Lucene search
+L

219875 matches found

Nuclei
Nuclei
added 2026/09/24 2:06 a.m.72 views

Jeedom <=4.0.38 - Cross-Site Scripting

Jeedom through 4.0.38 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2020-9036 info: name: Jeedom =4.0.38 - Cross-Site Scripting author: pikpikcu severity: medium...

6.1CVSS6.4AI score0.03587EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.113 views

LocalAI - Partial Local File Read

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the...

5.8CVSS6AI score0.0265EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.90 views

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

6.5CVSS5.6AI score0.02131EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.41 views

Viral Signup <= 2.1 - SQL Injection

The Viral Signup limited opt-in with viral referral sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

9.8CVSS5.7AI score0.03292EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.82 views

Jeesns 1.4.2 - Cross-Site Scripting

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting that allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field. id: CVE-2020-19282 info: name: Jeesns 1.4.2 - Cross-Site Scripting author: pikpikcu severity: medium...

6.1CVSS6.6AI score0.03162EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.178 views

TVT DVR Sensitive Device - Information Disclosure

A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5LMM and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. id: CVE-2024-7339...

6.9CVSS5.5AI score0.32028EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.67 views

Car Rental Management System 1.0 - SQL Injection

Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/manageuser.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-32028...

7.2CVSS7.3AI score0.05059EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.114 views

ZoneMinder - SQL Injection

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61. id: CVE-2024-43360 info: name: ZoneMinder - SQL Injection author: s4e-io severity: critical...

9.8CVSS7.3AI score0.06222EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.53 views

Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

8.6CVSS8AI score0.03119EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.45 views

WordPress Post Grid <2.1.8 - Cross-Site Scripting

WordPress Post Grid plugin before 2.1.8 contains a reflected cross-site scripting vulnerability. The slider import search feature and tab parameter of thesettings are not properly sanitized before being output back in the pages, id: CVE-2021-24488 info: name: WordPress Post Grid 2.1.8 - Cross-Sit...

6.1CVSS6.2AI score0.11241EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.118 views

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the sshform.php script functionality. id: CVE-2021-21800 info: name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting author: arafatansari severity: medium description: | Advantech R-SeeNet 2.4.12 contains a...

9.6CVSS7.4AI score0.14115EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.43 views

Kramer VIAware - Privilege Escalation and Remote Code Execution

Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...

10CVSS9.1AI score0.70753EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.76 views

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

6.1CVSS6.3AI score0.01652EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.13 views

Dockwatch <= 0.6.567 - OS Command Injection

Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete...

9.8CVSS8.6AI score0.0804EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.56 views

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

6.1CVSS6.2AI score0.03419EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.93 views

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. id: CVE-2014-2908 info: name: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting author:...

4.3CVSS5.8AI score0.20862EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.167 views

Odoo 8.0/9.0/10.0 - Local File Inclusion

Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.fileopen. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-9416 info: name: Odoo 8.0/9.0/10.0 -...

6.5CVSS7AI score0.05651EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.65 views

JoomSport <= 5.7.7 - SQL Injection

The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause. id: CVE-2026-42647 info: name: JoomSport =...

9.3CVSS5.8AI score0.01343EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.644 views

WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF

WordPress Automatic plugin 3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This...

9.9CVSS8.1AI score0.94057EPSS
SaveExploits18References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.54 views

phpPgAdmin <=4.1.1 - Cross-Site Scripting

phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via certain input available in PHPSELF in 1 redirect.php, possibly related to 2 login.php, which are different vectors than CVE-2007-2865. id:...

9.3CVSS5.9AI score0.14639EPSS
SaveExploits3References5
Rows per page
Query Builder