Lucene search
+L

1435315 matches found

Nuclei
Nuclei
added 2026/08/27 4:24 a.m.141 views

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

9.8CVSS9.3AI score0.03049EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.62 views

WordPress Yuzo <5.12.94 - Cross-Site Scripting

WordPress Yuzo Related Posts plugin before 5.12.94 is vulnerable to cross-site scripting because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can consequently inje...

6.1CVSS5.8AI score0.05331EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.135 views

Buffalo WSR-2533DHPL2 - Improper Access Control

The web interfaces of Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 do not properly restrict access to sensitive information from an unauthorized actor. id: CVE-2021-20092 info: name: Buffalo WSR-2533DHPL2 - Improper Access Control author: gy741,pdteam,par...

9.8CVSS8.2AI score0.99983EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.219 views

Tiny Java Web Server - Cross-Site Scripting

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. id: CVE-2021-37573 info: name: Tiny Java Web Server - Cross-Site Scripting author:...

6.1CVSS5.9AI score0.03398EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.109 views

SAS/Internet 9.4 1520 - Local File Inclusion

SAS/Internet 9.4 build 1520 and earlier allows local file inclusion. The samples library included by default in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro...

7.5CVSS7.4AI score0.07845EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.94 views

XStream <1.4.18 - Server-Side Request Forgery

XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify...

8.5CVSS7.2AI score0.11377EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.92 views

Wordpress Polls Widget < 1.5.3 - SQL Injection

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks id: CVE-2021-24442 inf...

9.8CVSS9.2AI score0.45996EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.90 views

Reprise License Manager 14.2 - Cross-Site Scripting

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. id: CVE-2021-45422 info: name: Reprise License Manager 14.2 - Cross-Site Scripting author: edoardottt severity: medium description: | Reprise License Manager 14.2...

6.1CVSS5.7AI score0.03241EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.104 views

Cacti - Cross-Site Scripting

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. id: CVE-2021-26247 info: name: Cacti - Cross-Site Scripting author: dhiyaneshDK severity: medium descriptio...

6.1CVSS5.8AI score0.07124EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.80 views

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. id: CVE-2021-40970 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

6.1CVSS6.2AI score0.02239EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.38 views

WordPress Automatic Plugin - Unauthenticated Options Change

WordPress Automatic Plugin versions 3.53.2 and below contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the processform.php script. The vulnerable script uses updateoption on all POST parameters without authentication or capability...

9.8CVSS8.9AI score0.16408EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.113 views

XStream 1.4.18 - Arbitrary Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

8.5CVSS7.7AI score0.143EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.123 views

MinIO Browser API - Server-Side Request Forgery

MinIO Browser API before version RELEASE.2021-01-30T00-20-58Z contains a server-side request forgery vulnerability. id: CVE-2021-21287 info: name: MinIO Browser API - Server-Side Request Forgery author: pikpikcu severity: high description: MinIO Browser API before version...

7.7CVSS7.5AI score0.24784EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.85 views

NexusPHP <1.7.33 - Cross-Site Scripting

NexusPHP before 1.7.33 contains multiple cross-site scripting vulnerabilities via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php. An attacker can...

6.1CVSS6.1AI score0.01543EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.355 views

Yii 2 < 2.0.38 - Remote Code Execution

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. id: CVE-2020-15148 info: name: Yii 2 2.0.38 - Remote Code Execution author: pikpikcu severity: critical description: Yii 2 yiisoft/yii2 before version 2.0....

10CVSS9.8AI score0.78759EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.154 views

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

6.5CVSS7.3AI score0.10695EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.46 views

WordPress Simple File List - Path Traversal

Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory. id: CVE-2020-12832 info: name: WordPress Simple File List - Path Traversal author: riteshs4hu severity: critical description: | Simple File List plugin allows path traversal v...

9.8CVSS8.6AI score0.07131EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.126 views

Craft CMS < 3.3.0 - Server-Side Template Injection

Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller. id: CVE-2020-9757 info: name: Craft CMS 3.3.0 - Server-Side Template Injection author:...

9.8CVSS9.5AI score0.72821EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.101 views

Suprema BioStar <2.8.2 - Local File Inclusion

Suprema BioStar before 2.8.2 Video Extension allows remote attackers can read arbitrary files from the server via local file inclusion. id: CVE-2020-15050 info: name: Suprema BioStar 2.8.2 - Local File Inclusion author: gy741 severity: high description: Suprema BioStar before 2.8.2 Video Extensio...

7.5CVSS8.2AI score0.50734EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.112 views

ESAFENET CDG - Arbitrary File Download

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. id: CVE-2019-9632 info: name: ESAFENET CDG - Arbitrary File Download author: pdteam severity: hi...

7.5CVSS7.7AI score0.39885EPSS
SaveExploits1References2
Rows per page
Query Builder