Lucene search
+L

37001 matches found

Cvelist
Cvelist
•added 2026/05/05 11:24 a.m.•61 views

CVE-2023-54349 AmazCart CMS 3.4 Reflected Cross-Site Scripting via Search

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search functionality. Attackers can enter script tags in the search box to execute arbitrary JavaScript that fires when...

6.1CVSS0.00265EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2026/05/05 2:20 a.m.•12 views

CVE-2026-40201

@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file...

5.4CVSS5.8AI score0.00298EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/05 12:18 a.m.•37 views

EUVD-2026-25590

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams...

3.7CVSS5.8AI score0.00264EPSS
SaveExploits1References2
OSV
OSV
•added 2026/05/05 12:18 a.m.•11 views

GHSA-XHJH-PMCV-23JW Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams Summary The encode function in lib/helpers/AxiosURLSearchParams.js contains a character mapping charMap at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent'\x00'...

3.7CVSS5.9AI score0.00264EPSS
SaveExploits1References3
CNNVD
CNNVD
•added 2026/05/05 12:00 a.m.•21 views

AmazCart CMS 跨站脚本漏洞

AmazCart CMS is an e-commerce content management system developed by the AmazCart company. Version 3.4 of AmazCart CMS has a cross-site scripting vulnerability. This vulnerability stems from a reflective cross-site scripting flaw, allowing unauthenticated attackers to inject malicious scripts...

6.1CVSS5.9AI score0.00265EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/05/05 12:00 a.m.•22 views

PT-2026-37004

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search functionality. Attackers can enter script tags in the search box to execute arbitrary JavaScript that fires when...

6.1CVSS5.9AI score0.00265EPSS
SaveExploits0References5
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/05/05 12:00 a.m.•3 views

CVE-2023-54349: Improper Neutralization of Input During Web Page Generation

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search functionality. Attackers can enter script tags in the search box to execute arbitrary JavaScript that fires when...

6.1CVSS6.1AI score0.00265EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
•added 2026/05/04 10:04 p.m.•18 views

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

Summary Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. Details Net::IMAP's...

9.8CVSS5.6AI score0.00519EPSS
SaveExploits0References12Affected Software1
OSV
OSV
•added 2026/05/04 10:04 p.m.•48 views

GHSA-HM49-WCQC-G2XG net-imap vulnerable to command Injection via "raw" arguments to multiple commands

Summary Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. Details Net::IMAP's...

5.8CVSS5.6AI score0.00519EPSS
SaveExploits0References12
RedhatCVE
RedhatCVE
•added 2026/05/04 8:21 p.m.•22 views

CVE-2026-4061

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'mapposttype' parameter in all versions up to, and including, 1.13.18. This is due to the SearchResults hook explicitly calling stripslashesdeep$POST which removes WordPress magic quotes protection, followed by...

7.5CVSS5.9AI score0.00505EPSS
SaveExploits0References1
OSV
OSV
•added 2026/05/04 6:30 p.m.•27 views

GHSA-35XX-9XRG-GWHF Apache Atlas has a Code Injection Vulnerability

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas. Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data. Affected...

7.1CVSS5.8AI score0.006EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
•added 2026/05/04 6:30 p.m.•32 views

Apache Atlas has a Code Injection Vulnerability

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas. Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data. Affected...

8.1CVSS5.8AI score0.006EPSS
SaveExploits0References4Affected Software1
attackerkb
attackerkb
•added 2026/05/04 6:27 p.m.•6 views

CVE-2026-42229

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows...

5.3CVSS5.8AI score0.00593EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
•added 2026/05/04 6:27 p.m.•65 views

CVE-2026-42229 n8n: SQL Injection in SeaTable Node

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows...

5.3CVSS0.00593EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/05/04 6:27 p.m.•8 views

CVE-2026-42229 n8n: SQL Injection in SeaTable Node

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows...

5.3CVSS5.8AI score0.00593EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/04 6:27 p.m.•25 views

EUVD-2026-27098

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows...

5.3CVSS5.8AI score0.00593EPSS
SaveExploits0References1
OSV
OSV
•added 2026/05/04 6:27 p.m.•17 views

CVE-2026-42229 n8n: SQL Injection in SeaTable Node

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows...

5.3CVSS6.6AI score
SaveExploits0References3
CVE
CVE
•added 2026/05/04 6:27 p.m.•46 views

CVE-2026-42229

CVE-2026-42229 describes an SQL injection in the SeaTable node of the open-source n8n workflow automation platform. The vulnerability affects SeaTable node operations row:search and row:get when user-controlled input is concatenated into SQL strings without proper escaping/parameterization. Explo...

8.8CVSS5.8AI score0.00593EPSS
SaveExploits0References1Affected Software1
Snyk
Snyk
•added 2026/05/04 5:28 p.m.•15 views

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the DSL search endpoint. An attacker can execute arbitrary code by placing malicious Gremlin traversal logic within grammar-allowed characters to access unintended data. Note: This is only exploitable if the...

8.1CVSS6.2AI score0.006EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/04 3:17 p.m.•18 views

EUVD-2026-26979

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...

7.1CVSS5.8AI score0.006EPSS
SaveExploits0References1
Rows per page
Query Builder