Lucene search
+L

458257 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.85 views

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

6.1CVSS6AI score0.01366EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.94 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS4.7AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.39 views

Arcserve Unified Data Protection - Authentication Bypass

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin function within wizardLogin. id: CVE-2024-0799 info: name: Arcserve Unified Data Protection -...

9.8CVSS9AI score0.04342EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.88 views

VMware vRealize Log Insight - Path Traversal

he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. id: CVE-2022-31706 info: name: VMware vRealize Log Insight - Path Traversal...

9.8CVSS9.3AI score0.87077EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.34 views

DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code...

7.5CVSS7.6AI score0.74048EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.63 views

WordPress Super Socializer <7.13.30 - Cross-Site Scripting

WordPress Super Socializer plugin before 7.13.30 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the urls parameter in its thechampsharingcount AJAX action available to both unauthenticated and authenticated users before outputting it back in the response...

6.1CVSS5.7AI score0.01938EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.53 views

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

7.5CVSS7.6AI score0.20351EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. id: CVE-2022-0422 info: name: WordPress White Label CMS 2.2.9 -...

6.1CVSS5.7AI score0.0812EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.83 views

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

7.5CVSS7.4AI score0.02437EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.261 views

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

7.5CVSS7.6AI score0.89716EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.66 views

Emlog Pro v2.1.14 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. id: CVE-2023-41621 info: name: Emlog Pro v2.1.14 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. impact: ...

6.1CVSS5.9AI score0.01146EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.59 views

phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

6.1CVSS5AI score0.01532EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.9 views

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

9.8CVSS5.1AI score0.02063EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.38 views

RSVPMaker <= 9.2.5 - SQL Injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...

9.8CVSS7.8AI score0.07158EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.19 views

WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

7.2CVSS5.6AI score0.02323EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.20 views

WP BASE Booking - Reflected XSS

WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...

6.1CVSS8.4AI score0.00579EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.26 views

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

9.8CVSS5.7AI score0.03225EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.36 views

WordPress Accordions - Unauthenticated Settings Update

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin = 2.0.2 at WordPress. id: CVE-2022-33198 info: name: WordPress Accordions - Unauthenticated Settings Update author: riteshs4hu severity: critical description: | Unauthenticated WordPress Options Change...

9.8CVSS5.5AI score0.03225EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.18 views

SPIP Saisies - Remote Code Execution

SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions. id: CVE-2025-71243 info: name: SPIP Saisies - Remote Code Execution author: omarkurt severity:...

9.8CVSS6.7AI score0.05126EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.31 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS9.7AI score0.53936EPSS
SaveExploits8References5
Rows per page
Query Builder