Lucene search
+L

1089815 matches found

Nuclei
Nuclei
added 2026/09/13 4:24 p.m.44 views

Microweber <1.2.11 - Cross-Site Scripting

Packagist prior to 1.2.11 contains a cross-site scripting vulnerability via microweber/microweber. User can escape the meta tag because the user doesn't escape the double-quote in the $redirectUrl parameter when logging out. id: CVE-2022-0678 info: name: Microweber 1.2.11 - Cross-Site Scripting...

6.5CVSS6.5AI score0.02273EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.98 views

Crestron Device - Credentials Disclosure

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname...

10CVSS7.9AI score0.75159EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.75 views

DVDFab 12 Player/PlayerFab - Local File Inclusion

DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access. id: CVE-2022-25216 info: name: DVDFab 12 Player/PlayerFa...

7.8CVSS7.2AI score0.13475EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.99 views

Wipro Holmes Orchestrator 20.4.1 - Information Disclosure

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

7.5CVSS7.4AI score0.53008EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.49 views

Vehicle Service Management System 1.0 - Cross Site Scripting

Vehicle Service Management System 1.0 contains a cross-site scripting vulnerability via the User List section in login panel. id: CVE-2021-46073 info: name: Vehicle Service Management System 1.0 - Cross Site Scripting author: TenBird severity: medium description: | Vehicle Service Management Syst...

4.8CVSS5.5AI score0.02736EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.61 views

AlquistManager Local File Inclusion

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access. id...

7.5CVSS7.5AI score0.09193EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.101 views

CentOS Web Panel - SQL Injection

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. id: CVE-2021-31316 info: name: CentOS Web Panel - SQL Injection author: ritikchaddha severity: critical description: | The unprivileged user portal part of CentOS Web Pane...

10CVSS8AI score0.13378EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.82 views

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

9.8CVSS7.7AI score0.5177EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.42 views

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

6.5CVSS6.9AI score0.0141EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.204 views

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...

7.5CVSS7.4AI score0.51653EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.165 views

Nova noVNC - Open Redirect

Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-3654 info: name: Nova noVNC - Open Redirect author: geeknik severity: medium...

6.1CVSS6.9AI score0.26792EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.79 views

WordPress GiveWP <2.17.3 - Cross-Site Scripting

WordPress GiveWP plugin before 2.17.3 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the formid parameter before returning it in the response of an unauthenticated request via the givecheckoutlogin AJAX action. An attacker can inject arbitrary script in the...

6.1CVSS6.3AI score0.02145EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.74 views

WordPress Guppy <=1.1 - Information Disclosure

WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another. id: CVE-2021-24997 info: name:...

6.5CVSS6.6AI score0.02753EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.156 views

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

8.8CVSS8.2AI score0.58286EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.38 views

SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting

SIS Informatik REWE GO SP17 before 7.7 contains a cross-site scripting vulnerability via rewe/prod/web/index.php affected parameters are config, version, win, db, pwd, and user and /rewe/prod/web/rewegocheck.php version and all other parameters. id: CVE-2021-31537 info: name: SIS Informatik REWE ...

6.1CVSS6.2AI score0.07781EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.48 views

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

WordPress Stop Spammers plugin before 2021.9 contains a reflected cross-site scripting vulnerability. It does not escape user input when blocking requests such as matching a spam word, thus outputting it in an attribute after sanitizing it to remove HTML tags. id: CVE-2021-24245 info: name:...

6.1CVSS6.2AI score0.05721EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.40 views

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

9.8CVSS8.3AI score0.70745EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.79 views

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

9.8CVSS8AI score0.5177EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.65 views

Thruk 2.40-2 - Cross-Site Scripting

Thruk 2.40-2 contains a cross-site scripting vulnerability via /thruk/cgi-bin/status.cgi?style=combined&title=TITLE in the host or title parameter. An attacker can inject arbitrary JavaScript into status.cgi, leading to a triggered payload when accessed by an authenticated user. id: CVE-2021-3548...

6.1CVSS6.3AI score0.02779EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.54 views

Aruba Instant Access Point (IAP) - Cross-Site Scripting

A remote cross-site scripting xss vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below;...

6.1CVSS6.7AI score0.16372EPSS
SaveExploits4References2
Rows per page
Query Builder