Lucene search
+L
NucleiMost viewed

4251 matches found

Nuclei
Nuclei
•added 12 hours ago•37 views

Glances - Information Disclosure

Glances 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges. id: CVE-2026-32596 info: name: Glances -...

8.7CVSS7.8AI score0.0155EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 12 hours ago•37 views

Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting

Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 are vulnerable to reflected cross-site scripting XSS via the page parameter in /cgi-bin/cgiServer.exx, allowing attackers to execute arbitrary JavaScript in the context of the user. id: CVE-2020-12262 info: name: Intelbr...

5.4CVSS5.7AI score0.01819EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 12 hours ago•37 views

ND Booking < 2.5 - Unauthenticated Options Change

The Hotel Booking WordPress plugin ND Booking 2.5 was affected by an Unauthenticated Options Change security vulnerability. id: CVE-2019-15774 info: name: ND Booking 2.5 - Unauthenticated Options Change author: popcorn94 severity: medium description: | The Hotel Booking WordPress plugin ND Bookin...

6.1CVSS6AI score0.01731EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 12 hours ago•37 views

Grafana - Exposes DingDing API Keys

An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1. id: CVE-2025-3415 info: name: Grafana - Exposes DingDing API Keys author: lucasribolli severity: medium description: | An inciden...

4.3CVSS5AI score0.00956EPSS
SaveExploits0References1
Nuclei
Nuclei
•added 12 hours ago•37 views

WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting

WordPress enhanced-tooltipglossary 3.2.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6.1AI score0.04426EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 12 hours ago•37 views

Kramer VIAware - Privilege Escalation and Remote Code Execution

Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...

10CVSS10AI score0.70753EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 12 hours ago•37 views

Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

6.1CVSS8.3AI score0.00572EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 12 hours ago•37 views

webp_server_go 0.4.0 - Path Traversal

webpservergo 0.4.0 contains a path traversal caused by insufficient sanitization in file handling, letting attackers read arbitrary files on the server, exploit requires attacker to send crafted requests. id: CVE-2021-46104 info: name: webpservergo 0.4.0 - Path Traversal author: pikpikcu severity...

7.5CVSS7.6AI score0.04231EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 12 hours ago•37 views

WP Pricing Table - Reflected XSS

WP Pricing Table WordPress plugin = 1.1 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute scripts in the context of high privilege users, exploit requires attacker to craft malicious URL. id: CVE-2024-13628 info: name: WP Pricing Table -...

6.1CVSS8.3AI score0.00629EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 12 hours ago•37 views

Protect WP Admin < 4.0 - Unauthenticated Protection Bypass

The Protect WP Admin WordPress plugin before version 4.0 disclosed the URL of the admin panel through the redirection of a crafted URL, bypassing the protection offered. id: CVE-2023-3139 info: name: Protect WP Admin 4.0 - Unauthenticated Protection Bypass author: popcorn94 severity: medium...

6.1CVSS6.9AI score0.00734EPSS
SaveExploits1References2
Nuclei
Nuclei
•added yesterday•37 views

DrayTek Vigor - Command Injection

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. id: CVE-2020-15415 info: name:...

9.8CVSS7.9AI score0.84599EPSS
SaveExploits1References2
Nuclei
Nuclei
•added yesterday•37 views

Koha 3.20.1 - Directory Traversal

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. id: CVE-2015-4632 info: name:...

7.5CVSS7.9AI score0.51829EPSS
SaveExploits8References5
Nuclei
Nuclei
•added yesterday•37 views

Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass

Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable to a directory traversal vulnerability when processing a sessionid cookie, which allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS. id: CVE-2016-7552...

10CVSS8.7AI score0.93249EPSS
SaveExploits15References5
Nuclei
Nuclei
•added yesterday•37 views

WPGraphQL 0.2.3 - User Creation

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. id: CVE-2019-9879 info: name: WPGraphQL 0.2.3 - User Creation author: DhiyaneshDk severity:...

9.8CVSS8.8AI score0.46614EPSS
SaveExploits4References4
Nuclei
Nuclei
•added yesterday•37 views

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. id: CVE-2025-40536 info: name: SolarWinds Web Help Desk 12.8.8 Hotfix 1 HF1 - Security...

9.8CVSS8.8AI score0.83622EPSS
SaveExploits4References3
Nuclei
Nuclei
•added 4 days ago•37 views

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

9.8CVSS9AI score0.95478EPSS
SaveExploits7References2
Nuclei
Nuclei
•added 4 days ago•37 views

Ivanti Avalanche SmartDeviceServer - XML External Entity

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. id: CVE-2024-38653 info: name: Ivanti Avalanche SmartDeviceServer - XML External Entity author: DhiyaneshDK severity: high description: | XXE in SmartDeviceServer in...

8.2CVSS7.8AI score0.91984EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 5 days ago•37 views

SolarWinds Security Event Manager - Unauthenticated RCE

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution. id: CVE-2024-0692 info: name: SolarWinds Security Event Manager - Unauthenticated RCE...

8.8CVSS8.5AI score0.92245EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 2026/07/16 9:41 a.m.•37 views

Jira Server and Data Center - Information Disclosure

Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before...

5.3CVSS6.3AI score0.99209EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/04/02 5:22 a.m.•37 views

Heimdall - Host Header Injection & Open Redirect

LinuxServer.io Heimdall 2.6.3-ls307 contains a host header injection caused by improper validation of user-supplied HTTP headers X-Forwarded-Host and Referer, letting unauthenticated remote attackers perform host header injection and open redirect attacks, exploit requires no special privileges...

9.8CVSS5.9AI score0.02779EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/02/04 7:0 a.m.•37 views

Harman Media Suite <= 4.2.0 - Local File Disclosure

Harman Media Suite versions 4.2.0 and below are vulnerable to possible Local File Disclosure. This allows an unauthenticated user to potentially download attachments and recordings stored within the Media Suite application if anonymous access to the User Portal is enabled. id: CVE-2023-39024 info...

6.9AI score
SaveExploits1References3
Nuclei
Nuclei
•added 12 hours ago•36 views

Last.fm Rotation 1.0 - Path Traversal

Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation lastfm-rotation plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the snode parameter. id: CVE-2014-5181 info: name: Last.fm Rotation 1.0 - Path Traversal author: DhiyaneshDK...

5CVSS5.6AI score0.04259EPSS
SaveExploits1
Nuclei
Nuclei
•added 12 hours ago•36 views

Submitty <= 20.04.01 - Open Redirect

Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-13121...

6.1CVSS6.2AI score0.02956EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 12 hours ago•36 views

Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect

Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. id: CVE-2018-14931 info: name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect author: 0xAkoko...

6.1CVSS6AI score0.02398EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 12 hours ago•36 views

Joomla! Component Horoscope 1.5.0 - Local File Inclusion

A directory traversal vulnerability in the Daily Horoscope comhoroscope component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1472 info: name: Joomla! Component Horoscope 1.5.0 - Local File Inclusion...

7.5CVSS5.6AI score0.13351EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 12 hours ago•36 views

Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS

Multiple cross-site scripting XSS vulnerabilities in Open Bulletin Board OpenBB 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 redirect parameter to member.php, 2 to parameter to myhome.php 3 TID parameter to post.php, or 4 redirect parameter to...

4.3CVSS5.1AI score0.09001EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...

10CVSS5.2AI score0.01656EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 12 hours ago•36 views

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

8.6CVSS8.2AI score0.18861EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 12 hours ago•36 views

Microweber < V.2.0 - Cross-Site Scripting

Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editortools/rteimageeditor endpoint. id: CVE-2023-5244 info: name: Microweber V.2.0 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Reflected Cross-Site Scripting Vulnerability in types GET paramete...

6.1CVSS5.3AI score0.01061EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 12 hours ago•36 views

Mlflow <2.8.0 - Local File Inclusion

Mlflow before 2.8.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2023-6977...

10CVSS8.2AI score0.03924EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress Plugin Tera Charts - Local File Inclusion

Multiple local file inclusion vulnerabilities in Tera Charts tera-charts plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. dot dot in the fn parameter to 1 charts/treemap.php or 2 charts/zoomabletreemap.php. id: CVE-2014-4940 info: name: WordPress Plugin Tera Charts...

5CVSS8.8AI score0.1927EPSS
SaveExploits4References4
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting

WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via playlist.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.2AI score0.0465EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 12 hours ago•36 views

WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting

The plugin was affected by a reflected cross-site scripting vulnerability in the wooce admin page. id: CVE-2022-0149 info: name: WooCommerce Stored Exporter WordPress Plugin 2.7.1 - Cross-Site Scripting author: dhiyaneshDk severity: medium description: The plugin was affected by a reflected...

6.1CVSS5.7AI score0.02337EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 12 hours ago•36 views

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

9.8CVSS7.8AI score0.07EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 12 hours ago•36 views

Django RasterField - SQL Injection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. id: CVE-2026-1207 info: name: Django RasterField - SQL Injection author: omarkurt...

8.3CVSS7.1AI score0.12976EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 12 hours ago•36 views

Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure

Export WP Page to Static HTML & PDF WordPress plugin = 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger...

9.8CVSS5.1AI score0.02135EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 12 hours ago•36 views

Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting

The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. id: CVE-2017-18517 info: name: Pinterest by BestWebSoft 1.0.5 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues...

6.1CVSS6AI score0.01621EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 12 hours ago•36 views

Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion

A directory traversal vulnerability in the Affiliate Datafeeds comdatafeeds component build 880 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1979 info: name: Joomla! Component Affiliate Datafeeds 880 - Local Fi...

6.8CVSS5.6AI score0.1115EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 12 hours ago•36 views

Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting

The ultimate-weather plugin 1.0 for WordPress contains a cross-site scripting vulnerability. id: CVE-2014-4561 info: name: Ultimate Weather Plugin = 1.0 - Cross-Site Scripting author: daffainfo severity: medium description: The ultimate-weather plugin 1.0 for WordPress contains a cross-site...

6.1CVSS5.8AI score0.03717EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

9.8CVSS5.2AI score0.14608EPSS
SaveExploits11References2
Nuclei
Nuclei
•added 12 hours ago•36 views

Viral Signup <= 2.1 - SQL Injection

The Viral Signup limited opt-in with viral referral sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

9.8CVSS5.8AI score0.03292EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress English Admin <1.5.2 - Open Redirect

WordPress English Admin plugin before 1.5.2 contains an open redirect vulnerability. The plugin does not validate the admincustomlanguagereturnurl before redirecting users to it. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id:...

6.1CVSS6.3AI score0.01908EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 12 hours ago•36 views

Joomla! Component BeeHeard 1.0 - Local File Inclusion

A directory traversal vulnerability in the BeeHeard combeeheard and BeeHeard Lite combeeheardlite component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1952 info: name: Joomla! Component BeeHeard 1.0 - Loc...

7.5CVSS5.6AI score0.12991EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal

WordPress SE HTML5 Album Audio Player 1.1.0 contains a directory traversal vulnerability in downloadaudio.php that allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. id: CVE-2015-4414 info: name: WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversa...

5CVSS8.8AI score0.18958EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 12 hours ago•36 views

WordPress heat-trackr 1.0 - Cross-Site Scripting

WordPress heat-trackr 1.0 contains a cross-site scripting vulnerability via heat-trackrabtestadd.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

6.1CVSS6.2AI score0.03415EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 12 hours ago•36 views

Mingsoft MCMS 5.2.9 - SQL Injection

Mingsoft MCMS v5.2.9 contains a SQL injection caused by unsanitized categoryType parameter at /content/list.do, letting attackers execute arbitrary SQL commands, exploit requires crafted input. id: CVE-2023-50578 info: name: Mingsoft MCMS 5.2.9 - SQL Injection author: ritikchaddha severity:...

9.8CVSS9.3AI score0.02222EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 12 hours ago•36 views

Joomla! Component Magic Updater - Local File Inclusion

A directory traversal vulnerability in the Magic Updater comjoomlaupdater component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1307 info: name: Joomla! Component Magic Updater - Local File Inclusion author:...

5CVSS5.7AI score0.10158EPSS
SaveExploits3References5
Nuclei
Nuclei
•added yesterday•36 views

phpMyAdmin < 5.0.3 - SQL Injection

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input. id: CVE-2020-26935 info: name: phpMyAdmin 5.0.3 - SQL Injection author: 0xAko...

9.8CVSS8.8AI score0.67081EPSS
SaveExploits1References3
Nuclei
Nuclei
•added yesterday•36 views

Laminas Project laminas-http - Remote Code Execution

Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...

9.8CVSS9.4AI score0.75313EPSS
SaveExploits3References2
Nuclei
Nuclei
•added yesterday•36 views

AudioCodes 420HD - Remote Code Execution

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow remote code execution. id: CVE-2018-10093 info: name: AudioCodes 420HD - Remote Code Execution author: wisnupramoedya severity: high description: | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow...

9CVSS8.4AI score0.6819EPSS
SaveExploits5References5
Total number of security vulnerabilities4251