Lucene search
+L
NucleiRecent

4305 matches found

Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•177 views

SAP NetWeaver Application Server Java 7.5 - Local File Inclusion

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...

7.5CVSS9AI score0.95111EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•57 views

NETGEAR WNAP320 Access Point Firmware - Remote Command Injection

NETGEAR WNAP320 Access Point Firmware version 2.0.3 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2016-1555 info: name: NETGEAR WNAP320 Access Point Firmware - Remote Command Injection author: gy741 severity: critical...

10CVSS8.8AI score0.98325EPSS
SaveExploits5References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•70 views

Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware Web Services versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic...

7.4CVSS8.6AI score0.96281EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•257 views

Microsoft SharePoint - Authentication Bypass

Microsoft SharePoint Server Elevation of Privilege Vulnerability id: CVE-2023-29357 info: name: Microsoft SharePoint - Authentication Bypass author: pdteam severity: critical description: | Microsoft SharePoint Server Elevation of Privilege Vulnerability impact: | Unauthenticated attackers can...

9.8CVSS9AI score0.99984EPSS
SaveExploits10References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•86 views

Adobe ColdFusion - Access Control Bypass

An attacker is able to access every CFM and CFC endpoint within the ColdFusion Administrator path /CFIDE/, of which there are 437 CFM files and 96 CFC files in a ColdFusion 2021 Update 6 install. id: CVE-2023-29298 info: name: Adobe ColdFusion - Access Control Bypass author:...

7.5CVSS8.2AI score0.99757EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•62 views

ManageEngine ADManager Plus - Command Injection

Zoho ManageEngine ADManager Plus through 7180 allows for authenticated users to exploit command injection via Proxy settings. id: CVE-2023-29084 info: name: ManageEngine ADManager Plus - Command Injection author: rootxharsh,iamnoooob,pdresearch severity: high description: | Zoho ManageEngine...

7.2CVSS7.2AI score0.98167EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•879 views

SPIP - Remote Command Execution

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. id: CVE-2023-27372 info: name: SPIP - Remote Command Execution author: DhiyaneshDK,nuts7 severity: critical description: ...

9.8CVSS8.8AI score0.99682EPSS
SaveExploits23References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•93 views

Joomla! Webservice - Password Disclosure

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. id: CVE-2023-23752 info: name: Joomla! Webservice - Password Disclosure author: badboycxcc,Sascha Brendel severity: medium description: | An issue was discovered in...

7.5CVSS6.5AI score0.99827EPSS
SaveExploits43References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•229 views

D-Link DNS-320 - Unauthenticated Remote Code Execution

D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a systemmgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters fntpserver, which in turn leads to arbitrary command execution. id: CVE-2020-25506 info: name:...

9.8CVSS7.8AI score0.99968EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•368 views

PhpMyAdmin <4.8.2 - Local File Inclusion

PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include view and potentially execute files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted...

8.8CVSS7.6AI score0.98411EPSS
SaveExploits22References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•61 views

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

5CVSS5.2AI score0.73028EPSS
SaveExploits12References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•75 views

Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion

Cisco Linksys WVC54GCA 1.00R22/1.00R24 is susceptible to local file inclusion in adm/file.cgi because it allows remote attackers to read arbitrary files via a %2e. encoded dot dot or an absolute pathname in the nextfile parameter. id: CVE-2009-1558 info: name: Cisco Linksys WVC54GCA 1.00R22/1.00R...

7.8CVSS5.6AI score0.29821EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•102 views

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...

7.7CVSS6.3AI score0.79855EPSS
SaveExploits4References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•70 views

Joomla! Core SQL Injection

A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. id: CVE-2015-7297 info: name: Joomla! Core SQL Injection author: princechaddha severity: high description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote...

7.5CVSS6.5AI score0.99967EPSS
SaveExploits8References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•72 views

PRTG Network Monitor <20.1.57.1745 - Information Disclosure

PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of t...

5.3CVSS5.8AI score0.52059EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•56 views

BOA Web Server 0.94.14 - Arbitrary File Access

BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials. id: CVE-2017-9833 info: name: BOA Web Server 0.94.14 - Arbitrary File Acces...

7.8CVSS7.8AI score0.68464EPSS
SaveExploits6References5
Nuclei
Nuclei
•added 2026/08/25 6:03 a.m.•125 views

Quiz Maker <= 6.5.8.3 - SQL Injection

The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'aysquestions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

9.8CVSS5.9AI score0.11755EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•32 views

Open Web Analytics 1.7.3 - Remote Code Execution

Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...

9.8CVSS8.7AI score0.99055EPSS
SaveExploits14References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•312 views

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

9.8CVSS7.9AI score0.99964EPSS
SaveExploits36References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•64 views

Microsoft SharePoint Server - Remote Code Execution (ToolShell)

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 authentication bypass, enables unauthenticated remote code...

9.8CVSS8.6AI score0.99982EPSS
SaveExploits42References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•86 views

VMware View Planner <4.6 SP1- Remote Code Execution

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability due to improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could...

9.8CVSS9.6AI score0.99005EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•189 views

ServiceNow UI Macros - Template Injection

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted...

9.8CVSS9AI score0.99976EPSS
SaveExploits9References4
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•139 views

NextGen Mirth Connect - Remote Code Execution

Mirth Connect, by NextGen HealthCare, is an open source data integration platform widely used by healthcare companies. Versions prior to 4.4.1 are vulnerable to an unauthenticated remote code execution vulnerability id: CVE-2023-37679 info: name: NextGen Mirth Connect - Remote Code Execution...

9.8CVSS9.7AI score0.99434EPSS
SaveExploits22References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•122 views

Adobe ColdFusion - Pre-Auth Remote Code Execution

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-29300 info:...

9.8CVSS9.1AI score0.99989EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•52 views

Ivanti vTM - Authentication Bypass

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. id: CVE-2024-7593 info: name: Ivanti vTM - Authentication Bypass author: gy741 severity: critical...

9.8CVSS9AI score0.9999EPSS
SaveExploits4References3
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•219 views

Oracle WebLogic Server - Remote Command Execution

Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See...

10CVSS9.4AI score0.99997EPSS
SaveExploits43References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•106 views

Spring Cloud - Remote Code Execution

Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and...

9.8CVSS8.3AI score0.99939EPSS
SaveExploits37References6
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•80 views

Oracle Weblogic Server - Remote Command Execution

Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. id: CVE-2020-14882 info: name: Oracle Weblogic Server - Remote Command Execution author: dwisiswant0 severity:...

10CVSS9.2AI score0.99997EPSS
SaveExploits41References6
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•52 views

Microsoft Open Management Infrastructure - Remote Code Execution

Microsoft Open Management Infrastructure is susceptible to remote code execution OMIGOD. id: CVE-2021-38647 info: name: Microsoft Open Management Infrastructure - Remote Code Execution author: daffainfo,xstp severity: critical description: Microsoft Open Management Infrastructure is susceptible t...

9.8CVSS8.1AI score0.99933EPSS
SaveExploits19References5
Nuclei
Nuclei
•added 2026/08/24 5:53 a.m.•108 views

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcardRecursive endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remot...

9.8CVSS9AI score0.99992EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•184 views

Microsoft Exchange Server SSRF Vulnerability

This vulnerability is part of an attack chain that could allow remote code execution on Microsoft Exchange Server. The initial attack requires the ability to make an untrusted connection to Exchange server port 443. Other portions of the chain can be triggered if an attacker already has access or...

9.8CVSS9.3AI score0.99996EPSS
SaveExploits69References5
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•449 views

Ingress-Nginx Controller - Remote Code Execution

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

9.8CVSS7.8AI score0.99525EPSS
SaveExploits20References5
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•154 views

Hikvision - Authentication Bypass

Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0...

9.8CVSS8.7AI score0.99998EPSS
SaveExploits13References5
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•115 views

Apache OFBiz Directory Traversal - Remote Code Execution

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13 id: CVE-2024-32113 info: name: Apache OFBiz Directory Traversal - Remote Code Execution author: DhiyaneshDK severity: high description: |...

9.8CVSS8.8AI score0.99442EPSS
SaveExploits8References6
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•175 views

Cisco IOS XE Web UI - Command Injection

A vulnerability in the web UI component of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to improper input validation in the web UI. An attacker could exploit...

10CVSS8.5AI score0.99571EPSS
SaveExploits27References2
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•109 views

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

10CVSS9.8AI score0.99999EPSS
SaveExploits8References5
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•88 views

Confluence - Remote Code Execution

Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability. id: CVE-2022-26134 info: name: Confluence - Remote Code Execution author: pdteam,jbertman severity: critical description: | Confluence Server and Data Center is susceptible to an...

9.8CVSS9.4AI score0.99999EPSS
SaveExploits77References5
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•132 views

Sonatype Nexus Repository Manager 3 - Remote Code Execution

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection id: CVE-2020-10199 info: name: Sonatype Nexus Repository Manager 3 - Remote Code Execution author: rootxharsh,iamnoooob,pdresearch severity: high description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection impact: |...

9CVSS8.1AI score0.99064EPSS
SaveExploits10References5
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•25 views

CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution

CWP Control Web Panel 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the ttotal parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username. id: CVE-2025-48703 info:...

9CVSS9.8AI score0.99655EPSS
SaveExploits3References2
Nuclei
Nuclei
•added 2026/08/21 7:35 p.m.•66 views

Atlassian Confluence - Privilege Escalation

Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence. id: CVE-2023-22515 info: name: Atlassian Confluence - Privilege Escalation author:...

10CVSS8.9AI score0.99156EPSS
SaveExploits40References5
Nuclei
Nuclei
•added 2026/08/20 4:29 a.m.•134 views

Apache Airflow <=1.10.10 - Remote Code Execution

Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending on the executor in us...

8.8CVSS8.8AI score0.99189EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/08/19 2:00 p.m.•215 views

PaperCut - Unauthenticated Remote Code Execution

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. ...

9.8CVSS9.4AI score0.99999EPSS
SaveExploits24References5
Nuclei
Nuclei
•added 2026/08/19 8:40 a.m.•6 views

MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE

MineAdmin versions before 3.2.0-alpha.2 contain a path traversal vulnerability in the app-store plugin service. The identifier parameter is concatenated into filesystem paths without sanitization. id: CVE-2026-55224 info: name: MineAdmin 3.2.0-alpha.2 - Plugin Path Traversal to RCE author: afanti...

5.2AI score
SaveExploits0References3
Nuclei
Nuclei
•added 2026/08/19 4:15 a.m.•276 views

Dahua IPC/VTH/VTO - Authentication Bypass

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...

10CVSS7.5AI score0.99556EPSS
SaveExploits9References2
Nuclei
Nuclei
•added 2026/08/18 2:59 a.m.•49 views

Citrix NetScaler Memory Disclosure - CitrixBleed 2

Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway id: CVE-2025-5777 info: name: Citrix NetScaler Memory Disclosure - CitrixBleed 2 author: watchtowr,DhiyaneshDk,darses severity: critical description: | Insufficient...

9.3CVSS8.6AI score0.99962EPSS
SaveExploits19References3
Nuclei
Nuclei
•added 2026/08/17 3:58 a.m.•90 views

Microsoft SQL Server Reporting Services - Remote Code Execution

Microsoft SQL Server Reporting Services is vulnerable to a remote code execution vulnerability because it incorrectly handles page requests. id: CVE-2020-0618 info: name: Microsoft SQL Server Reporting Services - Remote Code Execution author: joeldeleep severity: high description: Microsoft SQL...

9.8CVSS8.8AI score0.99022EPSS
SaveExploits14References5
Nuclei
Nuclei
•added 2026/08/17 3:58 a.m.•162 views

Ivanti EPM - Remote Code Execution

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. id: CVE-2024-29824 info: name: Ivanti EPM - Remote Code Execution author: DhiyaneshDK severity: critical description: | ...

9.6CVSS9.7AI score0.99951EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/08/16 7:27 p.m.•71 views

Apache Solr <=8.3.1 - Remote Code Execution

Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable,...

7.5CVSS8.9AI score0.98567EPSS
SaveExploits14References5
Nuclei
Nuclei
•added 2026/08/16 7:27 p.m.•81 views

Metabase < 0.46.6.1 - Remote Code Execution

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

9.8CVSS9.3AI score0.98677EPSS
SaveExploits37References6
Nuclei
Nuclei
•added 2026/08/16 7:27 p.m.•6 views

FileRise <= 3.3.0 - Unauthenticated File Read

FileRise = 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths. id: CVE-2026-25231 info: name: FileRise = 3.3....

7.5CVSS5.3AI score0.01471EPSS
SaveExploits1References2
Total number of security vulnerabilities4305