Lucene search
+L
NucleiRecent

4376 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.85 views

Ninja Forms < 3.6.26 - Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2023-37979 info: name: Ninja Forms 3.6.26 - Cross-Site Scripting author: r3Y3r53 severity:...

7.1CVSS7.2AI score0.09707EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.345 views

Sitecore - Remote Code Execution

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. id: CVE-2023-35813 info: name: Sitecore - Remote Code Execution author: DhiyaneshDk,iamnoooob severity: critical description: | Multiple Sitecore...

9.8CVSS8.6AI score0.86685EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.80 views

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php. id: CVE-2023-43374 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

9.8CVSS8.1AI score0.03272EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.37 views

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

6.1CVSS7AI score0.0129EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.20 views

OpenProject < 12.5.4 - Project Identifiers Exposure

OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication. id: CVE-2023-33960 info: name: OpenProject 12.5.4 - Project...

7.5CVSS7.2AI score0.01257EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.96 views

Newsletter < 7.6.9 - Cross-Site Scripting

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...

6.1CVSS6.3AI score0.01198EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.96 views

Stable Diffusion Webui 1.10.0 - Open Redirect

An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. id: CVE-2024-11044...

6.1CVSS6.2AI score0.00807EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.146 views

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

9.8CVSS8.2AI score0.03049EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.25 views

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

5.3CVSS5.8AI score0.00934EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.32 views

Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. id: CVE-2024-32114 info: name: Apache ActiveMQ 6.x 6.1....

8.8CVSS7.8AI score0.07148EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.54 views

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

8.8CVSS8.3AI score0.05015EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.12 views

WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE

The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...

10CVSS8.5AI score0.30783EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.46 views

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

5.4CVSS5.9AI score0.0313EPSS
SaveExploits0
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.48 views

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

7.5CVSS7.2AI score0.32916EPSS
SaveExploits3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.67 views

BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection

A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack...

6.5CVSS6.3AI score0.12051EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.183 views

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

7.5CVSS5.9AI score0.55574EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.143 views

Wordpress Country State City Dropdown <=2.7.2 - SQL Injection

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

9.8CVSS5.7AI score0.13618EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.227 views

XWiki < 4.10.20 - Remote code execution

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...

10CVSS8.1AI score0.3452EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.70 views

XWiki Platform - Unauthorized Document History Access

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

5.3CVSS5.7AI score0.03417EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.131 views

WyreStorm Apollo VX20 - Information Disclosure

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext credentials for the SoftAP access point Router /device/config using an HTTP GET request. id: CVE-2024-25735 info: name: WyreStorm Apollo VX20 - Information Disclosure author: johnk3r...

9.1CVSS7.2AI score0.50622EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.56 views

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

7.2CVSS7.5AI score0.05213EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.50 views

Sensei LMS < 4.24.2 - Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. id: CVE-2024-7786 info: name: Sensei LMS 4.24.2 - Email Template Leak author: s4e-io severity: high description: | The Sensei LMS WordPress...

7.5CVSS5.5AI score0.01745EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.41 views

Arcserve Unified Data Protection - Authentication Bypass

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin function within wizardLogin. id: CVE-2024-0799 info: name: Arcserve Unified Data Protection -...

9.8CVSS8.3AI score0.04342EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.111 views

LyLme-Spage - Arbitary File Upload

An arbitrary file upload vulnerability in the component /include/file.php of lylmespage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-34982 info: name: LyLme-Spage - Arbitary File Upload author: DhiyaneshDk severity: high description: | An arbitrary...

9.8CVSS6.5AI score0.04675EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.275 views

Argo CD Unauthenticated Access to sensitive setting

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. id: CVE-2024-37152 info: name: Ar...

7.5CVSS6.4AI score0.02348EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.111 views

Smart s200 Management Platform v.S200 - SQL Injection

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component. id: CVE-2024-27718 info: name: Smart s200 Management Platform v.S200 - SQL Injection author:...

7.8CVSS5.7AI score0.01101EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.99 views

Mitel MiCollab - Arbitary File Read

The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attack...

9.8CVSS7.6AI score0.9811EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.312 views

ChatGPT个人专用版 - Server Side Request Forgery

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. id: CVE-2024-27564 info: name: ChatGPT个人专用版 - Server Side Request Forgery author: DhiyaneshDK...

6.5CVSS7.4AI score0.40637EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.119 views

DataEase <= 2.4.1 - Sensitive Information Exposure

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. id: CVE-2024-30269...

5.3CVSS5.7AI score0.15875EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.116 views

osCommerce v4.0 - Cross-site Scripting

A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. id: CVE-2024-4348 info: name:...

5CVSS3.8AI score0.01828EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.227 views

Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

9.8CVSS7.5AI score0.28336EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.50 views

Usermin 2.100 - Username Enumeration

Usermin version 2.100 and below is susceptible to username enumeration via the password change functionality. An attacker can determine valid usernames by analyzing the response messages from the password change endpoint. id: CVE-2024-44762 info: name: Usermin 2.100 - Username Enumeration author:...

5.3CVSS5.9AI score0.02566EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.301 views

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

9.8CVSS8.1AI score0.80596EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.24 views

Langflow <= 1.0.12 - Remote Code Execution

Langflow 0.6.19 contains a remote code execution caused by accepting untrusted Python scripts in the /api/v1/customcomponent endpoint, letting remote attackers execute arbitrary code, exploit requires access to the endpoint and untrusted script input. id: CVE-2024-37014 info: name: Langflow =...

9.8CVSS8.7AI score0.63037EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.111 views

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

7.5CVSS7.2AI score0.26788EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.98 views

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

6.1CVSS5.8AI score0.00705EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.65 views

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

4CVSS5.3AI score0.00668EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.34 views

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin. id: CVE-2024-10146 info: name: Simple File List 6.1.13...

5.4CVSS5.7AI score0.00585EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.82 views

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the nutenteagg parameter at /hoteldruid/interconnessioni.php. id: CVE-2023-43373 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

9.8CVSS8.1AI score0.03753EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.176 views

XWiki - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

9.6CVSS6.2AI score0.02048EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.90 views

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

5.3CVSS5.7AI score0.01207EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.209 views

PrestaShop AdvancedPopupCreator - SQL Injection

In the module “Advanced Popup Creator” advancedpopupcreator from Idnovate for PrestaShop, a guest can perform SQL injection in affected versions. id: CVE-2023-27032 info: name: PrestaShop AdvancedPopupCreator - SQL Injection author: MaStErChO severity: critical description: | In the module...

9.8CVSS8.1AI score0.03015EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.147 views

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

8.8CVSS7.7AI score0.1354EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.91 views

GL.iNET SSID Key Disclosure

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. id: CVE-2023-31478 info: name: GL.iNET SSID Key Disclosure author: DhiyaneshDK severity: high description: | An issue was discovered on GL.iNet...

7.5CVSS7.5AI score0.29699EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.82 views

PMB v7.4.6 - Cross-Site Scripting

PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via the 'query' parameter. id: CVE-2023-24737 info: name: PMB v7.4.6 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via t...

6.1CVSS6.3AI score0.01169EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.273 views

Weaver E-Office 9.5 - Remote Code Execution

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit h...

9.8CVSS6.6AI score0.32895EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.104 views

Linksys E2000 1.0.06 position.js Improper Authentication

Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. id: CVE-2024-27497 info: name: Linksys E2000 1.0.06 position.js Improper Authentication author: DhiyaneshDk severity: high description: | Linksys E2000 Ver.1.0.06 build 1 is vulnerable to...

8.8CVSS8.1AI score0.26657EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.34 views

Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

The Hide My WP Ghost plugin does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page. id: CVE-2024-6420 info: name: Hide My WP Ghost 5.2.02 - Hidden Login Page Disclosure author: jpg0mez severity: hig...

8.6CVSS5.7AI score0.018EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.29 views

Push Notification for Post and BuddyPress <= 1.93 - SQL Injection

Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to SQL Injection via the 'onesignalexternalid' and 'onesignalgetsubscriptionoptionsid' paramters in all versions up to, and including, 1.93 due to insufficient escaping on the user supplied parameter and lack of sufficie...

9.8CVSS5.6AI score0.02758EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.36 views

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

5.3CVSS6.8AI score0.00909EPSS
SaveExploits0References3
Total number of security vulnerabilities4376