Lucene search
+L
NucleiRecent

4375 matches found

Nuclei
Nuclei
added 2026/09/16 2:04 p.m.70 views

WordPress Sniplets <=1.2.2 - Cross-Site Scripting

WordPress Sniplets 1.1.2 and 1.2.2 plugin contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the text parameter to warning.php, notice.php, and inset.php in view/sniplets/, and possibly modules/execute.php; via the url parameter ...

4.3CVSS5.8AI score0.074EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.62 views

Joomla! <=2.0.0 RC2 - Local File Inclusion

Joomla! 2.0.0 RC2 and earlier are susceptible to local file inclusion in the eXtplorer module comextplorer that allows remote attackers to read arbitrary files via a .. dot dot in the dir parameter in a showerror action. id: CVE-2008-4764 info: name: Joomla! =2.0.0 RC2 - Local File Inclusion...

5CVSS5.9AI score0.16505EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.34 views

Rating by BestWebSoft < 0.2 - Cross-Site Scripting

The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. id: CVE-2017-18530 info: name: Rating by BestWebSoft 0.2 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. impact: |...

6.1CVSS6.2AI score0.01384EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.62 views

Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion

Oracle GlassFish Server Open Source Edition 3.0.1 build 22 is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server. id: CVE-2017-1000029 info: name: Oracle GlassFish Server Open Source Edition 3.0.1 - Local File...

7.5CVSS7.6AI score0.08348EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.79 views

Telaen => v1.3.1 - Open Redirect

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL. id: CVE-2013-2621 info: name: Telaen = v1.3.1 - Open Redirect author: ctflearner severity: medium description: | Open Redirection...

6.1CVSS6.5AI score0.10692EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.202 views

CMSimple 3.1 - Local File Inclusion

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

6.8CVSS6.3AI score0.18809EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.76 views

DedeCMS 5.7 - SQL Injection

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php. id: CVE-2017-17731 info: name: DedeCMS 5.7 - SQL Injection author: j4vaovo severity: critical description: | DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php. impact: |...

9.8CVSS8.2AI score0.13194EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.68 views

Phoenix Framework - Open Redirect

Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks. id: CVE-2017-1000163 info: name: Phoenix Framework - Open Redirect author: 0xAkoko severity: medium...

6.1CVSS6.2AI score0.02377EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.71 views

SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. id: CVE-2017-18518 info: name: SMTP by BestWebSoft 1.1.0 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. impact: |...

6.1CVSS6.2AI score0.01621EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.67 views

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

6.1CVSS6.1AI score0.01937EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.53 views

WordPress Tidio-form <=1.0 - Cross-Site Scripting

WordPress tidio-form1.0 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

6.1CVSS6.3AI score0.04173EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.35 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS8.8AI score0.7453EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.50 views

Updater by BestWebSoft < 1.35 - Cross-Site Scripting

The updater plugin before 1.35 for WordPress has multiple XSS issues. id: CVE-2017-18565 info: name: Updater by BestWebSoft 1.35 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The updater plugin before 1.35 for WordPress has multiple XSS issues. impact: | Authenticat...

6.1CVSS6.2AI score0.0139EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.51 views

HPE System Management - Cross-Site Scripting

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

5.4CVSS6.4AI score0.04515EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.43 views

Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal

Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication. id: CVE-2017-9965 info: name: Schneider Electric Pelco VideoXpert...

5.8CVSS6.4AI score0.04612EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.44 views

Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. id: CVE-2017-18491 info: name: Contact Form by BestWebSoft 4.0.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple X...

6.1CVSS6.2AI score0.01458EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.34 views

WordPress Mailster <=1.5.4 - Cross-Site Scripting

WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. id: CVE-2017-17451 info: name: WordPress Mailster =1.5.5 which includes a fix for this vulnerability. reference: -...

6.1CVSS6.2AI score0.05088EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.42 views

WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting

WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via playlist.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.3AI score0.0465EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.57 views

Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting

The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. id: CVE-2017-18493 info: name: Custom Admin Page by BestWebSoft 0.1.2 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The custom-admin-page plugin before 0.1.2 for WordPress has multiple...

6.1CVSS6.2AI score0.014EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.172 views

DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery

DotNetNuke aka DNN before 9.2.0 suffers from a server-side request forgery vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources. id: CVE-2017-0929 info: name: DotNetNuke DNN ImageHandler 9.2.0 - Server-Side Request Forgery author...

7.5CVSS7.5AI score0.12543EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.120 views

WordPress wSecure Lite < 2.4 - Remote Code Execution

WordPress wsecure plugin before 2.4 is susceptible to remote code execution via shell metacharacters in the wsecure-config.php publish parameter. id: CVE-2016-10960 info: name: WordPress wSecure Lite 2.4 - Remote Code Execution author: daffainfo severity: high description: WordPress wsecure plugi...

8.8CVSS8.2AI score0.08976EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.45 views

Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting

The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. id: CVE-2017-18558 info: name: Testimonials by BestWebSoft 0.1.9 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS...

6.1CVSS6.2AI score0.01384EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.71 views

OpenDreambox 2.0.0 - Remote Code Execution

OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py. id: CVE-2017-14135 info: nam...

10CVSS8.9AI score0.21842EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.53 views

NETGEAR Routers - Authentication Bypass

NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices are susceptible to authentication bypass via simple crafted requests to the web management server. id: CVE-2017-5521 info: name: NETGEAR Routers - Authentication Bypass...

8.1CVSS7.9AI score0.89353EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.64 views

WordPress e-search <=1.0 - Cross-Site Scripting

WordPress e-search 1.0 and before contains a reflected cross-site scripting vulnerability via titleaz.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.3AI score0.0465EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.429 views

vBulletin <= 4.2.3 - SQL Injection

vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database. id: CVE-2016-6195 info: name:...

9.8CVSS8.5AI score0.68493EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.38 views

WordPress AJAX Random Post <=2.00 - Cross-Site Scripting

WordPress AJAX Random Post 2.00 is vulnerable to reflected cross-site scripting. id: CVE-2016-1000127 info: name: WordPress AJAX Random Post =2.00 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress AJAX Random Post 2.00 is vulnerable to reflected cross-site scripting...

6.1CVSS6AI score0.03718EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.16 views

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

9.8CVSS5.7AI score0.02639EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.28 views

WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

5.3CVSS5.7AI score0.007EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.9 views

Kirby CMS 5.3.0-5.4.0 - Path Traversal

Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences such as "../..", which the application concatenates...

8.8CVSS5.6AI score0.0177EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.10 views

Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

10CVSS6AI score0.01701EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.57 views

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

9.8CVSS5.7AI score0.03469EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.34 views

WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

8.5CVSS6.2AI score0.01668EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.9 views

Bludit CMS <= 3.20.0 - Cross-Site Scripting

Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query. id: CVE-2026-41456 info: name: Bludit CMS = 3.20.0 - Cross-Site Scripting author: 0xAkoko...

5.1CVSS5.8AI score0.01902EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.30 views

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

6.1CVSS5.9AI score0.00686EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.48 views

INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion

INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 is vulnerable to information disclosure, allowing unauthenticated attackers to access sensitive device information and configuration data via a direct request to the /cgi-bin/exportsettings.sh endpoint. id: CVE-2020-24285 info: name: INTELBRAS...

7.5CVSS7.2AI score0.04412EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.40 views

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

4.3CVSS5.8AI score0.08693EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.32 views

ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 subTab or 2 tab parameter to createAnomaly.do; 3 url, 4 subTab, or 5 tab parameter to mindex.do; 6 tab parameter to index2.do; or 7 port...

4.3CVSS5.8AI score0.07718EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.105 views

RaspAP <=2.6.5 - Remote Command Injection

RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";". id: CVE-2021-33357 info: name: RaspAP =2.6.5 - Remote Command Injection...

9.8CVSS8.5AI score0.17446EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.64 views

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

6.1CVSS6.2AI score0.16044EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.116 views

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

8.1CVSS6.5AI score0.08143EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.159 views

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

8.8CVSS8.1AI score0.13235EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.52 views

GiveWP <= 2.9.7 - Cross-Site Scripting

GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions before 2.10.0 is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in the admin Donors page. id: CVE-2021-24213 info: name: GiveWP = 2.9.7 - Cross-Site Scripting author: Shivam Kamboj severity: medium...

6.1CVSS6.2AI score0.0137EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.81 views

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

WordPress Pie Register plugin before 3.7.0.1 is susceptible to cross-site scripting. The plugin does not sanitize the invitaioncode GET parameter when outputting it in the Activation Code page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

6.1CVSS6.1AI score0.01602EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.121 views

Adobe ColdFusion - Cross-Site Scripting

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

5.4CVSS6.7AI score0.37095EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.94 views

Gryphon Tower - Cross-Site Scripting

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

6.1CVSS6.3AI score0.02557EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.89 views

Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting

Triconsole Datepicker Calendar before 3.77 contains a cross-site scripting vulnerability in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. id:...

6.1CVSS6.2AI score0.06196EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.242 views

D-Link DIR850 ET850-1.08TRb03 - Open Redirect

DLink DIR850 ET850-1.08TRb03 contains incorrect access control vulnerability in URL redirection, which can be used to mislead users to go to untrusted sites. id: CVE-2021-46379 info: name: D-Link DIR850 ET850-1.08TRb03 - Open Redirect author: 0xAkoko severity: medium description: DLink DIR850...

6.1CVSS6.8AI score0.15769EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.119 views

Mautic <3.3.4 - Cross-Site Scripting

Mautic before 3.3.4 contains a cross-site scripting vulnerability on the password reset page in the bundle parameter of the URL. An attacker can inject arbitrary script, steal cookie-based authentication credentials, and/or launch other attacks. id: CVE-2021-27909 info: name: Mautic 3.3.4 -...

6.3CVSS6.2AI score0.04067EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.89 views

WOOF WordPress plugin - Cross-Site Scripting

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. id: CVE-2021-25085 info: name: WOOF WordPress plugin - Cross-Site Scripting author: Maximus Decimus severity: medium...

6.1CVSS6.3AI score0.01651EPSS
SaveExploits2References4
Total number of security vulnerabilities4375