Lucene search
+L

35048 matches found

Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/06/05 12:00 a.m.•2 views

CVE-2026-50235: Improper Neutralization of Input During Web Page Generation

Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScri...

6.1CVSS6.1AI score0.00263EPSS
SaveExploits2References2
OSV
OSV
•added 2026/06/04 7:27 p.m.•27 views

GHSA-8V9P-G828-V98F Shopware: Admin Account Takeover via User Recovery Hash Exposure

Summary A low-privilege admin user with userrecovery:read ACL can take over any admin account. The attacker triggers password recovery for the victim unauthenticated endpoint, reads the recovery hash from the Admin API search endpoint, then uses the hash to reset the victim's password another...

6.8CVSS5.8AI score0.00457EPSS
SaveExploits0References4
OSV
OSV
•added 2026/06/04 6:55 p.m.•19 views

GHSA-HGJH-6WJ8-GCGF WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via $GET'search' in AVideo YouTubeAPI Gallery Pagination Summary A reflected Cross-Site Scripting vulnerability CWE-79 in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim...

6.1CVSS6.2AI score0.00286EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
•added 2026/06/04 6:55 p.m.•21 views

WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via $GET'search' in AVideo YouTubeAPI Gallery Pagination Summary A reflected Cross-Site Scripting vulnerability CWE-79 in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim...

6.1CVSS6.2AI score0.00286EPSS
SaveExploits0References3Affected Software1
Snyk
Snyk
•added 2026/06/04 6:55 p.m.•9 views

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS via the $GET'search' parameter in the YouTubeAPI gallery pagination process. An attacker can execute arbitrary JavaScript in a victim's...

6.1CVSS5.9AI score0.00286EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2026/06/04 4:15 p.m.•27 views

php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

6.5CVSS5.8AI score0.00345EPSS
SaveExploits0References5
NVD
NVD
•added 2026/06/04 2:16 p.m.•26 views

CVE-2019-25732

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS0.00262EPSS
SaveExploits0References3
attackerkb
attackerkb
•added 2026/06/04 1:22 p.m.•10 views

CVE-2019-25732

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS6.1AI score0.00262EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
•added 2026/06/04 1:22 p.m.•49 views

CVE-2019-25732 PHP EI-Tube Script 3 SQL Injection via search parameter

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS0.00262EPSS
SaveExploits0References3
CVE
CVE
•added 2026/06/04 1:22 p.m.•42 views

CVE-2019-25732

CVE-2019-25732 affects PHP EI-Tube Script 3. The vulnerability is an SQL injection in the search parameter that allows unauthenticated attackers to send crafted GET requests to the search endpoint to extract sensitive data (usernames, passwords, version details). Root cause is improper handling/e...

8.8CVSS6.1AI score0.00262EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/06/04 1:22 p.m.•30 views

EUVD-2019-20168

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS6.1AI score0.00262EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/06/04 1:22 p.m.•15 views

CVE-2019-25732 PHP EI-Tube Script 3 SQL Injection via search parameter

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS6.1AI score0.00262EPSS
SaveExploits0References3
The Hacker News
The Hacker News
•added 2026/06/04 9:51 a.m.•43 views

Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System TDS and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework. "The sites are...

5.8AI score
SaveExploits0
Packet Storm News
Packet Storm News
•added 2026/06/04 12:00 a.m.•43 views

RedEdit: Agentic Red-Teaming of Image Safety Classifiers Via MCTS-Guided Photo-Editing

Image safety classifiers serve as a critical component of contemporary content moderation systems on the internet. However, their resilience against user-style malicious image editing remains underexplored. Such behaviors are highly prevalent in daily scenarios but difficult to fully reproduce. T...

5.5AI score
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/06/04 12:00 a.m.•31 views

PT-2026-46865

Unauthenticated Reflected XSS via $ GET'search' in AVideo YouTubeAPI Gallery Pagination Summary A reflected Cross-Site Scripting vulnerability CWE-79 in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim...

6.1CVSS6.2AI score
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/04 12:00 a.m.•34 views

PT-2026-46852

Summary A low-privilege admin user with user recovery:read ACL can take over any admin account. The attacker triggers password recovery for the victim unauthenticated endpoint, reads the recovery hash from the Admin API search endpoint, then uses the hash to reset the victim's password another...

6.8CVSS5.8AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/04 12:00 a.m.•36 views

PT-2026-46894

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An unauthenticated Reflected Cross-Site Scripting XSS issue exists in the AVideo YouTubeAPI plugin. The problem occurs because the search query parameter is concatenated directly into the href attribut...

6.1CVSS6.3AI score0.00286EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/04 12:00 a.m.•37 views

PT-2026-46202

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS6.1AI score0.00262EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/04 12:00 a.m.•58 views

PT-2026-46232

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.2 Description The Shareable Playground also known as Public Flows feature allows unauthenticated users to execute workflows via a link. A flaw in the '/api/v1/build public tmp' endpoint enables attackers to execu...

9.6CVSS6.2AI score0.00783EPSS
SaveExploits2References18
CNNVD
CNNVD
•added 2026/06/04 12:00 a.m.•22 views

PHP EI-Tube Script SQL注入漏洞

The PHP EI-Tube Script is a video website construction system developed by Elis Atef. The PHP EI-Tube Script has a SQL injection vulnerability. This vulnerability arises from injecting malicious code through the search parameter, which may allow unauthenticated attackers to execute arbitrary SQL...

8.8CVSS6.2AI score0.00262EPSS
SaveExploits0References3
Rows per page
Query Builder