Lucene search
+L

54176 matches found

Nuclei
Nuclei
added 5 days ago59 views

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

9.8CVSS8AI score0.63999EPSS
SaveExploits2References2
Nuclei
Nuclei
added 5 days ago197 views

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...

7.5CVSS7.4AI score0.51653EPSS
SaveExploits5References5
Nuclei
Nuclei
added 5 days ago473 views

Revive Adserver 4.2 - Remote Code Execution

Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...

9.8CVSS8AI score0.57022EPSS
SaveExploits7References5
Nuclei
Nuclei
added 5 days ago77 views

Apache Cocoon 2.1.12 - XML Injection

Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML...

7.5CVSS7.3AI score0.72456EPSS
SaveExploits1References5
Nuclei
Nuclei
added 5 days ago137 views

Citrix StoreFront - Cross-Site Scripting

Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow. id: CVE-2023-5914 info: name: Citrix StoreFront - Cross-Site Scripting author: DhiyaneshDK...

7.2CVSS6.5AI score0.73142EPSS
SaveExploits0References4
BDU FSTEC
BDU FSTEC
added 5 days ago6 views

The vulnerability of the XmlLayout() function in the Apache Log4j Core library allows attackers to compromise the integrity of the protected information.

The vulnerability of the XmlLayout function in the Apache Log4j Core logging library is related to improper encoding or escaping of output data. Exploiting this vulnerability allows an attacker to influence the integrity of the protected information from a remote location...

7.8CVSS5.5AI score0.0086EPSS
SaveExploits0References4Affected Software2
EUVD
EUVD
added 6 days ago11 views

EUVD-2025-210545

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

5.5CVSS5.8AI score0.00241EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 6 days ago9 views

CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

5.5CVSS5.8AI score0.00241EPSS
SaveExploits0References1
SUSE CVE
SUSE CVE
added 6 days ago5 views

SUSE CVE-2026-55437

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

5.4CVSS7.7AI score0.00179EPSS
SaveExploits0References2
OSV
OSV
added 6 days ago5 views

JLSEC-2026-958 ImageMagick: MSL - Stack overflow in ProcessMSLScript

Summary Magick fails to check for circular references between two MSLs, leading to a stack overflow. Details After reading a.msl using magick, the following is displayed: MSLStartElement - ReadImage - ReadMSLImage - ProcessMSLScript - xmlParseChunk - xmlParseTryOrFinish - MSLStartElement bash...

9.8CVSS6.9AI score0.00208EPSS
SaveExploits0References4
OSV
OSV
added 6 days ago5 views

JLSEC-2026-1045 ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark()...

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory an...

1.9CVSS5.9AI score0.00169EPSS
SaveExploits1References5
NVD
NVD
added 6 days ago10 views

CVE-2026-54365

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

8.7CVSS0.00216EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago11 views

EUVD-2026-51102

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

8.7CVSS5.9AI score0.00287EPSS
SaveExploits0References2
CVE
CVE
added 6 days ago12 views

CVE-2026-54366

CentreStack prior to 17.4 is affected by an XML External Entity (XXE) vulnerability in the SharePoint storage configuration handler. An unauthenticated attacker can exfiltrate arbitrary files by sending a crafted request to the StorageConfig endpoint, causing the server to fetch and parse attacke...

8.7CVSS5.9AI score0.00287EPSS
SaveExploits0References2
Cvelist
Cvelist
added 6 days ago32 views

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

8.7CVSS0.00287EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 6 days ago11 views

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

8.7CVSS5.9AI score0.00287EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago11 views

EUVD-2026-51101

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

8.7CVSS6AI score0.00216EPSS
SaveExploits0References2
Nuclei
Nuclei
added 6 days ago136 views

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

9.8CVSS8AI score0.9994EPSS
SaveExploits5References5
NVD
NVD
added 6 days ago10 views

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

9.9CVSS0.00343EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago38 views

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

9.9CVSS0.00343EPSS
SaveExploits0References1
Rows per page
Query Builder