Lucene search
+L

215385 matches found

Nuclei
Nuclei
added 2026/09/16 2:04 p.m.109 views

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

7.5CVSS8.4AI score0.55315EPSS
SaveExploits6References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.28 views

IceWarp Mail Server ≤11.4.0 - Open Redirect

IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs. id: CVE-2025-40630 info: name: IceWarp Mail Server ≤11.4.0 - Open Redirect author: DhiyaneshDK severity: medium...

6.1CVSS5.9AI score0.00494EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.18 views

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

7.2CVSS5.9AI score0.0056EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.125 views

YARPP <= 5.30.10 - Missing Authorization

The YARPP Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the /includes/yarppprosetdisplaytypes.php file in all versions up to, and including, 5.30.10. This makes it possible for unauthenticated attackers to set displ...

9.8CVSS5.7AI score0.44896EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.34 views

Simple Online Planning Tool <1.3.2 - Local File Inclusion

SOPlanning 1.32 contain a directory traversal in the filegetcontents function via a .. dot dot in the fichier parameter. id: CVE-2014-8676 info: name: Simple Online Planning Tool 1.3.2 - Local File Inclusion author: 0xAkoko severity: medium description: | SOPlanning 1.32 contain a directory...

5.3CVSS6.5AI score0.40779EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.89 views

Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in tests/notAutotestContactServicepauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 go, 2 contactId, or 3 campaignId parameter. id: CVE-2014-45...

6.1CVSS6.4AI score0.03902EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.61 views

Netsweeper 4.0.4 - Cross-Site Scripting

A cross-site scripting vulnerability in remotereporter/loadlogfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter. id: CVE-2014-9607 info: name: Netsweeper 4.0.4 - Cross-Site Scripting author: daffainfo severity: medium...

6.1CVSS6.3AI score0.04749EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.80 views

SourceBans <2.0 - Cross-Site Scripting

SourceBans before 2.0 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. id: CVE-2015-8349 info: name: SourceBans 2.0 - Cross-Site Scripting author: pikpikcu severity: medium description:...

6.1CVSS6.3AI score0.03263EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.72 views

Nexus Repository 2 - Remote Code Execution

A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1. id: CVE-2024-5082 info: name: Nexus Repository 2 - Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: hi...

7.1CVSS6.9AI score0.01959EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.156 views

Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled. id: CVE-2020-13125 info...

9.9CVSS7.5AI score0.08565EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.45 views

DevDojo Voyager <=1.8.0 - Cross-Site Scripting

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. id: CVE-2024-55416 info: name: DevDojo Voyager =1.8.0 - Cross-Site Scripting author:...

3.5CVSS8.4AI score0.20273EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.68 views

ifw8 Router ROM v4.31 - Credential Discovery

ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code. id: CVE-2019-16313 info: name: ifw8 Router ROM v4.31 - Credential Discovery author: pikpikcu severity: high description: ifw8 Router ROM v4.31 is vulnerable to credential disclosure via...

7.5CVSS8AI score0.46109EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.60 views

HotelDruid 2.3.0 - Cross-Site Scripting

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. id: CVE-2019-8937 info: name: HotelDruid 2.3.0 - Cross-Site Scripting author: LogicalHunte...

6.1CVSS6.2AI score0.10633EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.68 views

node-srv - Local File Inclusion

node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. id: CVE-2018-3714 info: name: node-srv - Local File Inclusion author: madrobot severity: medium description: node-srv is vulnerable to local fil...

6.5CVSS6.9AI score0.08632EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.227 views

Apache Airflow <1.10.14 - Authentication Bypass

Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session. id: CVE-2020-17526 info: name: Apache Airflow 1.10.14 -...

7.7CVSS7.2AI score0.23336EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.42 views

MindsDB - Remote Code Execution

MindsDB 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication. id: CVE-2026-27483 info: name: MindsDB - Remote Code Execution author:...

8.8CVSS6.3AI score0.11113EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.11 views

FacturaScripts - Unauthenticated phpinfo Disclosure

Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication. id: CVE-2026-42878 info: name:...

5.3CVSS5.7AI score0.00552EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.44 views

WebPort 1.19.1 - Cross-Site Scripting

Web Port 1.19.1 is vulnerable to cross-site scripting via the /log type parameter. id: CVE-2019-12461 info: name: WebPort 1.19.1 - Cross-Site Scripting author: pikpikcu severity: medium description: Web Port 1.19.1 is vulnerable to cross-site scripting via the /log type parameter. impact: |...

6.1CVSS6.2AI score0.09916EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.67 views

Vite Development Server - Path Traversal

Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files. id: CVE-2025-31125 info: name: Vite Development Server...

7.5CVSS6.4AI score0.58462EPSS
SaveExploits9References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.97 views

Apache APISIX - Insufficiently Protected Credentials

Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. id: CVE-2020-13945 info: name: Apache...

6.5CVSS7.1AI score0.72976EPSS
SaveExploits4References5
Rows per page
Query Builder