Lucene search
+L

215459 matches found

Nuclei
Nuclei
added 2026/09/14 5:13 a.m.35 views

AdPush < 1.44 - Cross-Site Scripting

The adsense-plugin aka Google AdSense plugin before 1.44 for WordPress has multiple XSS issues. id: CVE-2017-18487 info: name: AdPush 1.44 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The adsense-plugin aka Google AdSense plugin before 1.44 for WordPress has multip...

6.1CVSS6.2AI score0.01458EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.55 views

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

6.1CVSS6.2AI score0.03419EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.57 views

PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting

The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. id: CVE-2017-18529 info: name: PromoBar by BestWebSoft 1.1.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. impact: |...

6.1CVSS6.2AI score0.01621EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.40 views

Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. id: CVE-2017-18556 info: name: Google Analytics by BestWebSoft 1.7.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-google-analytics plugin before 1.7.1 for WordPress has...

6.1CVSS6.2AI score0.01384EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.27 views

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

5.3CVSS5.7AI score0.01128EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.24 views

phpLDAPadmin <= 1.2.3 - Reflected XSS

phpLDAPadmin = 1.2.3 contains a reflected cross-site scripting caused by unsanitized input in htdocs/entrychooser.php via the form, element, rdn, or container parameter, letting attackers execute malicious scripts in victim browsers, exploit requires sending crafted input. id: CVE-2017-11107 info...

6.1CVSS6.4AI score0.02069EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.163 views

Odoo 8.0/9.0/10.0 - Local File Inclusion

Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.fileopen. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-9416 info: name: Odoo 8.0/9.0/10.0 -...

6.5CVSS7AI score0.05651EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.114 views

OpenCms 14 & 15 - Open Redirect

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template id: CVE-2023-6380 info: name: OpenCms 14 & 15 - Open Redirect author: MiguelSegoviaGil severity: medium description: | Open redirect vulnerability has been found in the Open C...

6.1CVSS6AI score0.01594EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.75 views

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

6.1CVSS6.3AI score0.01652EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.39 views

WordPress heat-trackr 1.0 - Cross-Site Scripting

WordPress heat-trackr 1.0 contains a cross-site scripting vulnerability via heat-trackrabtestadd.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

6.1CVSS6.6AI score0.03415EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.73 views

Atom CMS v2.0 - SQL Injection

Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php. id: CVE-2022-25488 info: name: Atom CMS v2.0 - SQL Injection author: theamanrawat severity: critical description: | Atom CMS v2.0 was discovered to contain a SQL injection...

9.8CVSS8AI score0.07148EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.53 views

WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting

WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. id: CVE-2017-18536 info: name: WordPress Stop User Enumeration =1.3.7 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress Stop User Enumeration 1.3.7 an...

6.1CVSS6AI score0.0203EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.59 views

EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

6.1CVSS6.1AI score0.01224EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.151 views

Dify v1.6.0 - Server-Side Request Forgery

Dify v1.6.0 contains a server side request forgery caused by improper validation in controllers.console.remotefiles.RemoteFileUploadApi, letting attackers make arbitrary requests from the server, exploit requires network access. id: CVE-2025-56520 info: name: Dify v1.6.0 - Server-Side Request...

5.3CVSS5.9AI score0.00696EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.63 views

SRS - Command Injection

SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerable to a drive-by command injection. id: CVE-2023-34105 info: name: SRS - Command Injection author: iamnoooob,rootxharsh,pdresearch severity: high description: | SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerab...

7.5CVSS7.3AI score0.08689EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.89 views

Uncanny Toolkit for LearnDash - Open Redirection

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. id: CVE-2023-34020 info: name: Uncanny Toolk...

6.1CVSS7.7AI score0.00963EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.53 views

Next.js Middleware - Server-Side Request Forgery

In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next, an attacker could exploit this behavior to perform Server-Side Request Forgery SSRF attacks. id: CVE-2025-57822 info: name: Next.js Middleware - Server-Side Request Forgery author:...

8.2CVSS5.9AI score0.02495EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.3 views

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

9.8CVSS0.0062EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.21 views

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

7.6CVSS5.8AI score0.00625EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.24 views

SquirrelMail Address Add 1.4.2 - Cross-Site Scripting

SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

4.3CVSS6.3AI score0.03436EPSS
SaveExploits3References2
Rows per page
Query Builder