Lucene search
+L

213887 matches found

Nuclei
Nuclei
added 2026/09/13 4:24 p.m.48 views

Zyxel - Cross-Site Scripting

Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mpidx...

6.1CVSS6.2AI score0.2118EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.52 views

Cisco RV110W RV130W RV215W Router - Information leakage

A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this...

5.3CVSS5.9AI score0.41657EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.68 views

Seagate NAS OS 4.3.15.1 - Server Information Disclosure

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.getinfos. id: CVE-2018-12296 info: name: Seagate NAS OS 4.3.15.1 - Server Information...

7.5CVSS7.2AI score0.11337EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.44 views

CirCarLife <4.3 - Improper Authentication

CirCarLife before 4.3 is susceptible to improper authentication. An internal installation path disclosure exists due to the lack of authentication for /html/repository.System. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16668 inf...

5.3CVSS7.2AI score0.09512EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.41 views

WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution. id: CVE-2018-17207 info: name:...

9.8CVSS8.3AI score0.60086EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.68 views

WordPress JSmol2WP <=1.07 - Cross-Site Scripting

WordPress JSmol2WP version 1.07 and earlier is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. id: CVE-2018-20462 info: name: WordPress JSmol2WP =1.07 - Cross-Site Scripting author: daffainfo severity: medium...

7.5CVSS7AI score0.13187EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.46 views

Eventum <3.4.0 - Open Redirect

Eventum before 3.4.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16761 info: name: Eventum 3.4.0 - Open Redirect author: 0xAkoko severity:...

6.1CVSS6.2AI score0.02201EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.120 views

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter. id: CVE-2018-20824 info: name: Atlassian Jira WallboardServlet 7.13.1 - Cross-Site Scripting author:...

6.1CVSS6.4AI score0.37986EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.53 views

LOYTEC LGATE-902 6.3.2 - Local File Inclusion

LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories including critical system files that are stored outside the root folder of the web application running on the device. This can be used to read...

7.8CVSS7.2AI score0.18611EPSS
SaveExploits3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.53 views

Dolibarr <7.0.2 - Cross-Site Scripting

Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. id: CVE-2018-10095 info: name: Dolibarr 7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium...

6.1CVSS6.9AI score0.86988EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.94 views

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the ping function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through t...

10CVSS8.4AI score0.39544EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.79 views

Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 is vulnerable to cross-site scripting via the AJAX and html web clients. id: CVE-2018-14013 info: name: Synacor Zimbra Collaboration Suite Collaboration 8.8.11 - Cross-Site Scripting author: pikpikcu severity: medium description:...

6.1CVSS6.2AI score0.07436EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.38 views

ThinkPHP < 3.2.4 - Remote Code Execution

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via the s parameter in index.php through the invokefunction functionality. id: CVE-2019-9082 info: name: ThinkPHP 3.2.4 - Remote Code Execution author: 0xanis severity: high description: |...

9.3CVSS8.8AI score0.97419EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.70 views

WordPress Sell Media 2.4.1 - Cross-Site Scripting

WordPress Plugin Sell Media v2.4.1 contains a cross-site scripting vulnerability in /inc/class-search.php that allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field. id: CVE-2019-6112 info: name: WordPress Sell Media 2.4.1 -...

6.1CVSS6.4AI score0.09221EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.39 views

AudioCodes 420HD - Remote Code Execution

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow remote code execution. id: CVE-2018-10093 info: name: AudioCodes 420HD - Remote Code Execution author: wisnupramoedya severity: high description: | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow...

9CVSS7.8AI score0.6819EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.33 views

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. id: CVE-2018-15811 info: name: DotNetNuke...

7.5CVSS7.2AI score0.74048EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.49 views

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...

7.5CVSS7.3AI score0.38988EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.48 views

CirCarLife <4.3 - Improper Authentication

CirCarLife before 4.3 is susceptible to improper authentication. A PLC status disclosure exists due to lack of authentication for /html/devstat.html. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16670 info: name: CirCarLife 4.3 -...

5.3CVSS6.6AI score0.24568EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.59 views

Monstra CMS <=3.0.4 - Cross-Site Scripting

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

6.1CVSS6.8AI score0.04733EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.44 views

Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion

Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities. id: CVE-2018-8727 info: name: Mirasys DVMS Workstation =5.12.7 to mitigate the LFI vulnerability. reference: -...

7.5CVSS7.3AI score0.08005EPSS
SaveExploits5References4
Rows per page
Query Builder