Lucene search
+L
NucleiRecent

4311 matches found

Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•75 views

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

9.8CVSS9.1AI score0.97193EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•92 views

Oracle WebLogic Server Local File Inclusion

An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can...

7.5CVSS6.7AI score0.92649EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•49 views

Joomla! Component com_abbrev - Local File Inclusion

A directory traversal vulnerability in the Abbreviations Manager comabbrev component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-0985 info: name: Joomla! Component comabbrev - Local Fi...

7.5CVSS5.7AI score0.13095EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•1925 views

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...

7.2CVSS8.1AI score0.95357EPSS
SaveExploits11References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•69 views

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

9CVSS8.2AI score0.82165EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•144 views

Emby < 4.5.0 - Server Server-Side Request Forgery

Emby Server before 4.5.0 allows server-side request forgery SSRF via the Items/RemoteSearch/Image ImageURL parameter. id: CVE-2020-26948 info: name: Emby 4.5.0 - Server Server-Side Request Forgery author: dwisiswant0 severity: critical description: | Emby Server before 4.5.0 allows server-side...

9.8CVSS8.7AI score0.87154EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•39 views

phpMyAdmin < 5.0.3 - SQL Injection

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input. id: CVE-2020-26935 info: name: phpMyAdmin 5.0.3 - SQL Injection author: 0xAko...

9.8CVSS8.8AI score0.67081EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•61 views

Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution

The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network access via HTTP to compromise Oracle WebLogic Server. id:...

9CVSS8.2AI score0.97929EPSS
SaveExploits8References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•39 views

twitter-server Cross-Site Scripting

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. id: CVE-2020-35774 info: name: twitter-server Cross-Site...

5.4CVSS5.2AI score0.85649EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•107 views

Spring Cloud Config - Local File Inclusion

Spring Cloud Config versions 2.2.x prior to 2.2.2, 2.1.x prior to 2.1.7, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. id: CVE-2020-5405 info: name: Spring...

6.5CVSS7.2AI score0.6876EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•73 views

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't...

7.5CVSS7.8AI score0.97822EPSS
SaveExploits11References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•53 views

LinuxKI Toolset <= 6.01 - Remote Command Execution

LinuxKI v6.0-1 and earlier are vulnerable to remote code execution. id: CVE-2020-7209 info: name: LinuxKI Toolset = 6.01 - Remote Command Execution author: dwisiswant0 severity: critical description: LinuxKI v6.0-1 and earlier are vulnerable to remote code execution. impact: | Successful...

9.8CVSS9.1AI score0.98751EPSS
SaveExploits10References6
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•101 views

Sophos UTM Preauth - Remote Code Execution

Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. id: CVE-2020-25223 info: name: Sophos UTM Preauth - Remote Code Execution author: gy741 severity: critical description: Sophos SG UTMA WebAdmin is susceptibl...

10CVSS9.6AI score0.96693EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•155 views

rConfig 3.9.4 - Cross-Site Scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php id: CVE-2020-12259 info: name: rConfig 3.9.4 - Cross-Site Scripting...

5.4CVSS6.7AI score0.96179EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•109 views

vBulletin 5.5.4 - 5.6.2- Remote Command Execution

vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. id: CVE-2020-17496 info: name: vBulletin 5.5.4 - 5.6.2- Remote Comman...

9.8CVSS9.4AI score0.8774EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•202 views

EyesOfNetwork 5.1-5.3 - SQL Injection/Remote Code Execution

EyesOfNetwork 5.1 to 5.3 contains SQL injection and remote code execution vulnerabilities. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. See also CVE-2020-8655,...

9.8CVSS9.3AI score0.91874EPSS
SaveExploits13References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•107 views

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

7.5CVSS7.5AI score0.90647EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•26 views

Squid Proxy - HTTP Authentication Credentials Disclosure

Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page e.g. ERRDNSFAIL. id: CVE-2025-62168 info: name: Squid Proxy - HTTP...

10CVSS8.6AI score0.62871EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•48 views

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...

7.5CVSS9.1AI score0.46373EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•1606 views

Pterodactyl Panel - Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. id: CVE-2025-49132 info: name: Pterodactyl Panel - Remote Code Execution...

10CVSS5.9AI score0.53389EPSS
SaveExploits30References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•55 views

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

8.8CVSS7.3AI score0.35534EPSS
SaveExploits7References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•74 views

vRealize Operations Manager API - Server-Side Request Forgery

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. id: CVE-2021-21975 info: name: vRealize Operation...

8.5CVSS7.9AI score0.7829EPSS
SaveExploits13References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•53 views

Joomla! <3.7.1 - SQL Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-8917 info: name: Joomla! 3.7.1 - SQL Injection...

9.8CVSS9.2AI score0.99826EPSS
SaveExploits21References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•177 views

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

9.8CVSS9.1AI score0.77729EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•66 views

Atlassian Jira Server-Side Template Injection

Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and...

9.8CVSS9.2AI score0.84621EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•65 views

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

9.8CVSS8.7AI score0.62903EPSS
SaveExploits9References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•111 views

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

7.5CVSS7.7AI score0.98616EPSS
SaveExploits7References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•77 views

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

9.5CVSS6.8AI score0.77584EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•43 views

WordPress Social Warfare <3.5.3 - Cross-Site Scripting

WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerability via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, affecting Social Warfare and Social Warfare Pro. id: CVE-2019-9978 info: name: WordPress Social Warfare 3.5.3 - Cross-Site Scripting...

6.1CVSS6.7AI score0.72946EPSS
SaveExploits20References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•32 views

Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...

8.8CVSS8.2AI score0.8581EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•43 views

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

9.8CVSS8.7AI score0.83543EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•208 views

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

8.6CVSS7.4AI score0.6674EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•123 views

Apache Airflow OS Command Injection

Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. id: CVE-2022-24288 info: name: Apache Airflow OS Command Injection...

8.8CVSS8.2AI score0.7788EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•104 views

UniFi OS Server - Command Injection

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. id: CVE-2026-34910 info: name: UniFi OS Server - Command Injection author: Kazgangap severity: critical description: | A malicious actor...

10CVSS8.6AI score0.87468EPSS
SaveExploits4References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•291 views

ACME mini_httpd <1.30 - Local File Inclusion

ACME minihttpd before 1.30 is vulnerable to local file inclusion. id: CVE-2018-18778 info: name: ACME minihttpd 1.30 - Local File Inclusion author: DhiyaneshDK,dogasantos severity: medium description: ACME minihttpd before 1.30 is vulnerable to local file inclusion. impact: | Successful...

6.5CVSS6.7AI score0.70791EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•64 views

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

7.2CVSS8AI score0.88158EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•250 views

MOVEit Transfer - Remote Code Execution

In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...

9.8CVSS9AI score0.99934EPSS
SaveExploits15References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•123 views

F5 BIG-IP - Unauthenticated RCE via AJP Smuggling

CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution RCE. The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass...

9.8CVSS9.9AI score0.96515EPSS
SaveExploits17References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•17 views

Langflow <= 1.0.12 - Remote Code Execution

Langflow 0.6.19 contains a remote code execution caused by accepting untrusted Python scripts in the /api/v1/customcomponent endpoint, letting remote attackers execute arbitrary code, exploit requires access to the endpoint and untrusted script input. id: CVE-2024-37014 info: name: Langflow =...

9.8CVSS9.7AI score0.60121EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•153 views

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...

4.3CVSS5.8AI score0.94494EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•294 views

Jboss Application Server - Remote Code Execution

Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing a...

9.8CVSS10AI score0.90713EPSS
SaveExploits14References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•96 views

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

9.4CVSS8.7AI score0.37639EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•77 views

Apache OFBiz 17.12.03 - Cross-Site Scripting

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. id: CVE-2020-9496 info: name: Apache OFBiz 17.12.03 - Cross-Site Scripting author: dwisiswant0 severity: medium description: Apache OFBiz 17.12.03 contains cross-site scripting a...

6.1CVSS6.2AI score0.98926EPSS
SaveExploits15References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•397 views

vBulletin <= 4.2.3 - SQL Injection

vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database. id: CVE-2016-6195 info: name:...

9.8CVSS9.2AI score0.68493EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•357 views

Apache Druid - Remote Code Execution

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. id: CVE-2021-25646 info: name: Apache Druid - Remote Cod...

9CVSS9AI score0.99001EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•80 views

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. id: CVE-2018-8006 info: name: Apache ActiveMQ =5.15.5 - Cross-Site...

6.1CVSS6.3AI score0.57227EPSS
SaveExploits0References10
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•214 views

Apache OFBiz < 17.12.07 - Arbitrary Code Execution

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack id: CVE-2021-29200 info: name: Apache OFBiz 17.12.07 - Arbitrary Code Execution author: your3cho severity: critical description: | Apache OFBiz has unsafe deserialization prior to...

9.8CVSS9.1AI score0.5537EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•1662 views

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

9.9CVSS9.5AI score0.99032EPSS
SaveExploits29References8
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

9.1CVSS8.7AI score0.90418EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•112 views

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

7.2CVSS7.5AI score0.90461EPSS
SaveExploits3References5
Total number of security vulnerabilities4311