Lucene search
+L
NucleiRecent

4298 matches found

Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•97 views

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

6.1CVSS5.7AI score0.02721EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•42 views

Zoho ManageEngine ServiceDesk Plus - Authentication Bypass

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...

9.8CVSS8.7AI score0.99825EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•116 views

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting

ZyXEL ZyWALL 2 Plus Internet Security Appliance contains a cross-site scripting vulnerability. Insecure URI handling leads to bypass of security restrictions, which allows an attacker to execute arbitrary JavaScript codes to perform multiple attacks. id: CVE-2021-46387 info: name: Zyxel ZyWALL 2...

6.1CVSS6.1AI score0.21028EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•17 views

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

Qubely WordPress plugin 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubelysendformdata AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication. id: CVE-2021-24916 info: name:...

7.5CVSS7.8AI score0.01729EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•36 views

Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS

Multiple cross-site scripting XSS vulnerabilities in Open Bulletin Board OpenBB 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 redirect parameter to member.php, 2 to parameter to myhome.php 3 TID parameter to post.php, or 4 redirect parameter to...

4.3CVSS5.2AI score0.09001EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•55 views

QNAP HBS 3 - Broken Access Control

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...

10CVSS8.9AI score0.7825EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•65 views

Bludit 3.13.1 - Cross Site Scripting

Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in admin/login id: CVE-2021-35323 info: name: Bludit 3.13.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in...

6.1CVSS5.9AI score0.05621EPSS
SaveExploits4References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•40 views

WooCommerce Help Scout - Arbitrary File Upload

WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code...

9.8CVSS9.2AI score0.07908EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•67 views

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

6.1CVSS5.8AI score0.02483EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•112 views

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

7.2CVSS7.5AI score0.90461EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•189 views

Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution

Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal. id: CVE-2021-40870 info: name: Aviatrix Controller 6.x before 6.5-1804.192...

9.8CVSS9.4AI score0.93019EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•95 views

Prismatic < 2.8 - Cross-Site Scripting

The plugin does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator id: CVE-2021-24409 info: name: Prismatic 2.8 - Cross-Site Scripting author: Harsh...

6.1CVSS6AI score0.01793EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•59 views

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

10CVSS9AI score0.18957EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•73 views

WordPress JNews Theme <8.0.6 - Cross-Site Scripting

WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory. id: CVE-2021-24342 info: name: WordPress JNews Theme =8.0.6 to mitigate the XSS...

6.1CVSS5.8AI score0.01975EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•114 views

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

8.1CVSS6.4AI score0.08017EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•87 views

WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or...

7.2CVSS7.2AI score0.05898EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•112 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

9CVSS8.4AI score0.74979EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•41 views

WordPress True Ranker <2.2.4 - Local File Inclusion

WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. id: CVE-2021-39312 info: name: WordPress True Ranker 2.2...

7.5CVSS7.2AI score0.77944EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•57 views

Doctor Appointment System 1.0 - SQL Injection

SQL injection in the expertise parameter in searchresult.php in Doctor Appointment System v1.0. id: CVE-2021-27124 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: medium description: | SQL injection in the expertise parameter in searchresult.php in Doctor...

6.5CVSS6.7AI score0.05721EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•67 views

WordPress Car Seller - Auto Classifieds Script - SQL Injection

The requestlistrequest AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitize, validate or escape the orderid POST parameter before using it in a SQL statement, leading to a SQL injection...

9.8CVSS9AI score0.14697EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•39 views

MaxSite CMS > V106 - Cross-Site Scripting

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." id: CVE-2021-35265 info: name: MaxSite CMS V106 - Cross-Site Scripting author: pikpikcu severity: medium description: | A reflected...

6.1CVSS6AI score0.03436EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•68 views

JustWriting - Cross-Site Scripting

A cross-site scripting vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter. id: CVE-2021-41467 info: name: JustWriting - Cross-Site Scripting author: madrobot severity: medium...

6.1CVSS6AI score0.03601EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•185 views

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

9.9CVSS8.4AI score0.69075EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•118 views

Adobe ColdFusion - Cross-Site Scripting

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

5.4CVSS6.5AI score0.37095EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•68 views

Maian Cart <=3.8 - Remote Code Execution

Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. id: CVE-2021-32172 info: name: Maian Cart =3.8 to mitigate this vulnerability. reference: - https://dreyand.github.io/maian-cart-rce/ - https://github.com/DreyAnd/maian-cart-rce -...

9.8CVSS9.5AI score0.66433EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•76 views

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability via the cgi/cal URI. id: CVE-2021-26475 info: name: EPrints 3.4.2 - Cross-Site Scripting author: geeknik severity: medium description: EPrints 3.4.2 contains a reflected cross-site scripting vulnerability via the cgi/cal URI...

6.1CVSS6.7AI score0.07326EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•84 views

Akkadian Provisioning Manager - Information Disclosure

Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped. id: CVE-2021-31581 info: name: Akkadian Provisionin...

7.9CVSS4.8AI score0.01217EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•47 views

WordPress JH 404 Logger <=1.1 - Cross-Site Scripting

WordPress JH 404 Logger plugin through 1.1 contains a cross-site scripting vulnerability. Referer and path of 404 pages are not properly sanitized when they are output in the WordPress dashboard, which can lead to executing arbitrary JavaScript code. id: CVE-2021-24176 info: name: WordPress JH 40...

5.4CVSS5.4AI score0.02044EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•87 views

WOOF WordPress plugin - Cross-Site Scripting

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. id: CVE-2021-25085 info: name: WOOF WordPress plugin - Cross-Site Scripting author: Maximus Decimus severity: medium...

6.1CVSS5.9AI score0.01651EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•84 views

Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting

Triconsole Datepicker Calendar before 3.77 contains a cross-site scripting vulnerability in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. id:...

6.1CVSS5.8AI score0.06196EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•96 views

WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution

WordPress WPCargo Track & Trace plugin before 6.9.0 is susceptible to remote code execution, The plugin contains a file which can allow an attacker to write a PHP file anywhere on the web server, leading to possible remote code execution. This can allow an attacker to execute malware, obtain...

9.8CVSS9.2AI score0.56148EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•220 views

FlatPress 1.2.1 - Stored Cross-Site Scripting

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks. id: CVE-2021-41432 info: name: FlatPress 1.2.1 -...

5.4CVSS5.9AI score0.01711EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•60 views

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

6.1CVSS5.6AI score0.16044EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•113 views

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

10CVSS9.1AI score0.69882EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•113 views

Mautic <3.3.4 - Cross-Site Scripting

Mautic before 3.3.4 contains a cross-site scripting vulnerability on the password reset page in the bundle parameter of the URL. An attacker can inject arbitrary script, steal cookie-based authentication credentials, and/or launch other attacks. id: CVE-2021-27909 info: name: Mautic 3.3.4 -...

6.3CVSS6AI score0.04067EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•90 views

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

7.5CVSS7.4AI score0.04305EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•62 views

WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting

WordPress Bello Directory & Listing theme before 1.6.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape the listinglistview, btbblistingfieldmylat, btbblistingfieldmylng, btbblistingfielddistancevalue, btbblistingfieldmylatdefault,...

6.1CVSS5.7AI score0.10769EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•130 views

Alibaba Sentinel - Server-side request forgery (SSRF)

There is a Pre-Auth SSRF vulnerability in Alibaba Sentinel version 1.8.2, which allows remote unauthenticated attackers to perform SSRF attacks via the /registry/machine endpoint through the ip parameter. id: CVE-2021-44139 info: name: Alibaba Sentinel - Server-side request forgery SSRF author:...

7.5CVSS7.6AI score0.05643EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•47 views

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

8.7CVSS8.5AI score0.04028EPSS
SaveExploits29References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•60 views

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

9.8CVSS8.1AI score0.64874EPSS
SaveExploits4References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•31 views

LiquidFiles < 4.2 - User Enumeration via Password Reset

LiquidFiles filetransfer server before 4.2 contains a user enumeration vulnerability caused by distinguishable responses in password reset functionality, letting unauthenticated attackers enumerate valid user accounts, exploit requires no authentication. id: CVE-2025-56132 info: name: LiquidFiles...

7.3CVSS5.2AI score0.00648EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•69 views

esm.sh <= v136 - Local File Inclusion

esm.sh = 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request. id: CVE-2025-59341 info: name: esm.sh = v136 - Local File Inclusion author: 0xAkoko severity: high description:...

8.7CVSS8.9AI score0.01636EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•129 views

Langflow AI <= 1.6.9 - CORS Misconfiguration

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint. id:...

9.4CVSS9.7AI score0.83844EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•34 views

ETQ Reliance - Reflected XSS via SQLConverterServlet

A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...

5.1CVSS5.5AI score0.01907EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•232 views

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

9.8CVSS8.9AI score0.81801EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•78 views

PHPJabbers Service Booking Script 1.0 - Cross Site Scripting

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. id: CVE-2023-4113...

6.1CVSS3.3AI score0.08422EPSS
SaveExploits4References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•496 views

LearnPress < 4.2.5.8 - Remote Code Execution

The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to execute any...

9.8CVSS9.1AI score0.08544EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•139 views

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

8.3CVSS7.2AI score0.54872EPSS
SaveExploits5References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•30 views

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. id: CVE-2023-49489 info: name: KodeExplorer 4.51 - Reflective Cross Site Scripting XSS...

6.1CVSS5.9AI score0.00726EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•62 views

ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

9.4CVSS5.2AI score0.38932EPSS
SaveExploits6References5
Total number of security vulnerabilities4298