Lucene search
+L

219943 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.77 views

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

9.8CVSS7.7AI score0.15207EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.83 views

Cacti < 1.2.25 Insecure Deserialization

Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. id: CVE-2023-30534 info: name: Cacti 1.2.25 Insecure Deserialization author: k0pak4 severity: medium description: | Cacti is an open source...

4.3CVSS7AI score0.02869EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.126 views

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

7.5CVSS7.2AI score0.1494EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.87 views

EyouCms v1.6.3 - Information Disclosure

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custommodelpath/recruit.filelist.txt. id: CVE-2023-37645 info: name: EyouCms v1.6.3 - Information Disclosure author: pussycat0x severity: medium description: | EyouCms v1.6.3 was discovered to...

5.3CVSS5.8AI score0.24931EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.106 views

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

7.5CVSS6.7AI score0.37304EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.125 views

Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting

A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php id: CVE-2023-36306 info: name: Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | A...

6.1CVSS7AI score0.05313EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.145 views

OpenCMS 14 & 15 - Cross Site Scripting

Cross-site scripting XSS vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. id: CVE-2023-6379 info: name: OpenCMS 14 & 15 - Cross Site Scripting author: msegoviag severity: medium description: | Cross-site scripting XSS vulnerability in Alkacon...

6.1CVSS6.2AI score0.01752EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.32 views

Seriously Simple Podcasting < 3.0.0 - Information Disclosure

The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address which by default is the admin email address via an unauthenticated crafted request. id: CVE-2023-6444 info: name: Seriously Simple Podcasting 3.0.0 - Information Disclosure author: s4e-io...

5.3CVSS5.7AI score0.02463EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.58 views

Easy Digital Downloads - Privilege Escalation

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. id: CVE-2023-30869 info: name: Easy Digital Downloads - Privilege Escalation author: daffainfo severity: critical...

9.8CVSS8.1AI score0.031EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.142 views

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

5.3CVSS5.9AI score0.02214EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.49 views

MLFlow < 2.8.1 - Sensitive Information Disclosure

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. id: CVE-2023-43472 info: name: MLFlow 2.8.1 - Sensitive Information Disclosure author: ritikchaddha severity: high description: | An issue in MLFlow versions...

7.5CVSS7.3AI score0.36582EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.63 views

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

6.1CVSS6.2AI score0.01347EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.53 views

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

9.8CVSS7.9AI score0.02041EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.34 views

NetMRI Unauthenticated SQL Injection via skipjackUsername

An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur. id: CVE-2025-32814 info: name: NetMRI Unauthenticated SQL Injection via skipjackUsername author: iamnoooob,pdresearch severity: critical description: | An issue was discovered in Infoblox NETMRI befo...

9.8CVSS7.5AI score0.36408EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.26 views

SPIP Saisies - Remote Code Execution

SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions. id: CVE-2025-71243 info: name: SPIP Saisies - Remote Code Execution author: omarkurt severity:...

9.8CVSS6.7AI score0.05126EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.47 views

ICTBroadcast - Command Injection

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

9.3CVSS7.8AI score0.05661EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.14 views

Branda WordPress plugin - Privilege Escalation

Branda WordPress plugin = 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request. id: CVE-2025-14998 info:...

9.8CVSS5.9AI score0.0181EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.17 views

Accept Donations with PayPal <= 1.5.2 - Open Redirect

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

4.7CVSS5.7AI score0.0049EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.58 views

BlogEngine CMS - Open Redirect

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect id: CVE-2023-33405 info: name: BlogEngine CMS - Open Redirect author: Shankar Acharya severity: medium description: | Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect impact: | Unauthenticated attackers can exploit...

6.1CVSS6.3AI score0.31265EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.137 views

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

9.8CVSS9AI score0.45401EPSS
SaveExploits1References2
Rows per page
Query Builder