Lucene search
+L
NucleiRecent

4305 matches found

Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•53 views

Joomla! Component JotLoader 2.2.1 - Local File Inclusion

A directory traversal vulnerability in the JotLoader comjotloader component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. id: CVE-2010-4617 info: name: Joomla! Component JotLoader 2.2.1 - Local File...

6.8CVSS5.6AI score0.08571EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•55 views

WP-FaceThumb 0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the paginationwpfacethumb parameter. id: CVE-2012-2371 info: name: WP-FaceThumb 0.1 - Cross-Site Scripting author: daffainfo severity:...

4.3CVSS5.2AI score0.12848EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•29 views

ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 subTab or 2 tab parameter to createAnomaly.do; 3 url, 4 subTab, or 5 tab parameter to mindex.do; 6 tab parameter to index2.do; or 7 port...

4.3CVSS5.3AI score0.07718EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•38 views

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

4.3CVSS5.2AI score0.08693EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•46 views

WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting

WordPress wpForo Forum plugin before 1.4.12 for WordPress allows unauthenticated reflected cross-site scripting via the URI. id: CVE-2018-11709 info: name: WordPress wpForo Forum = 1.4.11 - Cross-Site Scripting author: daffainfo,s4e-io severity: medium description: WordPress wpForo Forum plugin...

6.1CVSS5.6AI score0.036EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•35 views

SV3C HD Camera L Series - Open Redirect

SV3C HD Camera L Series 2.3.4.2103-S50-NTD-B20170508B and 2.3.4.2103-S50-NTD-B20170823B contains an open redirect vulnerability. It does not perform origin checks on URLs in the camera's web interface, which can be leveraged to send a user to an unexpected endpoint. An attacker can possibly obtai...

6.1CVSS6.2AI score0.0315EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•48 views

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

6.1CVSS5.5AI score0.99293EPSS
SaveExploits3References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•43 views

Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect

Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. id: CVE-2018-14931 info: name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect author: 0xAkoko...

6.1CVSS6AI score0.02398EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•56 views

LG-Ericsson iPECS NMS 30M - Local File Inclusion

Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=../ URIs. id: CVE-2018-15138 info: name: LG-Ericsson iPECS NMS 30M - Local File Inclusion author: 0xAkoko severity: high description: Ericsson-LG iPECS NMS 30M allows local file inclusion via...

7.5CVSS7.4AI score0.12851EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•71 views

LG SuperSign EZ CMS 2.5 - Local File Inclusion

LG SuperSign CMS 2.5 allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs - aka local file inclusion. id: CVE-2018-16288 info: name: LG SuperSign EZ CMS 2.5 - Local File Inclusion author: daffainfo severity: high description: | LG SuperSign CMS 2.5 allows reading of...

8.6CVSS8.3AI score0.35828EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•55 views

WordPress Localize My Post 1.0 - Local File Inclusion

WordPress Localize My Post 1.0 is susceptible to local file inclusion via the ajax/include.php file parameter. id: CVE-2018-16299 info: name: WordPress Localize My Post 1.0 - Local File Inclusion author: 0xAkoko,0x240x23elu severity: high description: | WordPress Localize My Post 1.0 is susceptib...

7.5CVSS7.6AI score0.44358EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•67 views

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. id: CVE-2018-19386 info: nam...

6.1CVSS5.7AI score0.09044EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•74 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /admin/ssl-fields/add.php Display Name, Description & Notes field parameters. id: CVE-2018-19751 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains...

4.8CVSS5.3AI score0.03316EPSS
SaveExploits6References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•79 views

Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting

Adiscon LogAnalyzer before 4.1.7 contains a cross-site scripting vulnerability in the 'referer' parameter of the login.php file. id: CVE-2018-19877 info: name: Adiscon LogAnalyzer 4.1.7 - Cross-Site Scripting author: arafatansari severity: medium description: | Adiscon LogAnalyzer before 4.1.7...

6.1CVSS5.5AI score0.18563EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /domain//admin/dw/add-server.php DisplayName parameters. id: CVE-2018-19892 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripti...

4.8CVSS5.3AI score0.01514EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•89 views

SugarCRM 3.5.1 - Cross-Site Scripting

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. id: CVE-2018-5715 info: name: SugarCRM 3.5.1 - Cross-Site Scripting author: edoardottt severity: medium description: SugarCRM 3.5.1 is vulnerable to cross-site...

6.1CVSS5.5AI score0.06914EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•56 views

CouchCMS <= 2.0 - Path Disclosure

CouchCMS = 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. id: CVE-2018-7662 info: name: CouchCMS = 2.0 - Path Disclosure author: ritikchaddha severity: medium description: CouchCMS = 2.0 allows...

5.3CVSS5.5AI score0.47085EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•56 views

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion

WordPress 99 Robots WP Background Takeover Advertisements 4.1.4 is susceptible to local file inclusion via exports/download.php. id: CVE-2018-9118 info: name: WordPress 99 Robots WP Background Takeover Advertisements =4.1.4 - Local File Inclusion author: 0xAkoko severity: high description: |...

7.5CVSS7.6AI score0.46931EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•76 views

Nimble Streamer <=3.5.4-9 - Local File Inclusion

Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server. id: CVE-2019-11013 info: name: Nimble Streamer =3.5.4-9 - Local File Inclusion...

6.5CVSS6.3AI score0.23978EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•52 views

Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting

Zyxel ZyWall, USG, and UAG devices allow remote attackers to inject arbitrary web script or HTML via the errmsg parameter freetimefailed.cgi CGI program, aka reflective cross-site scripting. id: CVE-2019-12581 info: name: Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting author: n-thumann...

6.1CVSS5.7AI score0.064EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•124 views

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

10CVSS9.1AI score0.39335EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•64 views

Gallery Photoblocks < 1.1.43 - Cross-Site Scripting

The Gallery PhotoBlocks WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability. id: CVE-2019-15829 info: name: Gallery Photoblocks 1.1.43 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The Gallery PhotoBlocks WordPress plugin was affected by...

4.8CVSS4.8AI score0.01318EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•79 views

WordPress Visualizer <3.3.1 - Cross-Site Scripting

WordPress Visualizer plugin before 3.3.1 contains a stored cross-site scripting vulnerability via /wp-json/visualizer/v1/update-chart WP-JSON API endpoint. An unauthenticated attacker can execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard...

6.1CVSS6.1AI score0.03342EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•88 views

Kirona Dynamic Resource Scheduler - Information Disclosure

Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd aka /osmtiles/REGISTER.cmd, which contains sensitive information with exposed SQL queries, such as database version, table name, and column name. id:...

5.3CVSS5.8AI score0.48303EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•54 views

Ignite Realtime Openfire <4.42 - Local File Inclusion

Ignite Realtime Openfire through 4.4.2 is vulnerable to local file inclusion via PluginServlet.java. It does not ensure that retrieved files are located under the Openfire home directory. id: CVE-2019-18393 info: name: Ignite Realtime Openfire 4.42 - Local File Inclusion author: pikpikcu severity...

5.3CVSS5.4AI score0.13945EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•118 views

Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting

Rumpus FTP Web File Manager 8.2.9.1 contains a reflected cross-site scripting vulnerability via the Login page. An attacker can send a crafted link to end users and can execute arbitrary JavaScript. id: CVE-2019-19368 info: name: Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting author:...

6.1CVSS6.1AI score0.25889EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•70 views

Oracle Business Intelligence/XML Publisher - XML External Entity Injection

Oracle Business Intelligence and XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 are vulnerable to an XML external entity injection attack. id: CVE-2019-2616 info: name: Oracle Business Intelligence/XML Publisher - XML External Entity Injection author: pdteam severity: high description: Oracle...

7.2CVSS7.3AI score0.92183EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

Pypiserver <1.2.5 - Carriage Return Line Feed Injection

Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI. id: CVE-2019-6802 info: name: Pypiserver 1.2.5 - Carriage Return Line Feed Injection author...

6.1CVSS6AI score0.03802EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•60 views

Jira - Local File Inclusion

Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion. id: CVE-2019-8442 info: name: Jira - Local File Inclusion author:...

7.5CVSS7.3AI score0.59832EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•37 views

Submitty <= 20.04.01 - Open Redirect

Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-13121...

6.1CVSS6.2AI score0.02956EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•92 views

Aryanic HighMail (High CMS) - Cross-Site Scripting

A cross-site scripting vulnerability in Aryanic HighMail High CMS versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. id: CVE-2020-23517 info: name: Aryanic HighMail High CMS - Cross-Site Scripting author: geeknik severity: medium...

6.1CVSS6AI score0.07051EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•46 views

INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion

INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 is vulnerable to information disclosure, allowing unauthenticated attackers to access sensitive device information and configuration data via a direct request to the /cgi-bin/exportsettings.sh endpoint. id: CVE-2020-24285 info: name: INTELBRAS...

7.5CVSS7.5AI score0.04376EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•117 views

Commvault CommCell - Local File Inclusion

CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder. id: CVE-2020-25780 info: name: Commvault...

7.5CVSS7.5AI score0.09884EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•29 views

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

9.8CVSS9.7AI score0.06944EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•38 views

phpMyAdmin < 5.0.3 - SQL Injection

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input. id: CVE-2020-26935 info: name: phpMyAdmin 5.0.3 - SQL Injection author: 0xAko...

9.8CVSS8.8AI score0.67081EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•18 views

ThemeGrill Demo Importer < 1.6.2 - Database Reset

ThemeGrill Demo Importer before 1.6.2 does not require authentication for wiping the database due to a resetwizardactions hook. In versions 1.3.4 and above and versions 1.6.1 and below, there is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state...

9.1CVSS8.6AI score0.04105EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•39 views

twitter-server Cross-Site Scripting

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. id: CVE-2020-35774 info: name: twitter-server Cross-Site...

5.4CVSS5.2AI score0.85649EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•45 views

DrayTek Vigor - Command Injection

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. id: CVE-2020-15415 info: name:...

9.8CVSS8AI score0.8448EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•24 views

ThinkCMF X2.2.2 - Remote Code Execution

ThinkCMF X2.2.2 and below contain a remote code execution caused by processing crafted packets, letting attackers execute arbitrary code remotely, exploit requires sending malicious packets. id: CVE-2020-20601 info: name: ThinkCMF X2.2.2 - Remote Code Execution author: pikpikcu severity: critical...

9.8CVSS9.9AI score0.07598EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

WordPress Canto 1.3.0 - Blind Server-Side Request Forgery

WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative...

5.3CVSS5.8AI score0.27771EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•28 views

WordPress 15Zine <3.3.0 - Cross-Site Scripting

WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cbsa AJAX action. id: CVE-2020-36510 info: name: WordPress 15Zine 3.3.0 - Cross-Site Scripting author: veshraj...

6.1CVSS5.7AI score0.0259EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•72 views

UnRaid <=6.80 - Remote Code Execution

UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. id: CVE-2020-5847 info: name: UnRaid =6.80 - Remote Code Execution author: madrobot severity: critical description: UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. impact: |...

10CVSS8.8AI score0.95844EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•98 views

Mara CMS 7.5 - Cross-Site Scripting

Mara CMS 7.5 allows reflected cross-site scripting in contact.php via the theme or pagetheme parameters. id: CVE-2020-24223 info: name: Mara CMS 7.5 - Cross-Site Scripting author: pikpikcu severity: medium description: Mara CMS 7.5 allows reflected cross-site scripting in contact.php via the them...

6.1CVSS5.7AI score0.14552EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•69 views

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

9CVSS8.2AI score0.82165EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•33 views

XWiki >= 13.10.8 - Cross-Site Scripting

Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript. id: CVE-2023-29506 info: name: XWiki = 13.10.8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Reflected XSS vulnerability in XWiki authenticate endpoints allows...

6.1CVSS6.4AI score0.01721EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•41 views

PHPJabbers Food Delivery Script - SQL Injection

PHPJabbers Food Delivery Script 3.0 has a SQL injection SQLi vulnerability in the "q" parameter of index.php. id: CVE-2023-40748 info: name: PHPJabbers Food Delivery Script - SQL Injection author: ritikchaddha severity: critical description: | PHPJabbers Food Delivery Script 3.0 has a SQL injecti...

9.8CVSS9AI score0.02881EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•67 views

Tiempo.com <= 0.1.2 - Cross-Site Scripting

Tiempo.com before 0.1.2 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to stea...

6.1CVSS7AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•95 views

mlflow - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6831 info: name: mlflow - Path Traversal author: byObin severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Authenticated attackers...

8.1CVSS7.8AI score0.0329EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•76 views

PrestaShop `tshirtecommerce` Module - SQL Injection

The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the designer endpoint, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database. id: CVE-2023-27637 info: name: PrestaShop tshirtecommerce Module - SQL...

9.8CVSS9.3AI score0.03299EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•73 views

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

9.8CVSS9.1AI score0.56567EPSS
SaveExploits0References3
Total number of security vulnerabilities4305