Lucene search
+L
NvdMost viewed

398488 matches found

NVD
NVD
•added 2024/07/09 9:15 p.m.•90 views

CVE-2024-37865

An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compatible storage component...

5.9CVSS0.00651EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/25 4:15 a.m.•90 views

CVE-2024-6297

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator...

10CVSS0.01011EPSS
SaveExploits0References10
NVD
NVD
•added 2024/03/17 5:15 p.m.•90 views

CVE-2024-25903

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a through 22.7...

7.5CVSS5.2AI score0.00453EPSS
SaveExploits0References1
NVD
NVD
•added 2024/03/01 6:15 p.m.•90 views

CVE-2024-27298

parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20...

10CVSS9.8AI score0.0103EPSS
SaveExploits0References5
NVD
NVD
•added 2023/07/05 1:15 p.m.•90 views

CVE-2023-3089

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated...

7.5CVSS8.3AI score0.0052EPSS
SaveExploits0References2
NVD
NVD
•added 2023/06/13 4:15 p.m.•90 views

CVE-2023-33695

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile function at /core/io/FileUtil.java...

7.1CVSS6.8AI score0.00244EPSS
SaveExploits1References1
NVD
NVD
•added 2023/04/27 5:15 a.m.•90 views

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

5.9CVSS5.7AI score0.01048EPSS
SaveExploits2References5
NVD
NVD
•added 2023/02/14 8:15 p.m.•90 views

CVE-2023-22629

An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem...

8.8CVSS8.6AI score0.12322EPSS
SaveExploits4References4
NVD
NVD
•added 2021/12/08 10:15 p.m.•90 views

CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

7.8CVSS0.00208EPSS
SaveExploits0References1
NVD
NVD
•added 2026/07/27 8:16 p.m.•89 views

CVE-2026-66014

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level...

8.8CVSS0.0064EPSS
SaveExploits0References2
NVD
NVD
•added 2026/05/28 9:16 p.m.•89 views

CVE-2026-46818

Vulnerability in the Oracle Payments product of Oracle E-Business Suite component: File Transmission. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Payments. Successful...

7.4CVSS0.0034EPSS
SaveExploits0References1
NVD
NVD
•added 2026/05/28 6:16 a.m.•89 views

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

7CVSS0.00236EPSS
SaveExploits0References5
NVD
NVD
•added 2026/04/24 6:16 p.m.•89 views

CVE-2026-42040

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode function in lib/helpers/AxiosURLSearchParams.js contains a character mapping charMap at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent'\x00' correctly...

3.7CVSS0.00264EPSS
SaveExploits1References1
NVD
NVD
•added 2025/08/15 6:15 p.m.•89 views

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

2.6CVSS0.00243EPSS
SaveExploits0References2
NVD
NVD
•added 2025/04/13 6:15 a.m.•89 views

CVE-2025-3531

A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The explo...

6.1CVSS0.00461EPSS
SaveExploits1References5
NVD
NVD
•added 2024/10/21 7:15 p.m.•89 views

CVE-2024-50014

In the Linux kernel, the following vulnerability has been resolved: ext4: fix access to uninitialised lock in fc replay path The following kernel trace can be triggered with fstest generic/629 when executed against a filesystem with fast-commit feature enabled: INFO: trying to register non-static...

5.5CVSS0.00224EPSS
SaveExploits0References6
NVD
NVD
•added 2024/09/27 7:15 a.m.•89 views

CVE-2024-9029

A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the readiptcprofile function in the Source/Metadata/IPTC.cpp file because the size of the profile is not being sanitized, causing a crash in the application linked to the library,...

7.5CVSS0.00514EPSS
SaveExploits1References2
NVD
NVD
•added 2024/07/17 8:15 a.m.•89 views

CVE-2024-6220

The 简数采集器 Keydatas plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatasdownloadImages function in all versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

9.8CVSS0.35463EPSS
SaveExploits0References3
NVD
NVD
•added 2024/05/17 12:15 p.m.•89 views

CVE-2024-5043

A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be...

8.8CVSS4.7AI score0.00624EPSS
SaveExploits1References4
NVD
NVD
•added 2023/07/17 9:15 p.m.•89 views

CVE-2023-37266

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

9.8CVSS0.06844EPSS
SaveExploits1References3
NVD
NVD
•added 2023/07/16 1:15 a.m.•89 views

CVE-2023-3692

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10...

7.2CVSS0.01008EPSS
SaveExploits1References2
NVD
NVD
•added 2023/07/10 4:15 p.m.•89 views

CVE-2023-3219

The EventON WordPress plugin before 2.1.2 does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the...

5.3CVSS5.3AI score0.07521EPSS
SaveExploits5References2
NVD
NVD
•added 2023/02/13 5:15 p.m.•89 views

CVE-2023-24804

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal...

5CVSS5.1AI score0.00524EPSS
SaveExploits1References3
NVD
NVD
•added 2022/05/11 6:15 p.m.•89 views

CVE-2022-30059

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Delete vulnerability via the neirong parameter at \backend\controllers\DbController.php...

6.5CVSS0.01154EPSS
SaveExploits1References1
NVD
NVD
•added 2022/01/13 10:15 p.m.•89 views

CVE-2021-34978

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.781.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. A crafted SOAP request can trigg...

8.8CVSS0.0152EPSS
SaveExploits0References2
NVD
NVD
•added 2021/07/26 7:15 a.m.•89 views

CVE-2021-33900

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism DIGEST-MD5, GSSAPI was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue...

7.5CVSS0.00793EPSS
SaveExploits0References1
NVD
NVD
•added 2020/09/01 5:15 p.m.•89 views

CVE-2020-23839

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

6.1CVSS6AI score0.10459EPSS
SaveExploits5References4
NVD
NVD
•added 2020/03/12 2:15 p.m.•89 views

CVE-2020-10390

OS Command Injection in export.php vulnerable function called from include/functions-article.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php...

7.2CVSS7.4AI score0.04326EPSS
SaveExploits1References2
NVD
NVD
•added 2019/08/26 5:15 p.m.•89 views

CVE-2019-15558

XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java...

9.8CVSS9.7AI score0.01421EPSS
SaveExploits0References1
NVD
NVD
•added 2026/07/22 2:17 p.m.•88 views

CVE-2026-62144

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

9.1CVSS0.01006EPSS
SaveExploits0References1
NVD
NVD
•added 2026/05/14 3:16 p.m.•88 views

CVE-2026-44484

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism...

9.8CVSS0.00671EPSS
SaveExploits0References4
NVD
NVD
•added 2025/10/22 8:15 p.m.•88 views

CVE-2025-62611

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL...

8.2CVSS0.00391EPSS
SaveExploits0References3
NVD
NVD
•added 2025/07/14 9:15 p.m.•88 views

CVE-2025-53818

GitHub Kanban MCP Server is a Model Context Protocol MCP server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Serv...

9.3CVSS0.01421EPSS
SaveExploits0References4
NVD
NVD
•added 2024/07/01 3:15 p.m.•88 views

CVE-2024-21457

INformation disclosure while handling Multi-link IE in beacon frame...

7.5CVSS0.00213EPSS
SaveExploits0References1
NVD
NVD
•added 2023/08/04 5:15 p.m.•88 views

CVE-2023-38689

Logistics Pipes is a modification a.k.a. mod for the computer game Minecraft Java Edition. The mod used Java's ObjectInputStreamreadObject on untrusted data coming from clients or servers over the network resulting in possible remote code execution when sending specifically crafted network packet...

9.8CVSS8.8AI score0.01456EPSS
SaveExploits0References3
NVD
NVD
•added 2023/03/28 8:15 p.m.•88 views

CVE-2023-28395

Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This may allow an attacker to hijack a session by predicting the session id and gain unauthorized access to the product...

8.3CVSS8.4AI score0.00649EPSS
SaveExploits1References1
NVD
NVD
•added 2022/07/20 5:15 p.m.•88 views

CVE-2022-33317

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric...

7.8CVSS0.00319EPSS
SaveExploits0References3
NVD
NVD
•added 2021/11/17 6:15 p.m.•88 views

CVE-2021-42362

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain...

8.8CVSS0.79823EPSS
SaveExploits5References6
NVD
NVD
•added 2021/11/08 5:15 a.m.•88 views

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

6.1CVSS0.00893EPSS
SaveExploits3References2
NVD
NVD
•added 2021/03/15 5:15 p.m.•88 views

CVE-2021-25667

A vulnerability has been identified in RUGGEDCOM RM1224 All versions = V4.3 and = V4.3 and = V4.3 and = V2.0 and V2.1.3, SCALANCE XB-200 All versions V4.1, SCALANCE XC-200 All versions V4.1, SCALANCE XF-200BA All versions V4.1, SCALANCE XM400 All versions V6.2, SCALANCE XP-200 All versions V4.1,...

8.8CVSS0.00859EPSS
SaveExploits0References2
NVD
NVD
•added 2020/06/29 5:15 p.m.•88 views

CVE-2020-14413

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...

6.1CVSS0.03442EPSS
SaveExploits0References1
NVD
NVD
•added 2020/03/14 2:15 p.m.•88 views

CVE-2020-10567

An issue was discovered in Responsive Filemanager through 9.14.0. In the ajaxcalls.php file in the saveimg action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF...

9.8CVSS9.6AI score0.1964EPSS
SaveExploits5References2
NVD
NVD
•added 2019/12/17 8:15 p.m.•88 views

CVE-2019-19241

In the Linux kernel before 5.4.2, the iouring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/iouring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to...

7.8CVSS7.3AI score0.01087EPSS
SaveExploits3References6
NVD
NVD
•added 2019/10/04 6:15 p.m.•88 views

CVE-2019-13318

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

5.5CVSS5.5AI score0.05834EPSS
SaveExploits0References2
NVD
NVD
•added 2017/03/17 12:59 a.m.•88 views

CVE-2017-0144

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka...

9.3CVSS8.5AI score0.9923EPSS
SaveExploits68References13
NVD
NVD
•added 2026/08/07 5:17 p.m.•87 views

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

7.5CVSS0.00445EPSS
SaveExploits0References1
NVD
NVD
•added 2026/06/19 5:16 p.m.•87 views

CVE-2026-3195

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the virtiosndpcmincb function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730...

7.4CVSS0.00171EPSS
SaveExploits0References3
NVD
NVD
•added 2026/05/18 8:16 p.m.•87 views

CVE-2026-47092

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version...

7.8CVSS0.00892EPSS
SaveExploits0References4
NVD
NVD
•added 2026/05/18 3:16 p.m.•87 views

CVE-2026-26462

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrar...

7.3CVSS0.00527EPSS
SaveExploits0References2
NVD
NVD
•added 2026/05/07 10:16 p.m.•87 views

CVE-2026-33844

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network...

9CVSS0.00806EPSS
SaveExploits0References1
Total number of security vulnerabilities5000