Lucene search
+L
NucleiMost viewed

4376 matches found

Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

OpenSIS 7.3 - SQL Injection

OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. id: CVE-2020-6637 info: name: OpenSIS 7.3 - SQL Injection author: pikpikcu severity: critical description: OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the...

9.8CVSS8.2AI score0.20058EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Galera WebTemplate 1.0 Directory Traversal

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. id: CVE-2021-40960 info: name: Galera WebTemplate 1.0 Directory Traversal author: daffainfo severity: critical description: Galera WebTemplate 1.0 is affected ...

9.8CVSS8.2AI score0.0992EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Infographic Maker iList < 4.3.8 - SQL Injection

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection. id: CVE-2022-0747 info:...

9.8CVSS8.2AI score0.14882EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Joomla! Component com_cartweberp - Local File Inclusion

A directory traversal vulnerability in the CARTwebERP comcartweberp component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-0982 info: name: Joomla! Component comcartweberp - Local File Inclusion author:...

4.3CVSS5.9AI score0.06885EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

DotCMS < 5.0.2 - Open Redirect

dotCMS before 5.0.2 contains multiple open redirect vulnerabilities via the html/common/forwardjs.jsp FORWARDURL parameter or the html/portlet/ext/common/pagepreviewpopup.jsp hostname parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify...

6.1CVSS6.2AI score0.03717EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

9CVSS7.7AI score0.97337EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Jira < 8.1.1 - Cross-Site Scripting

Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter. id: CVE-2019-3402 info: name: Jira 8.1.1 - Cross-Site Scripting author: pdteam severity: medium description: | Jira before 8.1.1 contains a cross-site...

6.1CVSS6.2AI score0.08947EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Cuppa CMS v1.0 - SQL injection

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menufilter=3 parameter. id: CVE-2022-24265 info: name: Cuppa CMS v1.0 - SQL injection author: theamanrawat severity: high description: | Cuppa CMS v1.0 was...

7.8CVSS7.2AI score0.06711EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

WP Go Maps <= 9.0.29 - Cross-Site Scripting

WP Go Maps formerly WP Google Maps plugin for WordPress versions before 9.0.30 is vulnerable to Reflected Cross-Site Scripting via the 'mapid' parameter in the admin map edit page. id: CVE-2024-29931 info: name: WP Go Maps = 9.0.29 - Cross-Site Scripting author: Shivam Kamboj severity: medium...

7.1CVSS8.1AI score0.00753EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Google ADK-Python - Unauthenticated Builder Endpoint

Google Agent Development Kit ADK 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python OSS, Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication...

10CVSS6.5AI score0.01818EPSS
SaveExploits0References1
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

ShokoServer System - Local File Inclusion (LFI)

ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...

8.6CVSS8.1AI score0.08147EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

8.2CVSS7.1AI score0.02296EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

JEHC-BPM - Remote Code Execute

A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM = v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution. id: CVE-2025-45854...

10CVSS6.6AI score0.03156EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Piwigo - User Enumeration via Password Reset

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at...

6.9CVSS5.8AI score0.00766EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

7.2CVSS5.8AI score0.00648EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting

The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. id: CVE-2017-18529 info: name: PromoBar by BestWebSoft 1.1.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. impact: |...

6.1CVSS6.2AI score0.01621EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

DomainMOD <=4.13.0 - Cross-Site Scripting

DomainMOD through 4.13.0 contains a cross-site scripting vulnerability via /reporting/domains/cost-by-month.php in Daterange parameters. id: CVE-2019-15811 info: name: DomainMOD =4.13.1 to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/47325 -...

6.1CVSS6.2AI score0.0699EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Babel - Open Redirect

Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations. id:...

6.1CVSS6.1AI score0.04059EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability

WordPress Simple Ajax Chat before 20220216 is vulnerable to sensitive information disclosure. The plugin does not properly restrict access to the exported data via the sac-export.csv file, which could allow unauthenticated users to access it. id: CVE-2022-27849 info: name: WordPress Simple Ajax...

7.5CVSS7.2AI score0.04619EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Page content. id: CVE-2022-42095 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...

4.8CVSS5.4AI score0.02002EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

7.5CVSS7.8AI score0.0364EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•57 views

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

6.1CVSS6.3AI score0.01165EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/14 5:13 a.m.•57 views

Ivanti vTM - Authentication Bypass

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. id: CVE-2024-7593 info: name: Ivanti vTM - Authentication Bypass author: gy741 severity: critical...

9.8CVSS8.3AI score0.9999EPSS
SaveExploits4References3
Nuclei
Nuclei
•added 2026/09/10 4:50 a.m.•57 views

Fortinet FortiNAC - Arbitrary File Write

Fortinet FortiNAC is susceptible to arbitrary file write. An external control of the file name or path can allow an attacker to execute unauthorized code or commands via specifically crafted HTTP request, thus making it possible to obtain sensitive information, modify data, and/or execute...

9.8CVSS8.4AI score0.99809EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/09/09 2:52 a.m.•57 views

LinuxKI Toolset <= 6.01 - Remote Command Execution

LinuxKI v6.0-1 and earlier are vulnerable to remote code execution. id: CVE-2020-7209 info: name: LinuxKI Toolset = 6.01 - Remote Command Execution author: dwisiswant0 severity: critical description: LinuxKI v6.0-1 and earlier are vulnerable to remote code execution. impact: | Successful...

9.8CVSS8.6AI score0.98751EPSS
SaveExploits10References6
Nuclei
Nuclei
•added 2026/09/07 6:34 a.m.•57 views

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

10CVSS8.2AI score0.85735EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/06/16 7:13 a.m.•57 views

TeamCity < 2023.11.4 - Authentication Bypass

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible id: CVE-2024-27199 info: name: TeamCity 2023.11.4 - Authentication Bypass author: DhiyaneshDk severity: high description: | In JetBrains TeamCity before 2023.11.4 path traversal allowing t...

9.8CVSS8.4AI score0.99991EPSS
SaveExploits26References2
Nuclei
Nuclei
•added 2026/02/04 7:00 a.m.•57 views

Nodogsplash - Directory Traversal

Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system. id: CVE-2023-39120 info...

6.9AI score
SaveExploits0References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. id:...

7.5CVSS6.5AI score0.251EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

9.8CVSS6.7AI score0.09257EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WordPress Themify Builder < 7.5.8 - Open Redirect

The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tbredirectfail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites. id: CVE-2024-3032 info: name:...

6.1CVSS5.8AI score0.00816EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Xceedium Xsuite <=2.4.4.5 - Local File Inclusion

Xceedium Xsuite 2.4.4.5 and earlier is vulnerable to local file inclusion via opm/readsessionlog.php that allows remote attackers to read arbitrary files in the logFile parameter. id: CVE-2015-4666 info: name: Xceedium Xsuite =2.4.4.5 - Local File Inclusion author: 0xAkoko severity: medium...

5CVSS8.3AI score0.16235EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WordPress EasyCart <2.0.6 - Information Disclosure

WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function. id: CVE-2014-4942 info: name: WordPress EasyCart 2.0.6 - Information Disclosur...

5CVSS5.7AI score0.04536EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php. id: CVE-2016-10973 info: name: Brafton WordPress Plugin 3.4.8 - Cross-Site Scripting author: Harsh severity: medium description: | The Brafton plugin...

7.4CVSS6.8AI score0.01703EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

9.8CVSS6.3AI score0.05265EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Wordpress Zedna eBook download <1.2 - Local File Inclusion

Wordpress Zedna eBook download prior to version 1.2 was affected by a filedownload.php local file inclusion vulnerability. id: CVE-2016-10924 info: name: Wordpress Zedna eBook download 1.2 - Local File Inclusion author: idealphase severity: high description: | Wordpress Zedna eBook download prior...

7.5CVSS7.4AI score0.11662EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion

WirelessHART Fieldgate SWG70 3.0 is vulnerable to local file inclusion via the fcgi-bin/wgsetcgi filename parameter. id: CVE-2018-16059 info: name: WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion author: daffainfo severity: medium description: WirelessHART Fieldgate SWG70 3.0 is vulnerabl...

5.3CVSS5.9AI score0.29816EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. id:...

7.5CVSS7.4AI score0.25855EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Jira Rainbow.Zen - Cross-Site Scripting

Jira Rainbow.Zen contains a cross-site scripting vulnerability via Jira/secure/BrowseProject.jspa which allows remote attackers to inject arbitrary web script or HTML via the id parameter. id: CVE-2007-0885 info: name: Jira Rainbow.Zen - Cross-Site Scripting author: geeknik severity: medium...

6.8CVSS5.8AI score0.05746EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43326 info: name: MooSocial 3.1.8 - Cross-Site Scripting author: r3Y3r53 severity:...

6.1CVSS6.2AI score0.01615EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS7.3AI score0.01776EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

7.2CVSS7.5AI score0.05213EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

7.5CVSS7.4AI score0.20761EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting

WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ctcommunity parameter in its search listing page before outputting it back. id: CVE-2021-24387 info: name: WordPress Pro Real Estate 7 Theme 3.1.1 - Cross-Site...

6.1CVSS6.2AI score0.03677EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

7.5CVSS7.4AI score0.70372EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Joomla! Percha Categories Tree 0.6 - Local File Inclusion

A directory traversal vulnerability in the Percha Fields Attach comperchafieldsattach component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-2033 info: name:...

7.5CVSS6AI score0.15795EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Advanced Text Widget < 2.0.2 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. id: CVE-2011-4618 info: name: Advanced Text Widget 2.0.2 - Cross-Site Scripting author:...

4.3CVSS5.8AI score0.10083EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WordPress Ninja Forms <3.4.34 - Open Redirect

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wpajaxnfoauthconnect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive...

6.1CVSS6.2AI score0.01643EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

Dairy Farm Shop Management System 1.0 - SQL Injection

Dairy Farm Shop Management System 1.0 contains multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context ...

9.8CVSS8.3AI score0.19253EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/17 2:05 a.m.•56 views

WordPress WPQA <5.4 - Cross-Site Scripting

WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form. id: CVE-2022-1597 info: name: WordPress WPQA 5.4 - Cross-Site Scripting author: veshraj severity: medium description: | WordPress WPQ...

6.1CVSS6.2AI score0.03017EPSS
SaveExploits2References5
Total number of security vulnerabilities4376