Lucene search
+L

1444696 matches found

Nuclei
Nuclei
added 2026/09/15 5:39 a.m.96 views

CasaOS < 0.4.4 - Authentication Bypass via Random JWT Token

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

9.8CVSS8.4AI score0.06844EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.93 views

Seo By 10Web < 1.2.7 - Cross-Site Scripting

The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id:...

4.8CVSS6.4AI score0.00909EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.36 views

Emby Server - Authentication Bypass

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

9.1CVSS7.7AI score0.01699EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.121 views

Milesight Routers - Information Disclosure

A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router...

7.5CVSS7.2AI score0.59609EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.80 views

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

6.1CVSS6.2AI score0.01199EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.213 views

Adobe ColdFusion WDDX Deserialization Gadgets

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-44353 info: name: Adobe ColdFusion WDDX...

9.8CVSS8.4AI score0.80178EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.121 views

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

8.2CVSS6.5AI score0.55861EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.70 views

MLflow < 2.11.3 - Path Traversal

MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information. id: CVE-2024-2928 info: name: MLflow 2.11.3 - Path Traversal autho...

7.5CVSS7.4AI score0.21847EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.85 views

Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...

7.5CVSS7.2AI score0.02518EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.60 views

TileServer API - Cross Site Scripting

tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting XSS vulnerability via the component /data/v3/?key. id: CVE-2024-35627 info: name: TileServer API - Cross Site Scripting author: DhiyaneshDK severity: medium description: | tileserver-gl up to v4.4.10 was discovered to...

6.1CVSS5.5AI score0.00957EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.44 views

WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

9.8CVSS8.5AI score0.04082EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.95 views

CData Arc < 23.4.8839 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. id: CVE-2024-31850 info: name: CData Arc 23.4.88...

9.8CVSS7.9AI score0.08086EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.9 views

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

7.5CVSS5.8AI score0.03057EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.50 views

Sympa version =>6.2.16 - Cross-Site Scripting

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. id: CVE-2018-1000671 info: name: Sympa version =6.2.16 -...

6.1CVSS6.7AI score0.03982EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.411 views

Roxy Fileman 1.4.5 - Unrestricted File Upload

Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. id: CVE-2018-20526 info: name: Roxy Fileman 1.4.5 -...

9.8CVSS8.1AI score0.73056EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.59 views

Joomla! Component Arcade Games 1.0 - Local File Inclusion

A directory traversal vulnerability in the Arcade Games comarcadegames component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1714 info: name: Joomla! Component Arcade Games 1.0 - Local File Inclusion autho...

5CVSS5.9AI score0.18703EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.110 views

kkFileView 4.0.0 - Cross-Site Scripting

kkFileView 4.0.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. id: CVE-2022-29349 info: name: kkFileView 4.0.0 - Cross-Site Scripting author: arafatansari severity: medium description: | kkFileView 4.0.0...

6.1CVSS6.2AI score0.0175EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.47 views

Joomla! Component JProject Manager 1.0 - Local File Inclusion

A directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1469 inf...

6.8CVSS6.1AI score0.08163EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.98 views

Lansweeper Unauthenticated SQL Injection

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. id: CVE-2019-13462 info: name: Lansweeper Unauthenticated SQL Injection author: divyamudgal severity: critical description: Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. impact: | This vulnerability can lead to...

9.1CVSS8AI score0.1131EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.476 views

Magento - SQL Injection

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. id: CVE-2019-7139 info: name: Magento - SQL Injection author: MaStErChO severity: critical description: | An unauthenticated user can execute SQL...

9.8CVSS8.2AI score0.18336EPSS
SaveExploits2References5
Rows per page
Query Builder