Lucene search
+L

10668 matches found

Cvelist
Cvelist
added 51 minutes ago5 views

CVE-2026-67612 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...

4.8CVSS
SaveExploits0References2
EUVD
EUVD
added 10 hours ago5 views

EUVD-2026-52180

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...

6.3AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago10 views

CVE-2026-16297

The CVE concerns the Clearfy Cache WordPress plugin prior to version 2.4.3. The vulnerability arises because the plugin does not restrict the classes allowed during unserialization of settings-import data, enabling an attacker with administrator access to induce PHP Object Injection. This can lea...

6.3AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago5 views

EUVD-2025-210597

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...

5.6AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago7 views

CVE-2025-15673

CVE-2025-15673 affects the Import and export users and customers WordPress plugin (versions before 2.4.3). Root cause: plugin does not restrict the path of a file it reads and displays during a CSV import, enabling high-privileged users to read arbitrary server files. Impact: potential exposure o...

5.6AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago8 views

CVE-2026-16534

The CVE-2026-16534 entry concerns the Import and export users and customers WordPress plugin (pre-2.4.2). The flaw arises because the plugin does not enforce WordPress role-assignment and per-user edit permissions during CSV import, allowing a user who only has the user-creation capability to cre...

5.5AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago5 views

EUVD-2026-52166

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...

5.5AI score
SaveExploits0References1
CVE
CVE
added 11 hours ago4 views

CVE-2026-18587

CVE-2026-18587 affects Wavlink WL-NU516U1 (708c073-mt7628). The flaw is in an unknown function of Config Import where manipulating the Password argument can trigger an OS command injection. The issue is exploitable remotely with high impact to confidentiality, integrity, and availability (C/I/A: ...

7.7CVSS6.6AI score
SaveExploits0References6
EUVD
EUVD
added 11 hours ago3 views

EUVD-2026-52160

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

7.7CVSS6.6AI score
SaveExploits0References6
Nuclei
Nuclei
added 12 hours ago192 views

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 allows unauthenticated attackers to execute arbitrary commands via a web shell. id: CVE-2023-4521 info: name: Import XML and RSS Feeds 2.1.5 - Unauthenticated RCE author: princechaddha severity: critical description: The Import XML and RS...

9.8CVSS8.1AI score0.39294EPSS
SaveExploits2References1
Nuclei
Nuclei
added 12 hours ago29 views

Import Legacy Media <= 0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4535 info: name: Import Legacy Media = 0.1 - Cross-Site...

6.1CVSS6.3AI score0.03983EPSS
SaveExploits2References4
Nuclei
Nuclei
added 12 hours ago18 views

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...

6.5CVSS6.5AI score0.01153EPSS
SaveExploits1References4
Nuclei
Nuclei
added 12 hours ago16 views

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

6.1CVSS7.2AI score0.01843EPSS
SaveExploits1References2
Nuclei
Nuclei
added 12 hours ago14 views

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. id: CVE-2019-17232 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated Options Import and Export author: daffainfo severity: high description: |...

7.5CVSS7.5AI score0.03518EPSS
SaveExploits1References4
Nuclei
Nuclei
added 12 hours ago44 views

External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery

WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obta...

6.5CVSS6.6AI score0.02996EPSS
SaveExploits1References4
Nuclei
Nuclei
added 12 hours ago12 views

phpVMS < 7.0.6 - Legacy Importer Authorization Bypass

phpVMS 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges. id: CVE-2026-42569 info: name: phpVMS 7.0.6 - Legacy Importer Authorization Bypass...

9.4CVSS5.4AI score0.01173EPSS
SaveExploits1References3
Nuclei
Nuclei
added 12 hours ago10 views

Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution

Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the /api/monitors/import and /api/alert/defines/import endpoints. An authenticated user can submit a YAML file that constructs an org.h2.jdbc.JdbcConnection with a malicio...

8.8CVSS6.3AI score0.08322EPSS
SaveExploits0References2
Nuclei
Nuclei
added 12 hours ago14 views

Schneider Electric U.motion Builder - SQL Injection

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...

8.8CVSS7.8AI score0.02917EPSS
SaveExploits3References2
Nuclei
Nuclei
added 12 hours ago21 views

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

9.8CVSS5.6AI score0.01381EPSS
SaveExploits0References2
Nuclei
Nuclei
added 12 hours ago29 views

DbGate - Remote Code Execution via Dynamic Import Bypass

DbGate versions = 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import. id:...

9.4CVSS6.3AI score0.01714EPSS
SaveExploits1References3
Rows per page
Query Builder