Hongdian H8922 3.0.5 Devices - Local File Inclusion

Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /logdownload.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ e.g., ../../etc/passwd This can be carried out wi...

6.5CVSS7.1AI score0.1592EPSS
SaveExploits1References5
Rows per page
Query Builder