Lucene search
+L

317787 matches found

Nuclei
Nuclei
added 2026/09/21 2:08 a.m.53 views

PrestaShop fieldpopupnewsletter Module - Cross Site Scripting

Fieldpopupnewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the callback parameter at ajax.php. id: CVE-2023-39676 info: name: PrestaShop fieldpopupnewsletter Module - Cross Site Scripting author: meme-lord severity: medium...

6.1CVSS6.2AI score0.01432EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.117 views

QCube Cross-Site-Scripting

A reflected cross-site scripting vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. id: CVE-2020-24912 info: name: QCube Cross-Site-Scripting author: pikpikcu severity: medium...

6.1CVSS6.8AI score0.0634EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.107 views

WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting

WordPress All-in-One WP Migration plugin 7.62 and prior contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials a...

4.7CVSS5.5AI score0.01204EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.44 views

WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure

WAVLINK Quantum D4G WL-WN531G3 running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files. id: CVE-2022-44356 info: name: WAVLINK Quantum D4G WL-WN531G3 - Information Disclosur...

7.5CVSS7.2AI score0.02762EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.66 views

Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. id: CVE-2022-48164 info: name: Wavlink WL-WN533A8 M33A8.V5030.190716 - Information...

7.5CVSS7.2AI score0.03096EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.41 views

Hongdian H8922 3.0.5 - Information Disclosure

Hongdian H8922 3.0.5 is susceptible to information disclosure. An attacker can access cli.conf with the administrator password and other sensitive data via /backup2.cgi and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-28150 info:...

5.5CVSS6AI score0.02794EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.27 views

Cisco Finesse - Server-Side Request Forgery (SSRF)

Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests. id: CVE-2024-20404 info: name: Cisco Finesse - Server-Side Reque...

7.2CVSS7.2AI score0.22644EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.31 views

CyberPower - SQL Injection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32737 info: name: CyberPower - SQL Injection author: DhiyaneshDk severity: high description: | A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3...

7.5CVSS7.2AI score0.05408EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.62 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 is vulnerable to cross-site scripting via the segments/add.php Segment Name field. id: CVE-2018-1000856 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 is vulnerable to cross-site scripting via the...

4.8CVSS5.3AI score0.02008EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.14 views

WPAdverts <= 2.3.2 - Information Disclosure

WPAdverts – Classifieds Plugin for WordPress = 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication. id:...

7.5CVSS5.6AI score0.00967EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.36 views

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

7.5CVSS7.4AI score0.02454EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.174 views

Odoo <= 8.0-20160726 & 9.0 - Open Redirect

An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. id: CVE-2017-5871 info: name: Odoo = 8.0-20160726 & 9.0 - Open Redirect author: 1337rokudenashi severity: medium description: | An Open...

5.8CVSS5.8AI score0.03761EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.49 views

CirCarLife <4.3 - Improper Authentication

CirCarLife before 4.3 is susceptible to improper authentication. A system software information disclosure exists due to lack of authentication for /html/device-id. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16671 info: name:...

5.3CVSS6.6AI score0.07571EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.111 views

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerabili...

10CVSS8.5AI score0.20371EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.115 views

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by...

10CVSS8.4AI score0.20371EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.10 views

Directus < 11.9.0 - Version Disclosure

Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus...

5.3CVSS5.7AI score0.0092EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.13 views

FacturaScripts - Unauthenticated phpinfo Disclosure

Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication. id: CVE-2026-42878 info: name:...

5.3CVSS5.7AI score0.00552EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.215 views

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...

8.8CVSS5.8AI score0.00932EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.29 views

Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API

Piwigo = 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking adminonly restriction, letting unauthenticated users access full browsing history, exploit requires no authentication id: CVE-2026-27833 info: name: Piwigo 16.3.0 - Unauthenticated...

7.5CVSS5.7AI score0.01641EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/21 2:08 a.m.61 views

FineCMS <5.0.9 - Open Redirect

FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...

6.1CVSS6.2AI score0.03041EPSS
SaveExploits1References2
Rows per page
Query Builder