Lucene search
+L

458259 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.33 views

ComfyUI-Manager < 3.38 - Configuration Overwrite

ComfyUI-Manager 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access. id: CVE-2025-67303 info: name:...

7.5CVSS8.4AI score0.01362EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.17 views

WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection via request parameters in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

7.5CVSS7.8AI score0.02202EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.18 views

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk contains an authentication bypass vulnerability caused by improper access control, letting attackers execute protected actions without authentication, exploit requires no special conditions. id: CVE-2025-40552 info: name: SolarWinds Web Help Desk - Authentication Bypass...

9.8CVSS9.1AI score0.6039EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.55 views

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

7.5CVSS8.1AI score0.0364EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.75 views

WAVLINK WN535 G3 - Information Disclosure

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in the livemfg.shtml page. An attacker can obtain sensitive router information via the exec cmd function and possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations. id:...

7.5CVSS6.6AI score0.07294EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.45 views

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

WordPress Stop Spammers plugin before 2021.9 contains a reflected cross-site scripting vulnerability. It does not escape user input when blocking requests such as matching a spam word, thus outputting it in an attribute after sanitizing it to remove HTML tags. id: CVE-2021-24245 info: name:...

6.1CVSS5.7AI score0.05721EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.97 views

SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

9.8CVSS9.7AI score0.73635EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.51 views

WordPress JoomSport <5.2.8 - SQL Injection

WordPress JoomSport plugin before 5.2.8 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operation...

9.8CVSS9.2AI score0.04756EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.88 views

WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure

WAVLINK WN579 X3 M79X3.V5030.180719 is susceptible to information disclosure in /cgi-bin/ExportAllSettings.sh. An attacker can obtain sensitive router information via a crafted POST request and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

7.5CVSS7.6AI score0.06435EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.36 views

Wavlink WN-535G3 - Cross-Site Scripting

Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi. id: CVE-2022-30489 info: name: Wavlink WN-535G3 - Cross-Site Scripting author: For3stCo1d severity: medium description: | Wavlink WN-535G3 contains a POST cross-site scripting...

6.1CVSS6.1AI score0.0416EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.46 views

ExponentCMS <= 2.6 - Host Header Injection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. id: CVE-2021-38751 info: name: ExponentCMS = 2.6 - Host Header Injection author:...

4.3CVSS5.1AI score0.02468EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.126 views

Sercomm VD625 Smart Modems - CRLF Injection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. id: CVE-2021-27132 info: name: Sercomm VD625 Smart Modems - CRLF Injection author: geeknik severity: critical description: Sercomm...

9.8CVSS8.8AI score0.16062EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.191 views

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...

9.8CVSS9.2AI score0.34359EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.47 views

Zarinpal Paid Download - Reflected XSS

Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires...

6.1CVSS8.4AI score0.00576EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.20 views

HP Switch - Authentication Bypass

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in...

9.8CVSS8.2AI score0.02641EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.53 views

WordPress Symposium <=15.8.1 - Cross-Site Scripting

WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2015-9414 info: name:...

6.1CVSS5.8AI score0.03605EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 2:28 a.m.22 views

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...

8.8CVSS8.7AI score0.03109EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 2:28 a.m.67 views

WordPress Job Portal < 2.0.6 - SQL Injection

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape the city parameter before using it in a SQL statement,leading to a SQL injection vulnerability that is exploitable by unauthenticated users. This vulnerability can be used to extractsensitive data from the database or...

9.8CVSS9AI score0.03122EPSS
SaveExploits2References2
OSV
OSV
added 2026/08/23 2:17 p.m.13 views

ROOT-OS-DEBIAN-13-CVE-2026-56209 CVE-2026-56209 in aom - Patched by Root

Root has patched CVE-2026-56209 in the aom package for Root:Debian:13. Multiple fixed versions available...

7.1CVSS5.2AI score0.00328EPSS
SaveExploits0
OSV
OSV
added 2026/08/23 1:56 p.m.10 views

ROOT-OS-DEBIAN-11-CVE-2026-34544 CVE-2026-34544 in openexr - Patched by Root

Root has patched CVE-2026-34544 in the openexr package for Root:Debian:11. Multiple fixed versions available...

7.3CVSS7.3AI score0.00244EPSS
SaveExploits1
Rows per page
Query Builder