Lucene search
+L

458233 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. id: CVE-2022-0422 info: name: WordPress White Label CMS 2.2.9 -...

6.1CVSS5.7AI score0.0812EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.83 views

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

7.5CVSS7.4AI score0.02437EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.261 views

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

7.5CVSS7.6AI score0.89716EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.66 views

Emlog Pro v2.1.14 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. id: CVE-2023-41621 info: name: Emlog Pro v2.1.14 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. impact: ...

6.1CVSS5.9AI score0.01146EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.59 views

phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

6.1CVSS5AI score0.01532EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.9 views

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

9.8CVSS5.1AI score0.02063EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.38 views

RSVPMaker <= 9.2.5 - SQL Injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...

9.8CVSS7.8AI score0.07158EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.19 views

WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

7.2CVSS5.6AI score0.02323EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.20 views

WP BASE Booking - Reflected XSS

WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...

6.1CVSS8.4AI score0.00579EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.26 views

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

9.8CVSS5.7AI score0.03225EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.36 views

WordPress Accordions - Unauthenticated Settings Update

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin = 2.0.2 at WordPress. id: CVE-2022-33198 info: name: WordPress Accordions - Unauthenticated Settings Update author: riteshs4hu severity: critical description: | Unauthenticated WordPress Options Change...

9.8CVSS5.5AI score0.03225EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.18 views

SPIP Saisies - Remote Code Execution

SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions. id: CVE-2025-71243 info: name: SPIP Saisies - Remote Code Execution author: omarkurt severity:...

9.8CVSS6.7AI score0.05126EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.32 views

Adobe Commerce (Magento) - Remote Code Execution

Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution. id: CVE-2022-24086 info: name:...

10CVSS9.3AI score0.9911EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.142 views

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

7.5CVSS8.3AI score0.97369EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.396 views

Qlik Sense Enterprise - HTTP Request Smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...

9.9CVSS8.9AI score0.84473EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.77 views

Progress Telerik Report Server - Authentication Bypass

In Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability. id: CVE-2024-4358 info: name: Progress Telerik Report Server - Authenticatio...

9.9CVSS9AI score0.97482EPSS
SaveExploits14References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.31 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS9.7AI score0.53936EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.103 views

Wavlink Multiple AP - Remote Command Injection

Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink...

10CVSS9AI score0.68794EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.21 views

URL Shortify <= 1.12.1 - Open Redirect

The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirectto' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentiall...

4.7CVSS5.3AI score0.00592EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.59 views

WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting

WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6.1AI score0.05396EPSS
SaveExploits2References5
Rows per page
Query Builder