Lucene search
+L

323521 matches found

Nuclei
Nuclei
added 2026/09/23 2:05 a.m.181 views

KeyCloak - Information Exposure

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients like client secret without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this...

6.5CVSS6.5AI score0.17943EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.67 views

Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

9.8CVSS8.5AI score0.19762EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.77 views

WordPress WP Security Audit Log 3.1.1 - Information Disclosure

WordPress WP Security Audit Log 3.1.1 plugin is susceptible to information disclosure. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-8719 info: name:...

5.3CVSS6.1AI score0.15621EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.91 views

Splunk <=7.0.1 - Information Disclosure

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. id: CVE-2018-11409 info: name: Splunk =7.0.1 - Information Disclosure author: harshbothra severity: medium...

5.3CVSS6AI score0.98314EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.102 views

Monstra CMS 3.0.4 - Cross-Site Scripting

Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form i.e., the login parameter to users/registration. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

6.1CVSS6.7AI score0.02273EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.52 views

GRAND FlAGallery 1.57 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in facebook.php in the GRAND FlAGallery plugin flash-album-gallery before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter. id: CVE-2011-4624 info: name: GRAND FlAGallery 1.57 - Cross-Site Scripting...

4.3CVSS5.8AI score0.07062EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.49 views

Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting

Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarfajax.php. id: CVE-2011-4336 info: name: Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting author: pikpikcu severity: medium description: Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site...

6.1CVSS6.2AI score0.07652EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.49 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

4.8CVSS6AI score0.03316EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.91 views

Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true...

5CVSS8.1AI score0.53728EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.86 views

WAVLINK - Access Control

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform...

7.5CVSS7.2AI score0.07552EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.25 views

XWiki - Information Disclosure

XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package. id: CVE-2025-55749 info: name:...

8.7CVSS7.3AI score0.01471EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.47 views

IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admininit, letting unauthenticated attackers view plugin settings, exploit requires no special conditions. id: CVE-2025-1361 info: name: IP2Location...

7.5CVSS8.1AI score0.01313EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.213 views

Imcat 4.4 - Phpinfo Configuration

Imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI. id: CVE-2018-20608 info: name: Imcat 4.4 - Phpinfo Configuration author: ritikchaddha severity: high description: Imcat 4.4 allows remote attackers to read phpinfo output via the...

7.5CVSS7.3AI score0.12063EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.48 views

Zend Server <9.13 - Cross-Site Scripting

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. id: CVE-2018-10230 info: name: Zend Server 9.13 - Cross-Site Scripting author: marcosiaf severity: medium description: | Zend Server before version 9.13 is vulnerable to cross-site scripting via the...

6.1CVSS6.2AI score0.02663EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.69 views

Helmet Store Showroom v1.0 - SQL Injection

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access. id: CVE-2022-46071 info: name: Helmet Store Showroom v1.0 - SQL Injection author: Harsh severity: critical description: | There is SQL Injection vulnerability...

9.8CVSS8.2AI score0.0431EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.95 views

b2evolution CMS <6.11.6 - Open Redirect

b2evolution CMS before 6.11.6 contains an open redirect vulnerability via the redirectto parameter in emailpassthrough.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-22840 info:...

6.1CVSS6.3AI score0.13817EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.68 views

WeiPHP 5.0 - SQL Injection

WeiPHP 5.0 contains a SQL injection vulnerability via the wpwhere function. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2020-20300 info: name: WeiPHP 5.0 - SQL...

9.8CVSS8.3AI score0.08752EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.61 views

Cisco SD-WAN vManage Software - Local File Inclusion

Cisco SD-WAN vManage Software in the application data endpoints is vulnerable to local file inclusion which could allow an unauthenticated, remote attacker to gain access to sensitive information. id: CVE-2020-26073 info: name: Cisco SD-WAN vManage Software - Local File Inclusion author: madrobot...

7.5CVSS7.3AI score0.12583EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.93 views

rConfig <3.9.4 - Sensitive Information Disclosure

rConfig prior to version 3.9.4 is susceptible to sensitive information disclosure. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application does not exit after a redirect is applied, the rest of the page still executes,...

7.5CVSS7.2AI score0.19037EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.6 views

TOTVS Fluig <= 1.7.0 - Arbitrary File Read

TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter. id: CVE-2020-29134 info: name: TOTVS Fluig = 1.7.0 - Arbitrary File Read author: ls4ss...

8.6CVSS7.8AI score0.27184EPSS
SaveExploits2References4
Rows per page
Query Builder