Lucene search
+L

221826 matches found

Nuclei
Nuclei
added 2026/09/22 2:05 a.m.67 views

Joomla! Component com_jresearch - 'Controller' Local File Inclusion

A directory traversal vulnerability in jresearch.php in the J!Research comjresearch component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1340 info: name: Joomla! Component comjresearch - 'Controller' Local Fi...

5CVSS5.9AI score0.13621EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.66 views

CirCarLife Scada <4.3 - System Log Exposure

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI. CirCarLife is an internet-connected electric vehicle charging station. id: CVE-2018-12634 info: name: CirCarLife Scada 4.3 - System Log...

9.8CVSS8.2AI score0.56401EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.43 views

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. id: CVE-2018-7193 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

6.1CVSS6.4AI score0.03092EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.127 views

NagiosXI <= 5.4.12 `commandline.php` SQL injection

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. id: CVE-2018-10735 info: name: NagiosXI = 5.4.12 commandline.php SQL injection author: DhiyaneshDk severity: high description: | A SQL injection issue was discovered in Nagios XI before...

7.2CVSS7.3AI score0.24511EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.28 views

Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion

A directory traversal vulnerability in the iNetLanka Multiple root commultiroot component 1.0 and 1.1 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1954 info: name: Joomla! Component iNetLanka Multiple root 1.0 ...

7.5CVSS5.9AI score0.16152EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.36 views

Quest KACE SMA /common/run_cross_report.php 'fmt' XSS

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting. id: CVE-2018-11133 info: name: Quest KACE SMA /common/runcrossreport.php 'fmt' XSS author: iamnoooob,pdresearch severity: medium...

6.1CVSS6.8AI score0.08191EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.105 views

NagiosXI <= 5.4.12 logbook.php SQL injection

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. id: CVE-2018-10737 info: name: NagiosXI = 5.4.12 logbook.php SQL injection author: DhiyaneshDK severity: high description: | A SQL injection issue was discovered in Nagios XI before 5.4....

7.2CVSS7.3AI score0.24511EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.66 views

VelotiSmart Wifi - Directory Traversal

VelotiSmart WiFi B-380 camera devices allow directory traversal via the uc-http service 1.0.0, as demonstrated by /../../etc/passwd on TCP port 80. id: CVE-2018-14064 info: name: VelotiSmart Wifi - Directory Traversal author: 0xAkoko severity: critical description: VelotiSmart WiFi B-380 camera...

9.8CVSS8.2AI score0.13135EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.101 views

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

7.5CVSS7.2AI score0.59646EPSS
SaveExploits0
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.137 views

Webmin <1.997 - Authenticated Remote Code Execution

Webmin before 1.997 is susceptible to authenticated remote code execution via software/apt-lib.pl, which lacks HTML escaping for a UI command. An attacker can perform command injection attacks and thereby execute malware, obtain sensitive information, modify data, and/or gain full control over a...

9.8CVSS8.6AI score0.96049EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.28 views

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

5.3CVSS6.1AI score0.0687EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.95 views

PrestaShop - SQL Injection to Eval Injection

PrestaShop versions from 1.6.0.10 and before 1.7.8.7 contain an SQL injection caused by unsanitized user input, letting attackers chain the vulnerability to call PHP's Eval function, exploit requires attacker to send malicious input. id: CVE-2022-31181 info: name: PrestaShop - SQL Injection to Ev...

9.8CVSS8AI score0.06479EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.53 views

Wavlink - Improper Access Control

Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations. id: CVE-2022-48165 info: name: Wavlink -...

7.5CVSS7.3AI score0.03284EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.77 views

WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting

WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages. id: CVE-2021-24298 info: name: WordPress Simple...

6.1CVSS6.2AI score0.03451EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.85 views

Hue Magic 3.0.0 - Local File Inclusion

Hue Magic 3.0.0 is susceptible to local file inclusion via the res.sendFile API. id: CVE-2021-25864 info: name: Hue Magic 3.0.0 - Local File Inclusion author: 0xAkoko severity: high description: Hue Magic 3.0.0 is susceptible to local file inclusion via the res.sendFile API. impact: | The LFI...

7.5CVSS7.2AI score0.09331EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.153 views

WordPress BulletProof Security 5.1 Information Disclosure

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible /dbbackuplog.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up t...

5.3CVSS6.7AI score0.71688EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.75 views

Appspace 6.2.4 - Server-Side Request Forgery

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. id: CVE-2021-27670 info: name: Appspace 6.2.4 - Server-Side Request Forgery author: ritikchaddha severity: critical description: Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. impact...

9.8CVSS8.2AI score0.61274EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.88 views

Erxes <0.23.0 - Cross-Site Scripting

Erxes before 0.23.0 contains a cross-site scripting vulnerability. The value of topicID parameter is not escaped and is triggered in the enclosing script tag. id: CVE-2021-32853 info: name: Erxes 0.23.0 - Cross-Site Scripting author: dwisiswant0 severity: critical description: Erxes before 0.23.0...

9.6CVSS7.2AI score0.03125EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.62 views

AlquistManager Local File Inclusion

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access. id...

7.5CVSS7.7AI score0.09193EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.123 views

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure

Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. id: CVE-2021-28937 info: name: Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure...

7.5CVSS7.2AI score0.04155EPSS
SaveExploits1References5
Rows per page
Query Builder