Lucene search
+L

258555 matches found

BDU FSTEC
BDU FSTEC
added 1 hour ago49 views

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

10CVSS7AI score0.00412EPSS
SaveExploits0References11Affected Software9
GithubExploit
GithubExploit
added 4 hours ago14 views

Exploit for Unrestricted Upload of File with Dangerous Type in Rsjoomla Rsfiles\!

CVE-2026-57827 — RSFiles! Unauthenticated File Upload → RCE...

10CVSS5.5AI score0.00405EPSS
SaveExploits4
NVD
NVD
added 6 hours ago9 views

CVE-2026-16062

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

SaveExploits0References1
Cvelist
Cvelist
added 6 hours ago5 views

CVE-2026-16062 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 6 hours ago4 views

CVE-2026-16062

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

6.2AI score
SaveExploits0References1
CVE
CVE
added 6 hours ago14 views

CVE-2026-16062

The CVE concerns the WordPress plugin Event Booking Manager for WooCommerce (pre-5.3.7). Deserialization of user-controlled input in event content fields allows users with Contributor-level access and above to inject PHP objects. The vulnerability does not introduce a POP chain by itself, but if ...

6.2AI score
SaveExploits0References1
Nuclei
Nuclei
added 9 hours ago113 views

IceWarp Mail Server Deep Castle 2 v.13.0.1.2 - Open Redirect

An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL. id: CVE-2023-40779 info: name: IceWarp Mail Server Deep Castle 2 v.13.0.1.2 - Open Redirect author: r3Y3r53 severity: medium description: | An issue in...

6.1CVSS6.9AI score0.01355EPSS
SaveExploits0References3
Nuclei
Nuclei
added 9 hours ago432 views

Bitrix Component - Cross-Site Scripting

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim ha...

9.8CVSS7.9AI score0.04973EPSS
SaveExploits1References3
Nuclei
Nuclei
added 9 hours ago484 views

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

6.5CVSS6.9AI score0.06583EPSS
SaveExploits3References5
Nuclei
Nuclei
added 9 hours ago259 views

Weaver E-Office 9.5 - Remote Code Execution

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit h...

9.8CVSS6.4AI score0.32895EPSS
SaveExploits4References5
Nuclei
Nuclei
added 9 hours ago102 views

VMware Aria Operations for Networks - Remote Code Execution

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. id:...

8.8CVSS8.4AI score0.82282EPSS
SaveExploits0References2
Nuclei
Nuclei
added 9 hours ago103 views

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

9.8CVSS8.3AI score0.96116EPSS
SaveExploits16References5
Nuclei
Nuclei
added 9 hours ago134 views

Simple URLs < 115 - Cross Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-0099 info: name: Simple URLs 115 - Cross Site Scripting author: r3Y3r53 severit...

6.1CVSS6.2AI score0.01726EPSS
SaveExploits6References5
Nuclei
Nuclei
added 9 hours ago62 views

Samsung MagicINFO 9 Server - File Upload & Remote Code Execution

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority. id: CVE-2025-4632 info: name: Samsung MagicINFO 9 Server - File Upload & Remote Code Execution author: s4e-i...

9.8CVSS8.2AI score0.23953EPSS
SaveExploits4References4
Nuclei
Nuclei
added 9 hours ago22 views

Schneider Electric U.motion Builder - Remote Code Execution

U.motion Builder 1.3.4 contains a remote code execution vulnerability caused by improper input sanitization, allowing attackers to execute arbitrary system commands through crafted input parameters. id: CVE-2018-7841 info: name: Schneider Electric U.motion Builder - Remote Code Execution author:...

9.8CVSS8.8AI score0.72675EPSS
SaveExploits6References4
Nuclei
Nuclei
added 9 hours ago31 views

SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution

A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the eval function within the Perl CGI component ciwweb.pl, where attacker-supplied input inside hidRandomACARAT is directly...

10CVSS9AI score0.4942EPSS
SaveExploits4References3
Nuclei
Nuclei
added 9 hours ago31 views

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function hooked via the 'addbookingtype' route in all versions up to, and including, 1.0.4. id: CVE-2025-6058 info: name: WPBookit "; ifisset$GET"cmd" echo "";...

9.8CVSS5.6AI score0.05649EPSS
SaveExploits2References3
Nuclei
Nuclei
added 9 hours ago13 views

Apache Unomi - Remote Code Execution

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code. id: CVE-2020-11975 info: name: Apache Unomi -...

10CVSS8.1AI score0.29885EPSS
SaveExploits3References4
Nuclei
Nuclei
added 9 hours ago21 views

Pandora FMS <=7.0NG.722 - Remote Code Execution

Pandora FMS versions =7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload CVE-2018-11221 and a local file inclusion CVE-2018-11222. An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of t...

9.8CVSS8.1AI score0.06534EPSS
SaveExploits1References3
Nuclei
Nuclei
added 9 hours ago19 views

Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution

service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 6.4.120822 allows a remote attacker to execute code via shell metacharacters in the kuid parameter. id: CVE-2019-20504 info: name: Dell KACE Systems Management Appliance K1000 6.4.120756 - Remote Code Execution...

9.8CVSS8AI score0.0955EPSS
SaveExploits1References3
Rows per page
Query Builder