Lucene search
+L

214187 matches found

Nuclei
Nuclei
added 2026/09/11 5:22 a.m.87 views

WordPress WPB Show Core - Cross-Site Scripting

WordPress wpb-show-core plugin through TODO contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site...

6.1CVSS6.3AI score0.00919EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.87 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Highlight Row feature at /index.php?module=entities/listingtypes&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

5.4CVSS6.4AI score0.00969EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.33 views

Musicbox WordPress - Reflected XSS

contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...

6.1CVSS8AI score0.00584EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.183 views

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

6.5CVSS5.9AI score0.02618EPSS
SaveExploits6References2
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.71 views

Tiki Wiki CMS Groupware 5.2 - Local File Inclusion

Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability. id: CVE-2010-4239 info: name: Tiki Wiki CMS Groupware 5.2 - Local File Inclusion author: 0xakoko severity: critical description: Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability...

9.8CVSS7.9AI score0.1343EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.94 views

WordPress User Post Gallery <=2.19 - Remote Code Execution

WordPress User Post Gallery plugin through 2.19 is susceptible to remote code execution. The plugin does not limit which callback functions can be called by users, making it possible for an attacker execute malware, obtain sensitive information, modify data, and/or gain full control over a...

9.8CVSS8.4AI score0.42723EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.29 views

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

6.1CVSS7AI score0.23632EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.130 views

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

5.3CVSS6.9AI score0.00875EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.56 views

Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

9.8CVSS6.7AI score0.09257EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.63 views

Joomla! Component redSHOP 1.0 - Local File Inclusion

A directory traversal vulnerability in the redSHOP comredshop component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the view parameter to index.php. id: CVE-2010-1531 info: name: Joomla! Component redSHOP 1.0 - Local File Inclusion author: daffainfo...

7.5CVSS5.9AI score0.16915EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.62 views

Joomla! Component com_janews - Local File Inclusion

A directory traversal vulnerability in the JA News comjanews component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1219 info: name: Joomla! Component comjanews - Local File Inclusion author: daffainf...

6.8CVSS5.9AI score0.0823EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.37 views

Helmet Store Showroom - Cross Site Scripting

Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting XSS. id: CVE-2022-46073 info: name: Helmet Store Showroom - Cross Site Scripting author: Harsh severity: medium description: | Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting XSS. impact: | Successful exploitation of...

6.1CVSS6.3AI score0.01235EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.36 views

NewsTicker <= 1.0 - Reflected Cross-Site Scripting

NewsTicker WordPress plugin v1.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...

6.1CVSS8.2AI score0.00589EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.124 views

Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting

A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php id: CVE-2023-36306 info: name: Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | A...

6.1CVSS7AI score0.05313EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.97 views

Oracle Weblogic - Server-Side Request Forgery

An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. id: CVE-2014-4210 info: name: Oracle Weblogic - Server-Side Request Forgery author:...

5CVSS8.1AI score0.38152EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.1638 views

Pterodactyl Panel - Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. id: CVE-2025-49132 info: name: Pterodactyl Panel - Remote Code Execution...

10CVSS6.7AI score0.54677EPSS
SaveExploits30References3
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.5 views

CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

6.9CVSS0.00247EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.115 views

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-45542 info: name: MooSocial 3.1.8 - Cross-Site Scripting author...

6.1CVSS6.2AI score0.01635EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.468 views

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the uploadpostimage function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload...

9.8CVSS8.1AI score0.14321EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/11 5:22 a.m.226 views

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

8.6CVSS7.2AI score0.6663EPSS
SaveExploits2References5
Rows per page
Query Builder