Lucene search
+L
NucleiRecent

4312 matches found

Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•355 views

ThinkPHP 5.0.24 - Information Disclosure

ThinkPHP 5.0.24 is susceptible to information disclosure. This version was configured without the PATHINFO parameter. This can allow an attacker to access all system environment parameters from index.php, thereby possibly obtaining sensitive information, modifying data, and/or executing...

7.5CVSS7.5AI score0.04748EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•113 views

Cuppa CMS v1.0 - Local File Inclusion

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. id: CVE-2022-25486 info: name: Cuppa CMS v1.0 - Local File Inclusion author: theamanrawat severity: high description: | CuppaCMS v1.0 was discovered to contain a local file...

7.8CVSS7.5AI score0.09966EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•113 views

WordPress Duplicator <1.4.7 - Authentication Bypass

WordPress Duplicator plugin before 1.4.7 is susceptible to authentication bypass. The plugin discloses the URL of the backup to unauthenticated visitors accessing the main installer endpoint. If the installer script has been run once by an administrator, this allows download of the full site back...

7.5CVSS7.2AI score0.16673EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•71 views

MotionEye Config Info Disclosure

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. id: CVE-2022-25568 info: name: MotionEye Config Info Disclosure author: DhiyaneshDK severity: high...

7.5CVSS7.3AI score0.06885EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•277 views

WordPress Newspaper < 12 - Cross-Site Scripting

WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized...

6.1CVSS5.6AI score0.00979EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•102 views

Kavita <0.5.4.1 - Server-Side Request Forgery

Kavita before 0.5.4.1 is susceptible to server-side request forgery in GitHub repository kareadita/kavita. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-2756 info: name:...

7.1CVSS6.8AI score0.03109EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•84 views

Microfinance Management System 1.0 - SQL Injection

Microfinance Management System 1.0 is susceptible to SQL Injection. id: CVE-2022-27927 info: name: Microfinance Management System 1.0 - SQL Injection author: lucasljm2001,ekrause severity: critical description: | Microfinance Management System 1.0 is susceptible to SQL Injection. impact: |...

9.8CVSS9AI score0.13829EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•78 views

Atom CMS v2.0 - SQL Injection

AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxpages.php id: CVE-2022-28032 info: name: Atom CMS v2.0 - SQL Injection author: theamanrawat severity: critical description: | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxpages.php impact: | Successful exploitation...

9.8CVSS9.2AI score0.05922EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•49 views

College Management System 1.0 - SQL Injection

College Management System 1.0 contains a SQL injection vulnerability via the course code parameter. id: CVE-2022-28079 info: name: College Management System 1.0 - SQL Injection author: ritikchaddha severity: high description: | College Management System 1.0 contains a SQL injection vulnerability...

8.8CVSS8.5AI score0.28512EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•54 views

Dairy Farm Shop Management System 1.0 - SQL Injection

Dairy Farm Shop Management System 1.0 contains multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context ...

9.8CVSS9.2AI score0.19253EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•65 views

Cyber Cafe Management System 1.0 - SQL Injection

Cyber Cafe Management System 1.0 contains multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of th...

9.8CVSS9.2AI score0.22909EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•103 views

kkFileView 4.0.0 - Cross-Site Scripting

kkFileView 4.0.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. id: CVE-2022-29349 info: name: kkFileView 4.0.0 - Cross-Site Scripting author: arafatansari severity: medium description: | kkFileView 4.0.0...

6.1CVSS5.8AI score0.0175EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•104 views

NETGEAR ProSafe SSL VPN firmware - SQL Injection

NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi. id: CVE-2022-29383 info: name: NETGEAR ProSafe SSL VPN firmware - SQL Injection author: elitebaz severity: critical description: |...

9.8CVSS7.5AI score0.48537EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•75 views

iSpy 7.2.2.0 - Authentication Bypass

iSpy 7.2.2.0 contains an authentication bypass vulnerability. An attacker can craft a URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-29775 info: name: iSpy 7.2.2.0 - Authentication Bypass author: arafatansari severity: critical...

9.8CVSS9AI score0.60667EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•115 views

WBCE CMS 1.5.2 - Cross-Site Scripting

WBCE CMS 1.5.2 contains a stored cross-site scripting vulnerability via \admin\user\save.php Display Name parameters. id: CVE-2022-30073 info: name: WBCE CMS 1.5.2 - Cross-Site Scripting author: arafatansari severity: medium description: | WBCE CMS 1.5.2 contains a stored cross-site scripting...

5.4CVSS5.2AI score0.01603EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•78 views

School Dormitory Management System 1.0 - SQL Injection

School Dormitory Management System 1.0 contains a SQL injection vulnerability via accounts/paymenthistory.php:31. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-30512 info:...

9.8CVSS9.2AI score0.09706EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•79 views

VMware - Local File Inclusion

VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access withou...

9.8CVSS8.8AI score0.2294EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•101 views

Nortek Linear eMerge E3-Series - Cross-Site Scripting

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. id: CVE-2022-31798 info: name: Nortek Linear eMerge E3-Series - Cross-Site Scripting author: ritikchaddha severity: medium description: |...

6.1CVSS5.8AI score0.08513EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•90 views

WAVLINK WN535 G3 - Information Disclosure

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in livecheck.shtml. An attacker can obtain sensitive router information via execution of the exec cmd function and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

7.5CVSS6.8AI score0.08541EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•509 views

Codoforum 5.1 - Arbitrary File Upload

Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain...

7.2CVSS7.4AI score0.32233EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•63 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleterequest. id: CVE-2022-31976 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: critical description: | Online Fire Reporting System v1.0 is vulnerable to...

9.8CVSS9.2AI score0.07224EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•127 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/takeaction.php?id=. id: CVE-2022-31984 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL...

7.2CVSS7.5AI score0.04906EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•52 views

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/admin/company/index.php?view=edit&id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...

7.2CVSS7.5AI score0.04563EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•83 views

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

7.2CVSS7.5AI score0.04563EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•244 views

Car Rental Management System 1.0 - SQL Injection

Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/viewcar.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-32025 info:...

7.2CVSS7.4AI score0.04563EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•77 views

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/doctor.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS9.2AI score0.07635EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•71 views

Microweber <1.3.2 - Cross-Site Scripting

Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2. id: CVE-2022-3242 info: name: Microweber 1.3.2 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Code Injection in on search.php?keywords= GitHub repository microweber/microweber...

6.1CVSS4.9AI score0.0152EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•39 views

WWBN AVideo 11.6 - Cross-Site Scripting

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. id: CVE-2022-32772 info: name: WWBN AVideo 11.6 - Cross-Site Scripting author: arafatansari severity: medi...

9.6CVSS7.4AI score0.03871EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•98 views

WordPress Visitor Statistics <=5.7 - SQL Injection

WordPress Visitor Statistics plugin through 5.7 contains multiple unauthenticated SQL injection vulnerabilities. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-33965 info:...

9.8CVSS9.2AI score0.04334EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•111 views

CuppaCMS v1.0 - Local File Inclusion

Cuppa CMS v1.0 is vulnerable to local file inclusion via the component /templates/default/html/windows/right.php. id: CVE-2022-34121 info: name: CuppaCMS v1.0 - Local File Inclusion author: edoardottt severity: high description: | Cuppa CMS v1.0 is vulnerable to local file inclusion via the...

7.5CVSS7.3AI score0.03624EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•93 views

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/admin.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

7.2CVSS7.5AI score0.04475EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•82 views

kkFileView 4.1.0 - Cross-Site Scripting

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. id: CVE-2022-35151 info: name: kkFileView 4.1.0 - Cross-Site Scripting author: arafatansari severity: medium description: | kkFileView 4.1.0...

6.1CVSS5.8AI score0.01361EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•80 views

Cuppa CMS v1.0 - Cross Site Scripting

Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /tablemanager/view/cuusergroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function. id: CVE-2022-38295...

6.1CVSS6.1AI score0.01134EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•230 views

Cuppa CMS v1.0 - Arbitrary File Upload

Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. id: CVE-2022-38296 info: name: Cuppa CMS v1.0 - Arbitrary File Upload author: theamanrawat severity: critical description: | Cuppa CMS v1.0 was discovered to contain an arbitrary file upload...

9.8CVSS9AI score0.04053EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•65 views

Sophos Mobile managed on-premises - XML External Entity Injection

An XML External Entity XXE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. id: CVE-2022-3980 info: name: Sophos Mobile managed on-premises - XML External Entity Injection author: dabla...

9.8CVSS9.2AI score0.08087EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•45 views

Flatpress < v1.2.1 - Cross Site Scripting

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the page parameter at /flatpress/admin.php. id: CVE-2022-40047 info: name: Flatpress v1.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | Flatpress v1.2.1 was discovered to...

5.4CVSS5.2AI score0.01189EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•52 views

WP User <= 7.0 - Unauthenticated SQLi

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. id: CVE-2022-4049 info: name: WP User = 7.0 - Unauthenticated SQLi author: theamanrawat severity: critica...

9.8CVSS9.1AI score0.04756EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•79 views

Cryptocurrency Widgets Pack < 2.0 - SQL Injection

The plugin does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. id: CVE-2022-4059 info: name: Cryptocurrency Widgets Pack 2.0 - SQL Injection author: r3Y3r53 severity: critical description...

9.8CVSS9.1AI score0.04795EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•79 views

SolarView 6.00 - Remote Command Execution

SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. id: CVE-2022-40881 info: name: SolarView 6.00 - Remote Command Execution author: For3stCo1d severity: critical description: | SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. impact: |...

9.8CVSS8.7AI score0.29451EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•30 views

MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal

MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 = Maintenance Pack 36 with Servicepack 8 week 36/2025 contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows ...

7.5CVSS8.9AI score0.03572EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•49 views

CandidATS 3.0.0 - Cross-Site Scripting.

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the indexFile parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6.1AI score0.01129EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•60 views

CandidATS 3.0.0 - Cross-Site Scripting.

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortDirection parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.1AI score0.01082EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•82 views

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the callback component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch othe...

6.1CVSS6AI score0.01425EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•75 views

Login as User or Customer < 3.3 - Privilege Escalation

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. id: CVE-2022-4305 info: name: Login as User or Customer 3.3 - Privilege Escalation author: r3Y3r53 severity: critical...

9.8CVSS8.8AI score0.38625EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•90 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...

5.4CVSS5.6AI score0.00883EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•59 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Users Alerts feature /index.php?module=usersalerts/usersalerts of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add". id:...

5.4CVSS5.6AI score0.00939EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•62 views

WordPress Events Calendar <1.4.5 - Cross-Site Scripting

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

6.1CVSS6.1AI score0.00891EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•79 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add Announcement function at /index.php?module=helppages/pages&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

5.4CVSS5.6AI score0.01037EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•39 views

Rukovoditel <= 3.2.1 - Cross-Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add Page function at /index.php?module=helppages/pages&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title fiel...

5.4CVSS5.6AI score0.01037EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/27 4:24 a.m.•119 views

WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery

WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

7.5CVSS8AI score0.37673EPSS
SaveExploits0References4
Total number of security vulnerabilities4312