Lucene search
+L

1670732 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.13 views

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

7.5CVSS5.8AI score0.01422EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.95 views

Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

9.8CVSS5.7AI score0.01999EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.26 views

Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

9.8CVSS8AI score0.36513EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.55 views

Optergy Proton/Enterprise Building Management System - Open Redirect

Optergy Proton/Enterprise Building Management System contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-7275 info: name: Optergy Proton/Enterprise...

6.1CVSS7AI score0.09087EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.64 views

eShop 3.0.4 - Cross-Site Scripting

eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in. id: CVE-2022-35493 info: name: eShop 3.0.4 - Cross-Site Scripting author: arafatansari severity: medium description: | eShop 3.0.4 contains a reflected cross-site scripting...

6.1CVSS6.2AI score0.01696EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.59 views

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

8.8CVSS8.1AI score0.80069EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.60 views

Jira Netic Group Export <1.0.3 - Missing Authorization

Jira Netic Group Export add-on before 1.0.3 contains a missing authorization vulnerability. The add-on does not perform authorization checks, which can allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a...

5.3CVSS6.1AI score0.2568EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.119 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteinquiry. id: CVE-2022-31978 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: critical description: | Online Fire Reporting System v1.0 is vulnerable to...

9.8CVSS8.2AI score0.07224EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.49 views

SmarterTools SmarterTrack - Cross-Site Scripting

Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. id: CVE-2022-24384 info: name: SmarterTools SmarterTrack - Cross-Site Scripting author: E1A severity: medium description: | Cross-site Scripting XSS vulnerability in...

8.8CVSS6.3AI score0.0409EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.23 views

Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

9.8CVSS8.5AI score0.56787EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.53 views

Wavlink - Improper Access Control

Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations. id: CVE-2022-48165 info: name: Wavlink -...

7.5CVSS7.3AI score0.03284EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.89 views

WAVLINK WN530HG4 - Improper Access Control

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd and thereby possibly obtain sensitive information, modify data, and/or execute...

7.5CVSS7.4AI score0.21815EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.58 views

Online Birth Certificate System 1.2 - Stored Cross-Site Scripting

Online Birth Certificate System 1.2 contains multiple stored cross-site scripting vulnerabilities in the component /obcs/user/profile.php, which allows an attacker to execute arbitrary web script or HTML via a crafted payload injected into the fname or lname parameters. id: CVE-2022-29005 info:...

6.1CVSS6.5AI score0.02178EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.31 views

Atlassian Confluence < 5.8.6 - Server-Side Request Forgery

Confluence Server and Data Center before 5.8.6 contain a blind server-side request forgery caused by the WidgetConnector plugin, letting remote attackers manipulate internal network resources, exploit requires network access to the server. id: CVE-2021-26072 info: name: Atlassian Confluence 5.8.6...

4.3CVSS5.5AI score0.38845EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.58 views

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

6.1CVSS6.3AI score0.01165EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.72 views

Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting

The plugin does not sanitise and escape the wyppagetype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24934 info: name: Visual CSS Style Editor 7.5.4 - Cross-Site Scripting author: Splint3r7 severity: medium description: | The...

6.1CVSS6.3AI score0.01397EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.38 views

WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting

The settings page of the plugin did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue. id: CVE-2021-24286 info: name: WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting author: r3Y3r53 severity: medium descriptio...

6.1CVSS6.3AI score0.13942EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.58 views

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

7.5CVSS7.8AI score0.03719EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.93 views

Shirne CMS 1.2.0 - Local File Inclusion

Shirne CMS 1.2.0 is vulnerable to local file inclusion which could cause arbitrary file read via /static/ueditor/php/controller.php. id: CVE-2022-37299 info: name: Shirne CMS 1.2.0 - Local File Inclusion author: pikpikcu severity: medium description: Shirne CMS 1.2.0 is vulnerable to local file...

6.5CVSS6.7AI score0.03542EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.118 views

AirFlow < 2.4.0 - Remote Code Execution

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. id: CVE-2022-40127 info: name: AirFlow 2.4.0 -...

8.8CVSS8AI score0.85653EPSS
SaveExploits2References5
Rows per page
Query Builder