Lucene search
+L

169990 matches found

Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•90 views

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

5.3CVSS5.7AI score0.01197EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•34 views

Mitel 6000 - OS Command Injection

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

8.3AI score0.50237EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•54 views

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...

7.5CVSS8AI score0.46373EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•95 views

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

9.8CVSS6.3AI score0.05821EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•56 views

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

5.8AI score0.17222EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•43 views

LiquidFiles < 4.2 - User Enumeration via Password Reset

LiquidFiles filetransfer server before 4.2 contains a user enumeration vulnerability caused by distinguishable responses in password reset functionality, letting unauthenticated attackers enumerate valid user accounts, exploit requires no authentication. id: CVE-2025-56132 info: name: LiquidFiles...

5.8AI score0.00695EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•40 views

WP Google Maps < 9.0.48 - Cross-Site Scripting

WP Google Maps WordPress plugin 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads. id: CVE-2025-11307 info: name: WP Google Maps 9.0.48 - Cross-Site Scripting author: 0xAkoko severity:...

5.9AI score0.01846EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•22 views

SureForms <= 1.13.1 - Sensitive Information Exposure

SureForms WordPress plugin = 1.13.1 contains a sensitive information exposure caused by setting 'authcallback' to 'returntrue' in 'srfmemailnotification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication. id:...

7.5CVSS5.8AI score0.01916EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•54 views

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

9.8CVSS8.6AI score0.97072EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•50 views

Trinity Audio <= 5.21.0 - Information Exposure

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

5.3CVSS5.7AI score0.01005EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•34 views

WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation

Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7. An unauthenticated attacker can exploit the AJAX endpoint flrblocksusersettingshandleajaxcallback to change the administrator's email address. Subsequently, the attacker...

9.8CVSS8.2AI score0.06937EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•76 views

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...

10CVSS9AI score0.85463EPSS
SaveExploits30References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•34 views

NetMRI Unauthenticated SQL Injection via skipjackUsername

An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur. id: CVE-2025-32814 info: name: NetMRI Unauthenticated SQL Injection via skipjackUsername author: iamnoooob,pdresearch severity: critical description: | An issue was discovered in Infoblox NETMRI befo...

7.6AI score0.36408EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•224 views

User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation

The User Registration & Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'preparemembersdata' function. This makes it possible for unauthenticated attackers to create newuser...

7.8AI score0.48804EPSS
SaveExploits7References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•16 views

Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

9.8CVSS5.9AI score0.0436EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•66 views

Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal

The web server of Lawo AG vsm LTC Time Sync vTimeSync is affected by a "..." triple dot path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only...

8.2AI score0.04235EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•58 views

LearnPress < 4.2.7.1 - SQL Injection

The LearnPress WordPress LMS Plugin before 4.2.7.1 is vulnerable to unauthenticated SQL injection via the 'cfields' parameter in the /wp-json/lp/v1/courses/archive-course REST API endpoint, allowing attackers to extract sensitive information from the database. id: CVE-2024-8529 info: name:...

10CVSS5.8AI score0.12056EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•32 views

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

The plugin does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from the WordPress.org repo, including vulnerable plugins that have been closed. id: CVE-2024-11972 info: name: Hunk Companion 1.9.0 - Unauthenticated Plugi...

8.5AI score0.54475EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•42 views

Flowise - NVIDIA NIM Endpoints Missing Authentication

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

9.8CVSS5.8AI score0.02638EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•21 views

Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection

Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint PhoneAppsHandler.pm. The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An...

9.8CVSS6.8AI score0.18979EPSS
SaveExploits2References2
Rows per page
Query Builder