Lucene search
+L

1118260 matches found

Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•74 views

Maian Cart <=3.8 - Remote Code Execution

Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. id: CVE-2021-32172 info: name: Maian Cart =3.8 to mitigate this vulnerability. reference: - https://dreyand.github.io/maian-cart-rce/ - https://github.com/DreyAnd/maian-cart-rce -...

9.8CVSS8.6AI score0.66433EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•46 views

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

10CVSS8.2AI score0.34619EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•198 views

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

9.9CVSS8.6AI score0.9384EPSS
SaveExploits11References3
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•46 views

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

10CVSS8.9AI score0.83214EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•83 views

vRealize Operations Manager API - Server-Side Request Forgery

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. id: CVE-2021-21975 info: name: vRealize Operation...

8.5CVSS7.7AI score0.7829EPSS
SaveExploits13References3
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•138 views

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

9.8CVSS9AI score0.46943EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•42 views

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

7.5CVSS7.6AI score0.51116EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•31 views

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

10CVSS8.6AI score0.38719EPSS
SaveExploits3References4
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•152 views

FOG Project < 1.5.10.34 - Remote Command Execution

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. id: CVE-2024-39914 info: name: FOG Project 1.5.10.34 - Remote...

9.8CVSS5.8AI score0.23237EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•11 views

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

9.4CVSS8.8AI score0.62459EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•56 views

ZenML ZenML Server - Improper Authentication

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. id: CVE-2024-25723 info:...

8.8CVSS7.1AI score0.70785EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•127 views

Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

9.8CVSS8.4AI score0.53113EPSS
SaveExploits1
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•311 views

Oracle WebLogic Server - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...

9.8CVSS8.5AI score0.50224EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•211 views

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

9.8CVSS8.1AI score0.34424EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•41 views

MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. id...

9.4CVSS8.9AI score0.44453EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•49 views

Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...

9.3CVSS6AI score0.7144EPSS
SaveExploits0References1
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•114 views

LimeSurvey 4.1.11 - Local File Inclusion

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. id: CVE-2020-11455 info: name: LimeSurvey 4.1.11 - Local File Inclusion author: daffainfo severity: critical...

9.8CVSS8.2AI score0.97179EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•38 views

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

9.8CVSS6.4AI score0.32782EPSS
SaveExploits9References3
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•168 views

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

9.8CVSS6.9AI score0.72917EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/27 2:09 a.m.•108 views

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

10CVSS7.4AI score0.59259EPSS
SaveExploits1References5
Rows per page
Query Builder