Lucene search
+L
NucleiRecent

4305 matches found

Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•68 views

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. id: CVE-2021-37416 info: name: Zoho ManageEngine ADSelfService Plus 6103 to mitigate this vulnerability. reference: -...

6.1CVSS5.7AI score0.02934EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•123 views

IPeakCMS 3.5 - SQL Injection

ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication. id: CVE-2021-3018 info: name: IPeakCMS 3.5 - SQL Injection author:...

9.8CVSS9.4AI score0.19506EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•96 views

Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/mynotifications NEWUINAV parameter. id: CVE-2021-36450 info: name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium description: Verint...

6.1CVSS5.7AI score0.64048EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•65 views

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery

Onair2 3.9.9.2 and KenthaRadio 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery. id: CVE-2021-24472 info...

9.8CVSS8.8AI score0.56614EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•90 views

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

7.5CVSS7.4AI score0.04305EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•62 views

WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting

WordPress Bello Directory & Listing theme before 1.6.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape the listinglistview, btbblistingfieldmylat, btbblistingfieldmylng, btbblistingfielddistancevalue, btbblistingfieldmylatdefault,...

6.1CVSS5.7AI score0.10769EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•44 views

Clansphere CMS 2011.4 - Cross-Site Scripting

Clansphere CMS 2011.4 contains an unauthenticated reflected cross-site scripting vulnerability via the "language" parameter. id: CVE-2021-27310 info: name: Clansphere CMS 2011.4 - Cross-Site Scripting author: alph4byt3 severity: medium description: Clansphere CMS 2011.4 contains an unauthenticate...

6.1CVSS5.7AI score0.02816EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•95 views

Prismatic < 2.8 - Cross-Site Scripting

The plugin does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator id: CVE-2021-24409 info: name: Prismatic 2.8 - Cross-Site Scripting author: Harsh...

6.1CVSS6AI score0.01793EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•30 views

Chamilo model.ajax.php - SQL Injection

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. id: CVE-2021-34187 info: name: Chamilo model.ajax.php - SQL Injection author: DhiyaneshDK severity: critical description: | main/inc/ajax/model.ajax.php in Chamilo...

9.8CVSS9.3AI score0.16181EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•91 views

Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection

Sunhillo SureLine 8.7.0.1.1 is vulnerable to OS command injection. The /cgi/networkDiag.cgi script directly incorporated user-controllable parameters within a shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. The following POST request...

10CVSS9.2AI score0.97599EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•31 views

Canon Devices - Authentication Bypass in Catwalk Server

Certain Canon devices manufactured in 2012 through 2020 such as imageRUNNER ADVANCE iR-ADV C5250, when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For...

7.5CVSS7.4AI score0.04EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•87 views

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...

7.8CVSS7.6AI score0.20514EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•80 views

myfactory FMS - Cross-Site Scripting

myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. id: CVE-2021-42565 info: name: myfactory FMS - Cross-Site Scripting author: madrobot,daffainfo severity: medium description: | myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. impact: |...

6.1CVSS5.7AI score0.05832EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•65 views

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php id: CVE-2021-4449 info: name: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload author: 0xnemian severity: critical description: | ZoomSounds plugin for WordPress contains a file upload vulnerability in...

9.8CVSS8.8AI score0.05439EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•88 views

QSAN Storage Manager <3.3.3 - Cross-Site Scripting

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. id: CVE-2021-37216 info: name: QSAN Storage Manager 3.3.3 - Cross-Site...

6.1CVSS5.7AI score0.03186EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•74 views

vRealize Operations Manager API - Server-Side Request Forgery

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. id: CVE-2021-21975 info: name: vRealize Operation...

8.5CVSS7.9AI score0.7829EPSS
SaveExploits13References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•62 views

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting

WordPress Goto Tour & Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and startdate GET parameters on its Tour List page. id: CVE-2021-24235 info: name: WordPress Goto Tour & Travel Theme =2.0 to mitigate the XSS...

6.1CVSS5.8AI score0.02927EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•131 views

WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting

WordPress Advanced Order Export For WooCommerce plugin before 3.1.8 contains an authenticated cross-site scripting vulnerability via the tab parameter in the admin panel. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

6.1CVSS6AI score0.10348EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•92 views

XStream <1.4.17 - Remote Code Execution

XStream before 1.4.17 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of...

8.8CVSS7.7AI score0.77232EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•120 views

IceWarp Mail Server - Open Redirect

IceWarp Mail Server contains an open redirect via the referer parameter. This can lead to phishing attacks or other unintended redirects. id: CVE-2021-36580 info: name: IceWarp Mail Server - Open Redirect author: DhiyaneshDk severity: medium description: | IceWarp Mail Server contains an open...

6.1CVSS6AI score0.01529EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•94 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS4.7AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•20 views

Oliver 5 Library Server <8.00.008.053 - Local File Inclusion

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. id: CVE-2021-45027 info: name: Oliver 5 Library Server 8.00.008.053 - Local File Inclusion author: gy741 severity: high description: Oliver 5 Library Server versions prior t...

7.5CVSS7.4AI score0.01736EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•111 views

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. id: CVE-2021-24274 info: name: WordPress Supsystic Ultimate Ma...

6.1CVSS5.7AI score0.17638EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•138 views

GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. id: CVE-2021-43778 info: name: GLPI plugin Barcode 2.6.1 - Path Traversal Vulnerability. author:...

9.1CVSS7.4AI score0.52658EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•105 views

WordPress Imagements <=1.2.5 - Arbitrary File Upload

WordPress Imagements plugin through 1.2.5 is susceptible to arbitrary file upload which can lead to remote code execution. The plugin allows images to be uploaded in comments but only checks for the Content-Type in the request to forbid dangerous files. An attacker can upload arbitrary files by...

9.8CVSS9.4AI score0.0714EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•47 views

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting

The plugin was affected by a reflected XSS in custom-facebook-feed in cff-top admin page. id: CVE-2021-25065 info: name: Smash Balloon Social Post Feed 4.1.1 - Authenticated Reflected Cross-Site Scripting author: Harsh severity: medium description: | The plugin was affected by a reflected XSS in...

5.4CVSS5.4AI score0.01217EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•84 views

Ruby Dragonfly <1.4.0 - Remote Code Execution

Ruby Dragonfly before 1.4.0 contains an argument injection vulnerability that allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishand...

9.8CVSS9AI score0.72143EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•97 views

Cartadis Gespage 8.2.1 - Directory Traversal

Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData. id: CVE-2021-33807 info: name: Cartadis Gespage 8.2.1 - Directory Traversal author: daffainfo severity: high description: Cartadis Gespage through 8.2.1 allows Directory Traversa...

7.5CVSS7.5AI score0.16139EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•96 views

HD-Network Realtime Monitoring System 2.0 - Local File Inclusion

Instances of HD-Network Realtime Monitoring System version 2.0 are vulnerable to a Local File Inclusion vulnerability which allows remote unauthenticated attackers to view confidential information. id: CVE-2021-45043 info: name: HD-Network Realtime Monitoring System 2.0 - Local File Inclusion...

7.5CVSS7.5AI score0.33133EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•174 views

KONGA 0.14.9 - Privilege Escalation

KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/ID at ADMIN parameter. id: CVE-2021-42192 info: name: KONGA 0.14.9 - Privilege Escalation author: rschio severity: high description...

9CVSS8AI score0.10066EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•156 views

Apache Tapestry - Remote Code Execution

Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the...

10CVSS9.6AI score0.93471EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•74 views

WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection

WordPress Visitor Statistics Real Time Traffic plugin before 4.8 does not properly sanitize and escape the refUrl in the refDetails AJAX action, which is available to any authenticated user. This could allow users with a role as low as subscriber to perform SQL injection attacks. id: CVE-2021-247...

8.8CVSS8.4AI score0.38298EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•71 views

XStream < 1.4.16 - Remote Code Execution

XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights can execute host commands via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operation...

9.9CVSS7.7AI score0.72324EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•80 views

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 is susceptible to local file inclusion because of insecure handling of a download function that leads to disclosure of internal files due to path traversal with root privileges. id: CVE-2021-46417 info: name: Franklin Fueling Systems...

7.8CVSS7.5AI score0.59753EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•87 views

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-42887 info:...

9.8CVSS8.9AI score0.44291EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•59 views

Prometheus - Open Redirect

Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and...

6.5CVSS6.2AI score0.1956EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•311 views

CraftCMS SEOmatic - Server-Side Template Injection

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side. Template Injection, allowing for remote code execution. id: CVE-2021-41749 info: name: CraftCMS SEOmatic - Server-Side Template Injection author: iamnoooob,ritikchaddha...

9.8CVSS9AI score0.18335EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•16 views

Gnuboard 5 - Cross-Site Scripting

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. id: CVE-2021-3831 info: name: Gnuboard 5 - Cross-Site Scripting author: arafatansari severity: medium description: | Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter...

7.1CVSS6.2AI score0.01812EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•158 views

GitLab GraphQL API User Enumeration

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. id: CVE-2021-4191 info: name: GitLab GraphQL API User Enumeration author: zsusac severity: medium description: An unauthenticated remote attacker can leverage thi...

5.3CVSS7AI score0.80004EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•34 views

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

10CVSS9.8AI score0.83214EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•119 views

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

8.5CVSS8.1AI score0.98124EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•110 views

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter. id: CVE-2021-39316 info: name: WordPress DZS Zoomsounds =6.51 to fix t...

7.5CVSS7.9AI score0.65763EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•189 views

Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution

Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal. id: CVE-2021-40870 info: name: Aviatrix Controller 6.x before 6.5-1804.192...

9.8CVSS9.4AI score0.93019EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•40 views

WooCommerce Help Scout - Arbitrary File Upload

WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code...

9.8CVSS9.2AI score0.07908EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•55 views

QNAP HBS 3 - Broken Access Control

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...

10CVSS8.9AI score0.7825EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•92 views

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. id: CVE-2021-26702 info: name: EPrints 3.4.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: EPrints 3.4.2 contains a reflected cross-site...

6.1CVSS6.7AI score0.03072EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•67 views

Zoho ManageEngine Desktop Central - Remote Code Execution

Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity:...

10CVSS9.4AI score0.99871EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•23 views

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

8.6CVSS7.7AI score0.49051EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•123 views

Geutebruck - Remote Command Injection

Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-33544 info: name: Geutebruck - Remote Command Injection author: gy741 severit...

7.2CVSS7.5AI score0.953EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•65 views

Bludit 3.13.1 - Cross Site Scripting

Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in admin/login id: CVE-2021-35323 info: name: Bludit 3.13.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in...

6.1CVSS5.9AI score0.05621EPSS
SaveExploits4References3
Total number of security vulnerabilities4305