Lucene search
+L

213658 matches found

Nuclei
Nuclei
added 2026/09/12 2:04 a.m.102 views

Breeze <= 2.4.4 - Arbitrary File Upload

Breeze Cache WordPress plugin = 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetchgravatarfromremote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled. id:...

9.8CVSS8.2AI score0.27701EPSS
SaveExploits9References2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.201 views

Apache HTTP Server - ACL Bypass

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. id: CVE-2024-38473 info: name: Apache HTTP Server - ACL Bypass author: pdteam severity: high...

8.1CVSS6.8AI score0.25878EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.41 views

Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

9CVSS6.2AI score0.02374EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.64 views

Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion

A directory traversal vulnerability in the J!WHMCS Integrator comjwhmcs component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1977 info: name: Joomla! Component J!WHMCS Integrator 1.5.0 - Local File...

7.5CVSS5.9AI score0.07402EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.584 views

InfluxDB <1.7.6 - Authentication Bypass

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret aka shared secret. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

9.8CVSS7.2AI score0.30921EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.101 views

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. id: CVE-2022-30777 info: name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting author: 3th1cyuk1 severity: medium description: | Parallels H-Sphere 3.6.1713 contains a cross-site...

6.1CVSS6.2AI score0.02296EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.60 views

Geoserver - Server-Side Request Forgery

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. id: CVE-2021-40822 info: name: Geoserver - Server-Side Request Forgery author: For3stCo1d,aringo-bf severity: high description: GeoServer through 2.18.5 and 2.19.x throug...

7.5CVSS7.2AI score0.19259EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.51 views

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

9.8CVSS5.8AI score0.02663EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.70 views

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. id: CVE-2018-19386 info: nam...

6.1CVSS6.2AI score0.09044EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.469 views

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the uploadpostimage function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload...

9.8CVSS8.1AI score0.14321EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.74 views

Homematic CCU3 - Local File Inclusion

eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem, aka local file inclusion. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. id: CVE-2019-9726 info: name: Homematic CCU3 - Local...

7.5CVSS7.5AI score0.16342EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.193 views

Apache Superset < 4.0.2 - SQL Injection

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

9.8CVSS5.7AI score0.04433EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.102 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

9CVSS7.9AI score0.72182EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.58 views

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

8.8CVSS7.2AI score0.35534EPSS
SaveExploits7References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.133 views

RStudio Connect - Open Redirect

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. id: CVE-2022-38131 info: name: RStudio Connect - Open Redirect author: xxcdd severity: medium description: | RStudio Connect prior to...

6.1CVSS6.3AI score0.01663EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.48 views

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

9.8CVSS6.3AI score0.05265EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.118 views

WordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference

WordPress acf-to-rest-ap through 3.1.0 allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that can read sensitive information in the wpoptions table such as the login and pass values. id: CVE-2020-13700 info: name: WordPres...

7.5CVSS7.2AI score0.13463EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.206 views

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

9.8CVSS7.9AI score0.34424EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.106 views

FUDForum 3.1.0 - Cross-Site Scripting

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. id: CVE-2021-27519 info: name: FUDForum 3.1.0 - Cross-Site Scripting author: kh4sh3i severity: medium description: | FUDForum 3.1.0 contains a...

6.1CVSS6.3AI score0.07604EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.6 views

CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

6.9CVSS0.00522EPSS
SaveExploits0References3
Rows per page
Query Builder