Lucene search
+L
NucleiRecent

4305 matches found

Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•76 views

WordPress BackupBuddy <8.8.3 - Cross Site Scripting

WordPress BackupBuddy plugin before 8.8.3 contains a cross-site vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in various locations. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected...

6.1CVSS7.1AI score0.00858EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•39 views

RestroPress 3.0.0-3.2.1 - Authentication Bypass

RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including...

9.8CVSS8.7AI score0.02196EPSS
SaveExploits6References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•54 views

DotCMS - Arbitrary File Upload

DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. id: CVE-2022-26352 info: name: DotCMS - Arbitrary File Upload author: h1ei1 severity: critical description: DotCM...

9.8CVSS8.7AI score0.91553EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•75 views

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

9.8CVSS9.1AI score0.97193EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•66 views

WordPress Country Selector <1.6.6 - Cross-Site Scripting

WordPress Country Selector plugin prior to 1.6.6 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the country and lang parameters before outputting them back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in th...

6.1CVSS6AI score0.01436EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•34 views

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

5.3CVSS5.5AI score0.10365EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•20 views

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

5.3CVSS5.3AI score0.00851EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•42 views

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

9.8CVSS8.7AI score0.83543EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•66 views

Atmail 6.5.0 - Cross-Site Scripting

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. id: CVE-2022-30776 info: name: Atmail 6.5.0 - Cross-Site Scripting author: 3th1cyuk1 severity: medium description: | Atmail 6.5.0 contains a cross-site scripting vulnerability via the...

6.1CVSS5.7AI score0.04291EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•94 views

Linear eMerge E3-Series - Information Disclosure

Linear eMerge E3-Series devices are susceptible to information disclosure. Admin credentials are stored in clear text at the endpoint /test.txt in situations where the default admin credentials have been changed. An attacker can obtain admin credentials, access the admin dashboard, control buildi...

8.2CVSS8.7AI score0.06987EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•103 views

Car Rental Management System 1.0 - SQL Injection

Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/managebooking.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-32026...

7.2CVSS7.4AI score0.05308EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•33 views

WWBN AVideo 11.6 - Cross-Site Scripting

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'success' parameter, which is inserted into the document with insufficient sanitization. id: CVE-2022-32771 info: name: WWBN AVideo 11.6 - Cross-Site Scripting author: arafatansari severity:...

9.6CVSS7.4AI score0.04226EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•131 views

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

8.8CVSS8.6AI score0.93076EPSS
SaveExploits12References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•53 views

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

7.5CVSS7.6AI score0.20351EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•29 views

WAVLINK WN530HG4 - Improper Access Control

Wavlink WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can download log files and configuration data via Exportlogs.sh and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-34049 info: name: WAVLINK WN530H...

5.3CVSS5.8AI score0.0264EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•89 views

Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting XSS vulnerability via accesstoken.php. id: CVE-2022-34093 info: name: Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Portal do...

6.1CVSS5.7AI score0.02804EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•1046 views

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

6.1CVSS5.7AI score0.04458EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•67 views

Hytec Inter HWL-2511-SS - Remote Command Execution

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. id: CVE-2022-36553 info: name: Hytec Inter HWL-2511-SS - Remote Command Execution author: HuTa0 severity: critical description: | Hytec Inter HWL-2511-SS...

9.8CVSS8.7AI score0.90902EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•23 views

KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \\sms,...

9.8CVSS8.7AI score0.54072EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•63 views

Academy Learning Management System <5.9.1 - Cross-Site Scripting

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6AI score0.02406EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•74 views

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...

9.3CVSS8.3AI score0.99652EPSS
SaveExploits11References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•18 views

Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access. id: CVE-2019-11886 info: name: Yellow Pencil Visual Theme Customizer 7.2.1 - Privilege...

8.8CVSS8.1AI score0.0189EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•19 views

Citrix StoreFront Server - XML External Entity

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. id: CVE-2019-13608 info: name: Citrix StoreFront Server - XML External Entity author: daffainfo severity: high description: | Citrix StoreFront Server before 1903, 7.15 LTSR...

7.5CVSS7.3AI score0.30041EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•20 views

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...

6.5CVSS6.3AI score0.01153EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•89 views

Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admininit function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the...

9.8CVSS8.9AI score0.04498EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•43 views

FortiOS - Insecure LDAP Configuration Detection

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions. id: CVE-2019-5591 info: name: FortiOS -...

6.5CVSS7.3AI score0.18422EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•33 views

QNAP Photo Station < 6.0.3 - Remote Code Execution

QNAP Photo Station versions prior to 6.0.3 contain multiple vulnerabilities that, when chained together, enable unauthenticated remote code execution RCE. id: CVE-2019-7194 info: name: QNAP Photo Station 6.0.3 - Remote Code Execution author: x-stp severity: critical description: | QNAP Photo...

9.8CVSS9.4AI score0.83124EPSS
SaveExploits8References1
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•105 views

ThemeREX Addons - Remote Code Execution

ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trxaddons/v2/get/sclayout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trxaddonsrestgetsclayout with an unsafe sc parameter, letting...

9.8CVSS9.1AI score0.08877EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

9.8CVSS9.8AI score0.19083EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•51 views

ProfilePress < 3.1.11 - Cross-Site Scripting

The ProfilePress plugin for WordPress before 3.1.11 is vulnerable to unauthenticated reflected cross-site scripting XSS via the tabbed login/register widget due to improper escaping of user input. Attackers can inject arbitrary JavaScript via the tabbed-login-name parameter. id: CVE-2021-24522...

6.1CVSS6AI score0.01552EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•63 views

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

6.1CVSS5.8AI score0.01582EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•94 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS4.7AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•17 views

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

Qubely WordPress plugin 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubelysendformdata AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication. id: CVE-2021-24916 info: name:...

7.5CVSS7.8AI score0.01729EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•55 views

QNAP HBS 3 - Broken Access Control

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...

10CVSS8.9AI score0.7825EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•37 views

Laminas Project laminas-http - Remote Code Execution

Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...

9.8CVSS9.4AI score0.75313EPSS
SaveExploits3References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•123 views

IPeakCMS 3.5 - SQL Injection

ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication. id: CVE-2021-3018 info: name: IPeakCMS 3.5 - SQL Injection author:...

9.8CVSS9.4AI score0.19506EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

9.1CVSS8.7AI score0.90418EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•17 views

KevinLAB BEMS 1.0 - SQL Injection

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through inputid POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and...

9.8CVSS9.1AI score0.08146EPSS
SaveExploits2References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•42 views

Zoho ManageEngine ServiceDesk Plus - Authentication Bypass

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...

9.8CVSS8.7AI score0.99825EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•16 views

Gnuboard 5 - Cross-Site Scripting

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. id: CVE-2021-3831 info: name: Gnuboard 5 - Cross-Site Scripting author: arafatansari severity: medium description: | Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter...

7.1CVSS6.2AI score0.01812EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•62 views

D-Link DIR-605 - Information Disclosure

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page id: CVE-2021-40655 info: name: D-Link DIR-605 - Information Disclosure author: DhiyaneshDK severity: high...

7.5CVSS7.9AI score0.86659EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•20 views

Oliver 5 Library Server <8.00.008.053 - Local File Inclusion

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. id: CVE-2021-45027 info: name: Oliver 5 Library Server 8.00.008.053 - Local File Inclusion author: gy741 severity: high description: Oliver 5 Library Server versions prior t...

7.5CVSS7.4AI score0.01736EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•88 views

osTicket 1.15.x - SQL Injection

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topicid" URL parameters combination. id: CVE-2021-45811 info: name: osTicket 1.15.x - SQL Injection author:...

6.5CVSS7AI score0.02454EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•67 views

Pascom CPS - Local File Inclusion

Pascom packaged with Cloud Phone System CPS versions before 7.20 contain a known local file inclusion vulnerability. id: CVE-2021-45968 info: name: Pascom CPS - Local File Inclusion author: dwisiswant0 severity: high description: | Pascom packaged with Cloud Phone System CPS versions before 7.20...

7.5CVSS7.4AI score0.10385EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•90 views

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

7.5CVSS7.4AI score0.04305EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•116 views

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting

ZyXEL ZyWALL 2 Plus Internet Security Appliance contains a cross-site scripting vulnerability. Insecure URI handling leads to bypass of security restrictions, which allows an attacker to execute arbitrary JavaScript codes to perform multiple attacks. id: CVE-2021-46387 info: name: Zyxel ZyWALL 2...

6.1CVSS6.1AI score0.21028EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•56 views

WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting

WordPress All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs plugin before 2.0.4 contains a reflected cross-site scripting vulnerability on the my-sticky-elements-leads admin page. id: CVE-2022-0148 info: name: WordPress All-in-one Floating Contact Form 2.0.4 - Cross-Site...

5.4CVSS5.2AI score0.01572EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•116 views

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

9.8CVSS9.1AI score0.74615EPSS
SaveExploits4References4
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•39 views

Microweber Cross-Site Scripting

Microweber contains a reflected cross-site scripting in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0378 info: name: Microweber Cross-Site Scripting author: pikpikcu severity: medium description: Microweber contains a reflected cross-site scripting in Packagist...

7.1CVSS5.7AI score0.03866EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•78 views

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. id: CVE-2022-0422 info: name: WordPress White Label CMS 2.2.9 -...

6.1CVSS5.7AI score0.0812EPSS
SaveExploits2References5
Total number of security vulnerabilities4305