Lucene search
+L

213639 matches found

Nuclei
Nuclei
added 2026/09/12 2:04 a.m.41 views

WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting

WordPress Plugin MapPress before version 2.73.4 does not sanitize and escape the 'mapid' parameter before outputting it back in the "Bad mapid" error message, leading to reflected cross-site scripting. id: CVE-2022-0208 info: name: WordPress Plugin MapPress 2.73.4 - Cross-Site Scripting author:...

6.1CVSS6.3AI score0.02038EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.95 views

FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

6.1CVSS6.3AI score0.1052EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.66 views

Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. id: CVE-2022-48164 info: name: Wavlink WL-WN533A8 M33A8.V5030.190716 - Information...

7.5CVSS7.1AI score0.03096EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.34 views

74cmsSE v3.4.1 - Arbitrary File Read

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php. id: CVE-2022-26271 info: name: 74cmsSE v3.4.1 - Arbitrary File Read author: ritikchaddha severity: high description: | 74cmsSE v3.4.1 was discovered to contain a...

7.5CVSS7.5AI score0.04515EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.76 views

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

9.8CVSS7.9AI score0.14462EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.33 views

Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. id: CVE-2022-23397 info: name: Cedar Gate EZ-NET = 6.8.0 - Cross-Si...

6.1CVSS6.3AI score0.01028EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.62 views

ZEROF Web Server 2.0 - Cross-Site Scripting

ZEROF Web Server 2.0 allows /admin.back cross-site scripting. id: CVE-2022-25323 info: name: ZEROF Web Server 2.0 - Cross-Site Scripting author: pikpikcu severity: medium description: ZEROF Web Server 2.0 allows /admin.back cross-site scripting. impact: | Successful exploitation of this...

6.1CVSS6AI score0.03231EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.56 views

Galera WebTemplate 1.0 Directory Traversal

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. id: CVE-2021-40960 info: name: Galera WebTemplate 1.0 Directory Traversal author: daffainfo severity: critical description: Galera WebTemplate 1.0 is affected ...

9.8CVSS8AI score0.0992EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.100 views

Lucee Admin - Remote Code Execution

Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 contains an unauthenticated remote code execution vulnerability. id: CVE-2021-21307 info: name: Lucee Admin - Remote Code Execution author: dhiyaneshDk severity: critical description: Lucee Admin before versions 5.3.7.47, 5.3.6.68 or...

9.8CVSS8.3AI score0.89189EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.77 views

Popup by Supsystic <1.10.5 - Cross-Site scripting

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. id: CVE-2021-24275 info: name: Popup by Supsystic 1.10.5 - Cross-Site scripting author: dhiyaneshDK severity:...

6.1CVSS6.2AI score0.18165EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.29 views

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

9.8CVSS8.1AI score0.06691EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.93 views

Labstack Echo 4.8.0 - Open Redirect

Labstack Echo 4.8.0 contains an open redirect vulnerability via the Static Handler component. An attacker can leverage this vulnerability to cause server-side request forgery, making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-400...

9.6CVSS8.1AI score0.02575EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.111 views

WordPress WP JobSearch <1.5.1 - Cross-Site Scripting

WordPress WP JobSearch plugin prior to 1.5.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

6.1CVSS6.3AI score0.01847EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.65 views

Sophos Mobile managed on-premises - XML External Entity Injection

An XML External Entity XXE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. id: CVE-2022-3980 info: name: Sophos Mobile managed on-premises - XML External Entity Injection author: dabla...

9.8CVSS8.2AI score0.08413EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.283 views

WordPress Newspaper < 12 - Cross-Site Scripting

WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized...

6.1CVSS6.1AI score0.01018EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.40 views

WWBN AVideo 11.6 - Cross-Site Scripting

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. id: CVE-2022-32772 info: name: WWBN AVideo 11.6 - Cross-Site Scripting author: arafatansari severity: medi...

9.6CVSS7.3AI score0.03963EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.83 views

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the callback component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch othe...

6.1CVSS6.3AI score0.01425EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.45 views

WordPress Sensei LMS <4.5.0 - Information Disclosure

WordPress Sensei LMS plugin before 4.5.0 is susceptible to information disclosure. The plugin does not have proper permissions set in a REST endpoint, which can allow an attacker to access private messages. id: CVE-2022-2034 info: name: WordPress Sensei LMS 4.5.0 - Information Disclosure author:...

5.3CVSS5.9AI score0.02528EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.86 views

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

7.2CVSS7.3AI score0.04563EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.46 views

WordPress <= 6.2 - Server Side Request Forgery

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. id: CVE-2022-3590 info: name: WordPress = 6.2 - Server Side...

5.9CVSS6.1AI score0.0315EPSS
SaveExploits5References2
Rows per page
Query Builder