Lucene search
+L

1634037 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.95 views

Anchor CMS 0.12.3 - Error Log Exposure

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. id: CVE-2018-7251 info: name: Anchor CMS 0.12.3 ...

9.8CVSS8.1AI score0.7183EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.60 views

LG-Ericsson iPECS NMS 30M - Local File Inclusion

Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=../ URIs. id: CVE-2018-15138 info: name: LG-Ericsson iPECS NMS 30M - Local File Inclusion author: 0xAkoko severity: high description: Ericsson-LG iPECS NMS 30M allows local file inclusion via...

7.5CVSS7.2AI score0.12851EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.73 views

NagiosXI <= 5.4.12 - SQL injection

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. id: CVE-2018-10736 info: name: NagiosXI = 5.4.12 - SQL injection author: DhiyaneshDK severity: high description: | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the...

7.2CVSS7.3AI score0.42556EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.133 views

RStudio Connect - Open Redirect

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. id: CVE-2022-38131 info: name: RStudio Connect - Open Redirect author: xxcdd severity: medium description: | RStudio Connect prior to...

6.1CVSS6.4AI score0.01663EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.33 views

Sitecore Experience Platform - Deserialization of Untrusted Data

Sitecore Experience Platform before 8.2 Update-7 and 9.0 before Update-2 is vulnerable to a remote code execution vulnerability CVE-2019-9874. An attacker can exploit this issue to execute arbitrary code on the affected system via a crafted request to the...

9.8CVSS9.2AI score0.83736EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.50 views

WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. id: CVE-2019-9880 info: name: WPEngine WPGraphQL 0.2.3 -...

9.1CVSS8AI score0.34761EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.44 views

WordPress CTHthemes - Cross-Site Scripting

WordPress CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes contain reflected cross-site scripting vulnerabilities via a search query. id: CVE-2019-20210 info: name: WordPress CTHthemes - Cross-Site Scripting author: edoardottt severity: medium description: |...

6.1CVSS6.2AI score0.03243EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.489 views

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

9.8CVSS8.1AI score0.52948EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.140 views

perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery

An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery SSRF attacks. id: CVE-2022-41412 info: name: perfSONAR 4.x = 4.4.4 - Server-Side Request Forgery author: nullhypothesis severity: high descriptio...

8.6CVSS7.8AI score0.04204EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.31 views

WAVLINK WN530HG4 - Improper Access Control

Wavlink WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can download log files and configuration data via Exportlogs.sh and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-34049 info: name: WAVLINK WN530H...

5.3CVSS6AI score0.02697EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.51 views

Pandora FMS 7.0NG - Remote Command Injection

Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. id: CVE-2019-20224 info: name: Pandora FMS 7.0NG - Remote Command Injection author: ritikchaddha severity: hig...

9CVSS7.9AI score0.4968EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.93 views

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

6.1CVSS6.9AI score0.10902EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.99 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS5.5AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.99 views

Apache ShardingSphere ElasticJob-UI privilege escalation

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and pri...

6.5CVSS6.6AI score0.37594EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.45 views

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

9.8CVSS8.1AI score0.83543EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.39 views

WordPress Accordions - Unauthenticated Settings Update

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin = 2.0.2 at WordPress. id: CVE-2022-33198 info: name: WordPress Accordions - Unauthenticated Settings Update author: riteshs4hu severity: critical description: | Unauthenticated WordPress Options Change...

9.8CVSS5.9AI score0.03295EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.85 views

WAVLINK - Access Control

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform...

7.5CVSS7.2AI score0.07552EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.67 views

WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting

WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter a search query. Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean...

6.1CVSS6.2AI score0.03611EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.137 views

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...

8.8CVSS7.8AI score0.2389EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.30 views

Lokomedia CMS - Local File Inclusion

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. id: CVE-2010-2018 info: name: Lokomedia CMS - Local File Inclusion author: r3Y3r53 severit...

5CVSS5.8AI score0.03258EPSS
SaveExploits2References3
Rows per page
Query Builder