Lucene search
+L

1453313 matches found

Nuclei
Nuclei
added 2026/09/23 2:05 a.m.82 views

PMB v7.4.6 - Cross-Site Scripting

PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via the 'query' parameter. id: CVE-2023-24737 info: name: PMB v7.4.6 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via t...

6.1CVSS6.4AI score0.01169EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.100 views

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

9.4CVSS8.1AI score0.37639EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.90 views

Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection

Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...

5.3CVSS6.1AI score0.05722EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.77 views

Trilium <0.52.4 - Cross-Site Scripting

Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2022-2290 info: name: Trilium 0.52.4 - Cross-Site Scripting author:...

6.4CVSS6.7AI score0.02916EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.74 views

Reprise License Manager 14.2 - Information Disclosure

Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostnames, system architecture and file/directory...

5.3CVSS6.1AI score0.09322EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.40 views

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

7.2CVSS6AI score0.02391EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.49 views

Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting

Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarfajax.php. id: CVE-2011-4336 info: name: Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting author: pikpikcu severity: medium description: Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site...

6.1CVSS6.2AI score0.07652EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.42 views

Joomla! Component Love Factory 1.3.4 - Local File Inclusion

A directory traversal vulnerability in the Love Factory comlovefactory component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1957 info: name: Joomla! Component Love Factory 1.3.4 - Local File Inclusion...

7.5CVSS6AI score0.14847EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.42 views

Netsweeper 4.0.3 - Cross-Site Scripting

A cross-site scripting vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO. id: CVE-2014-9608 info: name: Netsweeper 4.0.3 - Cross-Site Scriptin...

6.1CVSS6.4AI score0.04663EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.85 views

Magento Server Mass Importer - Cross-Site Scripting

Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php. id: CVE-2015-2068 info: name: Magento Server Mass...

4.3CVSS5.9AI score0.1404EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.42 views

Koha 3.20.1 - Directory Traversal

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. id: CVE-2015-4632 info: name:...

7.5CVSS7.5AI score0.51829EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.74 views

DokuWiki - Cross-Site Scripting

DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATEAT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.9AI score0.03253EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.55 views

HPE System Management - Cross-Site Scripting

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

5.4CVSS6.4AI score0.04515EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.61 views

ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. id: CVE-2017-11512 info...

7.5CVSS7.4AI score0.79604EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.68 views

Phoenix Framework - Open Redirect

Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks. id: CVE-2017-1000163 info: name: Phoenix Framework - Open Redirect author: 0xAkoko severity: medium...

6.1CVSS6.3AI score0.02377EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.73 views

OpenDreambox 2.0.0 - Remote Code Execution

OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py. id: CVE-2017-14135 info: nam...

10CVSS8.9AI score0.21842EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.68 views

ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

9.4CVSS5.8AI score0.38932EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.102 views

Monstra CMS 3.0.4 - Cross-Site Scripting

Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form i.e., the login parameter to users/registration. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

6.1CVSS6.7AI score0.02273EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.67 views

Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

9.8CVSS8.5AI score0.19762EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/23 2:05 a.m.209 views

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

9.8CVSS8.1AI score0.34424EPSS
SaveExploits3References5
Rows per page
Query Builder