Lucene search
+L

273696 matches found

Nuclei
Nuclei
added 2026/08/27 4:24 a.m.181 views

FoxCMS v.1.2.5 - Remote Code Execution

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. id: CVE-2025-29306 info: name: FoxCMS v.1.2.5 - Remote Code Execution author: ritikchaddha severity: critical description: | An issue in FoxCMS v.1.2.5 allows a...

9.8CVSS9.1AI score0.4628EPSS
SaveExploits11References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.105 views

WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution

WordPress Woody Ad Snippets prior to 2.2.5 is susceptible to cross-site scripting and remote code execution via admin/includes/class.import.snippet.php, which allows unauthenticated options import as demonstrated by storing a cross-site scripting payload for remote code execution. id:...

8.8CVSS8.5AI score0.18463EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.351 views

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

9.8CVSS9.1AI score0.31133EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.67 views

MindPalette NateMail 3.0.15 - Cross-Site Scripting

MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note...

6.1CVSS5.9AI score0.04019EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.485 views

Revive Adserver 4.2 - Remote Code Execution

Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...

9.8CVSS9AI score0.57022EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.88 views

Inspur ClusterEngine 4.0 - Remote Code Execution

Inspur ClusterEngine V4.0 is suscptible to a remote code execution vulnerability. A remote attacker can send a malicious login packet to the control server. id: CVE-2020-21224 info: name: Inspur ClusterEngine 4.0 - Remote Code Execution author: pikpikcu severity: critical description: Inspur...

10CVSS9.6AI score0.38745EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.182 views

SCIMono <0.0.19 - Remote Code Execution

SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system. id: CVE-2021-21479 info: name: SCIMono 0.0.19 - Remote Code Execution author: dwisiswant0 severit...

9.1CVSS8.7AI score0.10116EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.127 views

WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload

WordPress Backup Guard plugin before 1.6.0 is susceptible to authenticated arbitrary file upload. The plugin does not ensure that imported files are in SGBP format and extension, allowing high-privilege users to upload arbitrary files, including PHP, possibly leading to remote code execution. id:...

7.2CVSS8.2AI score0.84112EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.63 views

ListSERV Maestro <= 9.0-8 RCE

A struts-based OGNL remote code execution vulnerability exists in ListSERV Maestro before and including version 9.0-8. id: CVE-2010-1870 info: name: ListSERV Maestro = 9.0-8 RCE author: b0yd severity: medium description: A struts-based OGNL remote code execution vulnerability exists in ListSERV...

5CVSS8.2AI score0.92015EPSS
SaveExploits22References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.117 views

D-Link DNS-320 - Remote Code Execution

The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. id: CVE-2019-16057 info: name: D-Link DNS-320 - Remote Code Execution author: DhiyaneshDk severity: critical description: | The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerabl...

10CVSS8.8AI score0.87065EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.368 views

ZZZCMS 1.6.1 - Remote Code Execution

ZZZCMS zzzphp V1.6.1 is vulnerable to remote code execution via the inc/zzztemplate.php file because the parserIfLabel function's filtering is not strict, resulting in PHP code execution as demonstrated by the if:assert substring. id: CVE-2019-9041 info: name: ZZZCMS 1.6.1 - Remote Code Execution...

7.2CVSS8.1AI score0.31421EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.26 views

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

10CVSS9.7AI score0.42388EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.25 views

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

10CVSS6.5AI score0.03315EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.10 views

Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload

Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56290 info: name: Page Builder CK = 3.5.10 - Unauthenticated Arbitrary File Uplo...

10CVSS9.2AI score0.30375EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.34 views

DbGate - Remote Code Execution via Dynamic Import Bypass

DbGate versions = 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import. id:...

9.4CVSS6.2AI score0.01714EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.30 views

9Router <= 0.4.36 - Unauthenticated RCE

9Router = 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/ and /api/mcp/ entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, the...

10CVSS5.8AI score0.03352EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.19 views

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

9.8CVSS6.5AI score0.2506EPSS
SaveExploits12References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.38 views

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

9.8CVSS6.6AI score0.40992EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.52 views

Qwik - Unauthenticated RCE via server$ Deserialization

Qwik =1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require availability at runtime. id: CVE-2026-27971 info: name: Qwik - Unauthenticated RCE via server$ Deserialization...

9.8CVSS5.9AI score0.05416EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.170 views

Unauthenticated Remote Code Execution – Bricks <= 1.9.6

Bricks Builder is a popular WordPress development theme with approximately 25,000 active installations. It provides an intuitive drag-and-drop interface for designing and building WordPress websites. Bricks = 1.9.6 is vulnerable to unauthenticated remote code execution RCE which means that anybod...

10CVSS9.8AI score0.88234EPSS
SaveExploits19References5
Rows per page
Query Builder