{
"CVE-1999-0067": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "PHF CGI Phone Book - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-1999-0067.yaml"
},
"CVE-1999-0266": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "info2www CGI - Remote File Disclosure / Command Execution",
"severity": "critical",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-1999-0266.yaml"
},
"CVE-1999-0267": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-120",
"name": "NCSA HTTPd 1.3 - Buffer Overflow Detection",
"severity": "critical",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-1999-0267.yaml"
},
"CVE-1999-1083": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Jana Web Server 1.45 - Directory Traversal",
"severity": "high",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-1999-1083.yaml"
},
"CVE-1999-1177": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-434",
"name": "IRIX nph-publish CGI - Arbitrary File Write Detection",
"severity": "critical",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-1999-1177.yaml"
},
"CVE-2000-0114": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Microsoft FrontPage Extensions - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2000/CVE-2000-0114.yaml"
},
"CVE-2000-0760": {
"cvss": 6.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
"name": "Jakarta Tomcat 3.1 and 3.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2000/CVE-2000-0760.yaml"
},
"CVE-2001-0537": {
"cvss": 9.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cwe": "CWE-287",
"name": "Cisco IOS HTTP Configuration - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2001/CVE-2001-0537.yaml"
},
"CVE-2001-1473": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-310",
"name": "Deprecated SSHv1 Protocol Detection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2001/CVE-2001-1473.yaml"
},
"CVE-2002-1131": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-80",
"name": "SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2002/CVE-2002-1131.yaml"
},
"CVE-2004-0437": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
"name": "Titan FTP Server 3.01 - DoS via LIST Command Disconnection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-0437.yaml"
},
"CVE-2004-0519": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"name": "SquirrelMail 1.4.x - Folder Name Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2004/CVE-2004-0519.yaml"
},
"CVE-2004-0656": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
"name": "Pure-FTPd \u2264 1.0.18 - DoS via Connection Limit Exhaustion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-0656.yaml"
},
"CVE-2004-1602": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-203",
"name": "ProFTPD 1.2.x - Username Enumeration via Timing Attack",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-1602.yaml"
},
"CVE-2004-1641": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
"name": "Titan FTP \u2264 3.21 - Heap Overflow via Long Commands",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-1641.yaml"
},
"CVE-2004-1965": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"name": "Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2004/CVE-2004-1965.yaml"
},
"CVE-2004-2687": {
"cvss": 9.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cwe": "CWE-16",
"name": "Distccd v1 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-2687.yaml"
},
"CVE-2005-0850": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cwe": "CWE-20",
"name": "FileZilla Server < 0.9.6 - DoS via MS-DOS Device Names",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2005/CVE-2005-0850.yaml"
},
"CVE-2005-0851": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cwe": "CWE-835",
"name": "FileZilla Server < 0.9.6 - DoS via MODE Z Infinite Loop",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2005/CVE-2005-0851.yaml"
},
"CVE-2005-2428": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-200",
"name": "Lotus Domino R5 and R6 WebMail - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-2428.yaml"
},
"CVE-2005-3128": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-80",
"name": "SquirrelMail Address Add 1.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-3128.yaml"
},
"CVE-2005-3344": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"name": "Horde Groupware Unauthenticated Admin Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-3344.yaml"
},
"CVE-2005-3634": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
"name": "SAP Web Application Server 6.x/7.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-3634.yaml"
},
"CVE-2005-4385": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"name": "Cofax <=2.0RC3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-4385.yaml"
},
"CVE-2006-1681": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"name": "Cherokee HTTPD <=0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-1681.yaml"
},
"CVE-2006-2173": {
"cvss": 6.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:P",
"name": "FileZilla FTP Server 2.2.22 - Buffer Overflow",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2006/CVE-2006-2173.yaml"
},
"CVE-2006-2842": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Squirrelmail <=1.4.6 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-2842.yaml"
},
"CVE-2006-3392": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-3392.yaml"
},
"CVE-2006-6565": {
"cvss": 4.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P",
"cwe": "CWE-476",
"name": "FileZilla Server < 0.9.22 - DoS via Wildcard Commands",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2006/CVE-2006-6565.yaml"
},
"CVE-2007-0885": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"name": "Jira Rainbow.Zen - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-0885.yaml"
},
"CVE-2007-2449": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache Tomcat 4.x-7.x - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-2449.yaml"
},
"CVE-2007-3010": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-20",
"name": "Alcatel-Lucent OmniPCX - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-3010.yaml"
},
"CVE-2007-4504": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! RSfiles <=1.0.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-4504.yaml"
},
"CVE-2007-4556": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"name": "OpenSymphony XWork/Apache Struts2 - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-4556.yaml"
},
"CVE-2007-5728": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "phpPgAdmin <=4.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-5728.yaml"
},
"CVE-2008-0702": {
"cvss": 9.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cwe": "CWE-119",
"name": "Titan FTP Server 6.03 and 6.0.5.549 - Heap Overflow via Long Commands",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2008/CVE-2008-0702.yaml"
},
"CVE-2008-1059": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-94",
"name": "WordPress Sniplets 1.1.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1059.yaml"
},
"CVE-2008-1061": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Sniplets <=1.2.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1061.yaml"
},
"CVE-2008-1547": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-601",
"name": "Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1547.yaml"
},
"CVE-2008-2052": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Bitrix Site Manager 6.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-2052.yaml"
},
"CVE-2008-2398": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "AppServ Open Project <=2.5.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-2398.yaml"
},
"CVE-2008-2650": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "CMSimple 3.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-2650.yaml"
},
"CVE-2008-4668": {
"cvss": 9.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-4668.yaml"
},
"CVE-2008-4764": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! <=2.0.0 RC2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-4764.yaml"
},
"CVE-2008-5281": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-119",
"name": "Titan FTP Server 6.05 DELE Command - Heap Overflow",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2008/CVE-2008-5281.yaml"
},
"CVE-2008-5587": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "phpPgAdmin <=4.2.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-5587.yaml"
},
"CVE-2008-6080": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! ionFiles 4.4.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6080.yaml"
},
"CVE-2008-6172": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component RWCards 3.0.11 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6172.yaml"
},
"CVE-2008-6222": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! ProDesk 1.0/1.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6222.yaml"
},
"CVE-2008-6465": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6465.yaml"
},
"CVE-2008-6668": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "nweb2fax <=0.2.7 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6668.yaml"
},
"CVE-2008-6982": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Devalcms 1.4a - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6982.yaml"
},
"CVE-2008-7269": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P",
"cwe": "CWE-20",
"name": "UC Gateway Investment SiteEngine v5.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-7269.yaml"
},
"CVE-2009-0347": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P",
"cwe": "CWE-59",
"name": "Autonomy Ultraseek - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-0347.yaml"
},
"CVE-2009-0545": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-20",
"name": "ZeroShell <= 1.0beta11 Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-0545.yaml"
},
"CVE-2009-0884": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P",
"cwe": "CWE-120",
"name": "FileZilla Server < 0.9.31 - SSL/TLS Packet Overflow DoS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2009/CVE-2009-0884.yaml"
},
"CVE-2009-0932": {
"cvss": 6.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
"cwe": "CWE-22",
"name": "Horde/Horde Groupware - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-0932.yaml"
},
"CVE-2009-1151": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-94",
"name": "PhpMyAdmin Scripts - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1151.yaml"
},
"CVE-2009-1496": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Cmimarketplace 0.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1496.yaml"
},
"CVE-2009-1558": {
"cvss": 7.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
"cwe": "CWE-22",
"name": "Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1558.yaml"
},
"CVE-2009-1872": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Adobe Coldfusion <=8.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1872.yaml"
},
"CVE-2009-2015": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! MooFAQ 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-2015.yaml"
},
"CVE-2009-2100": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! JoomlaPraise Projectfork  2.0.10 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-2100.yaml"
},
"CVE-2009-3053": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Agora 3.0.0b - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-3053.yaml"
},
"CVE-2009-3318": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Roland Breedveld Album 1.14 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-3318.yaml"
},
"CVE-2009-4202": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-4202.yaml"
},
"CVE-2009-4223": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-94",
"name": "KR-Web <=1.1b2 - Remote File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-4223.yaml"
},
"CVE-2009-4679": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Portfolio Nexus - Remote File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-4679.yaml"
},
"CVE-2009-5020": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P",
"cwe": "CWE-20",
"name": "AWStats < 6.95 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-5020.yaml"
},
"CVE-2009-5114": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WebGlimpse 2.18.7 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-5114.yaml"
},
"CVE-2010-0157": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component com_biblestudy - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0157.yaml"
},
"CVE-2010-0219": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-255",
"name": "Apache Axis2 Default Login",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0219.yaml"
},
"CVE-2010-0467": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component CCNewsLetter - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0467.yaml"
},
"CVE-2010-0696": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Jw_allVideos - Arbitrary File Retrieval",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0696.yaml"
},
"CVE-2010-0759": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Plugin Core Design Scriptegrator - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0759.yaml"
},
"CVE-2010-0942": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_jvideodirect - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0942.yaml"
},
"CVE-2010-0943": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_jashowcase - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0943.yaml"
},
"CVE-2010-0944": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_jcollection - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0944.yaml"
},
"CVE-2010-0972": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0972.yaml"
},
"CVE-2010-0982": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_cartweberp - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0982.yaml"
},
"CVE-2010-0985": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component com_abbrev - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0985.yaml"
},
"CVE-2010-1056": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component com_rokdownloads - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1056.yaml"
},
"CVE-2010-1081": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1081.yaml"
},
"CVE-2010-1217": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1217.yaml"
},
"CVE-2010-1219": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component com_janews - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1219.yaml"
},
"CVE-2010-1302": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component DW Graph - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1302.yaml"
},
"CVE-2010-1304": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component User Status - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1304.yaml"
},
"CVE-2010-1305": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component JInventory 1.23.02 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1305.yaml"
},
"CVE-2010-1306": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Picasa 2.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1306.yaml"
},
"CVE-2010-1307": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Magic Updater - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1307.yaml"
},
"CVE-2010-1308": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component SVMap 1.1.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1308.yaml"
},
"CVE-2010-1312": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component News Portal 1.5.x - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1312.yaml"
},
"CVE-2010-1313": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1313.yaml"
},
"CVE-2010-1314": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Highslide 1.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1314.yaml"
},
"CVE-2010-1315": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component webERPcustomer - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1315.yaml"
},
"CVE-2010-1340": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_jresearch - 'Controller' Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1340.yaml"
},
"CVE-2010-1345": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Cookex Agency CKForms - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1345.yaml"
},
"CVE-2010-1352": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Juke Box 1.7 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1352.yaml"
},
"CVE-2010-1353": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component LoginBox - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1353.yaml"
},
"CVE-2010-1354": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component VJDEO 1.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1354.yaml"
},
"CVE-2010-1429": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-264",
"name": "Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1429.yaml"
},
"CVE-2010-1461": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Photo Battle 1.0.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1461.yaml"
},
"CVE-2010-1469": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component JProject Manager 1.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1469.yaml"
},
"CVE-2010-1470": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Web TV 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1470.yaml"
},
"CVE-2010-1471": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Address Book 1.5.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1471.yaml"
},
"CVE-2010-1472": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Horoscope 1.5.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1472.yaml"
},
"CVE-2010-1473": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Advertising 0.25 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1473.yaml"
},
"CVE-2010-1474": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Sweetykeeper 1.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1474.yaml"
},
"CVE-2010-1475": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1475.yaml"
},
"CVE-2010-1476": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1476.yaml"
},
"CVE-2010-1478": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Jfeedback 1.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1478.yaml"
},
"CVE-2010-1491": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component MMS Blog 2.3.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1491.yaml"
},
"CVE-2010-1494": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component AWDwall 1.5.4 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1494.yaml"
},
"CVE-2010-1495": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Matamko 1.01 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1495.yaml"
},
"CVE-2010-1531": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component redSHOP 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1531.yaml"
},
"CVE-2010-1532": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1532.yaml"
},
"CVE-2010-1533": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component TweetLA 1.0.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1533.yaml"
},
"CVE-2010-1534": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Shoutbox Pro - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1534.yaml"
},
"CVE-2010-1535": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1535.yaml"
},
"CVE-2010-1540": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_blog - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1540.yaml"
},
"CVE-2010-1586": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-20",
"name": "HP System Management Homepage (SMH) v2.x.x.x - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1586.yaml"
},
"CVE-2010-1601": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component JA Comment - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1601.yaml"
},
"CVE-2010-1602": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1602.yaml"
},
"CVE-2010-1603": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component ZiMBCore 0.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1603.yaml"
},
"CVE-2010-1607": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component WMI 1.5.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1607.yaml"
},
"CVE-2010-1653": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Graphics 1.0.6 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1653.yaml"
},
"CVE-2010-1657": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component SmartSite 1.0.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1657.yaml"
},
"CVE-2010-1658": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component NoticeBoard 1.3 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1658.yaml"
},
"CVE-2010-1659": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1659.yaml"
},
"CVE-2010-1714": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component Arcade Games 1.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1714.yaml"
},
"CVE-2010-1715": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Online Exam 1.5.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1715.yaml"
},
"CVE-2010-1717": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component iF surfALERT 1.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1717.yaml"
},
"CVE-2010-1718": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Archery Scores 1.0.6 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1718.yaml"
},
"CVE-2010-1719": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1719.yaml"
},
"CVE-2010-1722": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Online Market 2.x - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1722.yaml"
},
"CVE-2010-1723": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1723.yaml"
},
"CVE-2010-1858": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component SMEStorage - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1858.yaml"
},
"CVE-2010-1870": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
"cwe": "CWE-917",
"name": "ListSERV Maestro <= 9.0-8 RCE",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1870.yaml"
},
"CVE-2010-1871": {
"name": "JBoss Seam 2 Code Execution",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2010-1871-1820.yaml"
},
"CVE-2010-1873": {
"name": "Joomla! Component Jvehicles - Local File Inclusion",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2010-1873.yaml"
},
"CVE-2010-1875": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Property - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1875.yaml"
},
"CVE-2010-1878": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component OrgChart 1.0.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1878.yaml"
},
"CVE-2010-1952": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component BeeHeard 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1952.yaml"
},
"CVE-2010-1953": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1953.yaml"
},
"CVE-2010-1954": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1954.yaml"
},
"CVE-2010-1955": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1955.yaml"
},
"CVE-2010-1956": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1956.yaml"
},
"CVE-2010-1957": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Love Factory 1.3.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1957.yaml"
},
"CVE-2010-1977": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1977.yaml"
},
"CVE-2010-1979": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1979.yaml"
},
"CVE-2010-1980": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1980.yaml"
},
"CVE-2010-1981": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Fabrik 2.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1981.yaml"
},
"CVE-2010-1982": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component JA Voice 2.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1982.yaml"
},
"CVE-2010-1983": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component redTWITTER 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1983.yaml"
},
"CVE-2010-20103": {
"name": "ProFTPd-1.3.3c - Backdoor Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2010/CVE-2010-20103.yaml"
},
"CVE-2010-2018": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Lokomedia CMS - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2018.yaml"
},
"CVE-2010-2033": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Percha Categories Tree 0.6 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2033.yaml"
},
"CVE-2010-2034": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Percha Image Attach 1.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2034.yaml"
},
"CVE-2010-2035": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2035.yaml"
},
"CVE-2010-2036": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Percha Fields Attach 1.0 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2036.yaml"
},
"CVE-2010-2037": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2037.yaml"
},
"CVE-2010-2045": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2045.yaml"
},
"CVE-2010-2050": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component MS Comment 0.8.0b - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2050.yaml"
},
"CVE-2010-2122": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2122.yaml"
},
"CVE-2010-2128": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2128.yaml"
},
"CVE-2010-2259": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component com_bfsurvey - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2259.yaml"
},
"CVE-2010-2307": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2307.yaml"
},
"CVE-2010-2507": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2507.yaml"
},
"CVE-2010-2680": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component jesectionfinder - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2680.yaml"
},
"CVE-2010-2682": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2682.yaml"
},
"CVE-2010-2857": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Music Manager - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2857.yaml"
},
"CVE-2010-2861": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2861.yaml"
},
"CVE-2010-2918": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-94",
"name": "Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2918.yaml"
},
"CVE-2010-2920": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2920.yaml"
},
"CVE-2010-3203": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component PicSell 1.0 - Arbitrary File Retrieval",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-3203.yaml"
},
"CVE-2010-3426": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-3426.yaml"
},
"CVE-2010-3863": {
"name": "Apache Shiro => 1.1.0 - Authentication Bypass",
"severity": "unknown",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2010-3863.yaml"
},
"CVE-2010-3867": {
"cvss": 7.1,
"cvss_vector": "CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:C",
"cwe": "CWE-22",
"name": "ProFTPD < 1.3.3c - Directory Traversal via mod_site_misc",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2010/CVE-2010-3867.yaml"
},
"CVE-2010-4231": {
"cvss": 7.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
"cwe": "CWE-22",
"name": "Camtron CMNC-200 IP Camera - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4231.yaml"
},
"CVE-2010-4239": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Tiki Wiki CMS Groupware 5.2 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4239.yaml"
},
"CVE-2010-4282": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Pandora Fms < 3.1.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4282.yaml"
},
"CVE-2010-4617": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component JotLoader 2.2.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4617.yaml"
},
"CVE-2010-4719": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component JRadio - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4719.yaml"
},
"CVE-2010-4769": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Joomla! Component Jimtawl 1.0.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4769.yaml"
},
"CVE-2010-4977": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "Joomla! Component Canteen 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4977.yaml"
},
"CVE-2010-5028": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "Joomla! Component JE Job 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-5028.yaml"
},
"CVE-2010-5278": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "MODx manager - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-5278.yaml"
},
"CVE-2010-5286": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-22",
"name": "Joomla! Component Jstore - 'Controller' Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-5286.yaml"
},
"CVE-2011-0049": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Majordomo2 - SMTP/HTTP Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-0049.yaml"
},
"CVE-2011-0518": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "LotusCMS 3.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-0518.yaml"
},
"CVE-2011-0762": {
"cvss": 4.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P",
"cwe": "CWE-400",
"name": "vsftpd < 2.3.3 - DoS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-0762.yaml"
},
"CVE-2011-1669": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-1669.yaml"
},
"CVE-2011-2523": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "VSFTPD 2.3.4 - Backdoor Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-2523.yaml"
},
"CVE-2011-2744": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Chyrp 2.x - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-2744.yaml"
},
"CVE-2011-2780": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Chyrp 2.x - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-2780.yaml"
},
"CVE-2011-3171": {
"cvss": 3.6,
"cvss_vector": "CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:P/A:P",
"cwe": "CWE-22",
"name": "Pure-FTPd \u2264 1.0.22 - Directory Traversal",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-3171.yaml"
},
"CVE-2011-3315": {
"cvss": 7.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
"cwe": "CWE-22",
"name": "Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-3315.yaml"
},
"CVE-2011-3600": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Apache OFBiz - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-3600.yaml"
},
"CVE-2011-4336": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4336.yaml"
},
"CVE-2011-4618": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Advanced Text Widget < 2.0.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4618.yaml"
},
"CVE-2011-4624": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "GRAND FlAGallery 1.57 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4624.yaml"
},
"CVE-2011-4640": {
"cvss": 4.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WebTitan < 3.60 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4640.yaml"
},
"CVE-2011-4804": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Component com_kp - 'Controller' Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4804.yaml"
},
"CVE-2011-4926": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Adminimize 1.7.22 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4926.yaml"
},
"CVE-2011-4969": {
"name": "jQuery XSS vulnerability before 1.6.3",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2011-4969.yaml"
},
"CVE-2011-5106": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5106.yaml"
},
"CVE-2011-5107": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Alert Before Your Post <= 0.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5107.yaml"
},
"CVE-2011-5179": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Skysa App Bar 1.04 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5179.yaml"
},
"CVE-2011-5181": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5181.yaml"
},
"CVE-2011-5252": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-20",
"name": "Orchard 'ReturnUrl' Parameter URI - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5252.yaml"
},
"CVE-2011-5265": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Featurific For WordPress 1.6.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5265.yaml"
},
"CVE-2012-0392": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"name": "Apache Struts2 S2-008 RCE",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0392.yaml"
},
"CVE-2012-0394": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-94",
"name": "Apache Struts <2.3.1.1 - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0394.yaml"
},
"CVE-2012-0896": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0896.yaml"
},
"CVE-2012-0901": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "YouSayToo auto-publishing 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0901.yaml"
},
"CVE-2012-0981": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "phpShowtime 2.0 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0981.yaml"
},
"CVE-2012-0991": {
"cvss": 3.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "OpenEMR 4.1 - Local File Inclusion",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0991.yaml"
},
"CVE-2012-0996": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "11in1 CMS 1.2.1 - Local File Inclusion (LFI)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0996.yaml"
},
"CVE-2012-10018": {
"cvss": 8.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-10018.yaml"
},
"CVE-2012-1226": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1226.yaml"
},
"CVE-2012-1823": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-20",
"name": "PHP CGI v5.3.12/5.4.2 Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1823.yaml"
},
"CVE-2012-1835": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1835.yaml"
},
"CVE-2012-2122": {
"cvss": 5.1,
"cvss_vector": "CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:P/A:P",
"cwe": "CWE-287",
"name": "MySQL - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2012/CVE-2012-2122.yaml"
},
"CVE-2012-2371": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WP-FaceThumb 0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-2371.yaml"
},
"CVE-2012-3153": {
"cvss": 6.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
"name": "Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-3153.yaml"
},
"CVE-2012-4032": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-20",
"name": "WebsitePanel before v1.2.2.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4032.yaml"
},
"CVE-2012-4242": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4242.yaml"
},
"CVE-2012-4253": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "MySQLDumper 1.24.4 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4253.yaml"
},
"CVE-2012-4273": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4273.yaml"
},
"CVE-2012-4547": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4547.yaml"
},
"CVE-2012-4768": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4768.yaml"
},
"CVE-2012-4878": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "FlatnuX CMS - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4878.yaml"
},
"CVE-2012-4889": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4889.yaml"
},
"CVE-2012-4940": {
"cvss": 6.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
"cwe": "CWE-22",
"name": "Axigen Mail Server Filename Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4940.yaml"
},
"CVE-2012-4982": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-20",
"name": "Forescout CounterACT 6.3.4.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4982.yaml"
},
"CVE-2012-5321": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-20",
"name": "TikiWiki CMS Groupware v8.3 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-5321.yaml"
},
"CVE-2012-5913": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Integrator 1.32 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-5913.yaml"
},
"CVE-2012-6499": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-20",
"name": "WordPress Plugin Age Verification v0.4 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-6499.yaml"
},
"CVE-2013-1965": {
"cvss": 9.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cwe": "CWE-94",
"name": "Apache Struts2 S2-012 RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-1965.yaml"
},
"CVE-2013-2248": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-20",
"name": "Apache Struts - Multiple Open Redirection Vulnerabilities",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2248.yaml"
},
"CVE-2013-2251": {
"cvss": 9.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cwe": "CWE-20",
"name": "Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2251.yaml"
},
"CVE-2013-2287": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2287.yaml"
},
"CVE-2013-2621": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Telaen => v1.3.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2621.yaml"
},
"CVE-2013-3526": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-3526.yaml"
},
"CVE-2013-3827": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"name": "Javafaces LFI",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-3827.yaml"
},
"CVE-2013-4117": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-4117.yaml"
},
"CVE-2013-4625": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-4625.yaml"
},
"CVE-2013-4786": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-255",
"name": "IPMI 2.0 RAKP Authentication Remote Password Hash Disclosure",
"severity": "high",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-2013-4786.yaml"
},
"CVE-2013-4982": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-287",
"name": "AVTECH DVR - Login Verification Code Bypass",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-4982.yaml"
},
"CVE-2013-5528": {
"cvss": 4.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Cisco Unified Communications Manager 7/8/9 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-5528.yaml"
},
"CVE-2013-5979": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Xibo 1.2.2/1.4.1 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-5979.yaml"
},
"CVE-2013-6281": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Spreadsheet - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-6281.yaml"
},
"CVE-2013-7091": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7091.yaml"
},
"CVE-2013-7240": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7240.yaml"
},
"CVE-2013-7285": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "XStream <1.4.6/1.4.10 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7285.yaml"
},
"CVE-2014-0160": {
"name": "OpenSSL Heartbleed Vulnerability",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2014/CVE-2014-0160.yaml"
},
"CVE-2014-100004": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sitecore CMS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-100004.yaml"
},
"CVE-2014-10037": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "DomPHP 0.83 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-10037.yaml"
},
"CVE-2014-1203": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Eyou E-Mail <3.6 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-1203.yaml"
},
"CVE-2014-1841": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Titan FTP Server < 10.40 Move Function - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2014/CVE-2014-1841.yaml"
},
"CVE-2014-1842": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Titan FTP Server Search Function < 10.40 - User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2014/CVE-2014-1842.yaml"
},
"CVE-2014-1843": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Titan FTP Server < 10.40 - User Properties Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2014/CVE-2014-1843.yaml"
},
"CVE-2014-2321": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-264",
"name": "ZTE Cable Modem Web Shell",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2321.yaml"
},
"CVE-2014-2323": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Lighttpd 1.4.34 SQL Injection and Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2323.yaml"
},
"CVE-2014-2383": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-200",
"name": "Dompdf < v0.6.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2383.yaml"
},
"CVE-2014-2908": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2908.yaml"
},
"CVE-2014-2962": {
"cvss": 7.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
"cwe": "CWE-22",
"name": "Belkin N150 Router 1.00.08/1.00.09 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2962.yaml"
},
"CVE-2014-3120": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-284",
"name": "ElasticSearch v1.1.1/1.2 RCE",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3120.yaml"
},
"CVE-2014-3206": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Seagate BlackArmor NAS - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3206.yaml"
},
"CVE-2014-3704": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "Drupal SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3704.yaml"
},
"CVE-2014-3744": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Node.js st module Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3744.yaml"
},
"CVE-2014-4210": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"name": "Oracle Weblogic - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4210.yaml"
},
"CVE-2014-4513": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4513.yaml"
},
"CVE-2014-4535": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Import Legacy Media <= 0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4535.yaml"
},
"CVE-2014-4536": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4536.yaml"
},
"CVE-2014-4539": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Movies <= 0.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4539.yaml"
},
"CVE-2014-4544": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Podcast Channels < 0.28 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4544.yaml"
},
"CVE-2014-4550": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Shortcode Ninja <= 1.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4550.yaml"
},
"CVE-2014-4558": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4558.yaml"
},
"CVE-2014-4561": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4561.yaml"
},
"CVE-2014-4577": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WP AmASIN \u2013 The Amazon Affiliate Shop - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4577.yaml"
},
"CVE-2014-4592": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Planet <= 0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4592.yaml"
},
"CVE-2014-4940": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Plugin Tera Charts - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4940.yaml"
},
"CVE-2014-4941": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Cross RSS 1.7 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4941.yaml"
},
"CVE-2014-4942": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress EasyCart <2.0.6 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4942.yaml"
},
"CVE-2014-5111": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Fonality trixbox - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5111.yaml"
},
"CVE-2014-5181": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Last.fm Rotation 1.0 - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5181.yaml"
},
"CVE-2014-5187": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5187.yaml"
},
"CVE-2014-5258": {
"cvss": 4.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "webEdition 6.3.8.0 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5258.yaml"
},
"CVE-2014-5368": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Plugin WP Content Source Control - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5368.yaml"
},
"CVE-2014-6271": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "ShellShock - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6271.yaml"
},
"CVE-2014-6287": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "HTTP File Server <2.3c - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6287.yaml"
},
"CVE-2014-6308": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Osclass Security Advisory 3.4.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6308.yaml"
},
"CVE-2014-8676": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Simple Online Planning Tool <1.3.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8676.yaml"
},
"CVE-2014-8682": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "Gogs (Go Git Service) - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8682.yaml"
},
"CVE-2014-8739": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8739.yaml"
},
"CVE-2014-8799": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Plugin DukaPress 2.5.2 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8799.yaml"
},
"CVE-2014-9094": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress DZS-VideoGallery Plugin Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9094.yaml"
},
"CVE-2014-9119": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress DB Backup <=4.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9119.yaml"
},
"CVE-2014-9180": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
"cwe": "CWE-601",
"name": "Eleanor CMS - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9180.yaml"
},
"CVE-2014-9444": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Frontend Uploader <= 0.9.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9444.yaml"
},
"CVE-2014-9606": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Netsweeper 4.0.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9606.yaml"
},
"CVE-2014-9607": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Netsweeper 4.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9607.yaml"
},
"CVE-2014-9608": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Netsweeper 4.0.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9608.yaml"
},
"CVE-2014-9609": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Netsweeper 4.0.8 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9609.yaml"
},
"CVE-2014-9614": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Netsweeper 4.0.5 - Default Weak Account",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9614.yaml"
},
"CVE-2014-9615": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Netsweeper 4.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9615.yaml"
},
"CVE-2014-9617": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Netsweeper 3.0.6 - Open Redirection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9617.yaml"
},
"CVE-2014-9618": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Netsweeper - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9618.yaml"
},
"CVE-2014-9735": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-264",
"name": "WordPress RevSlider - Remote Code Execution via File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9735.yaml"
},
"CVE-2015-0554": {
"cvss": 9.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:C",
"cwe": "CWE-264",
"name": "ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-0554.yaml"
},
"CVE-2015-1000005": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Candidate Application Form <= 1.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1000005.yaml"
},
"CVE-2015-1000010": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "WordPress Simple Image Manipulator < 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1000010.yaml"
},
"CVE-2015-1000012": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress MyPixs <=0.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1000012.yaml"
},
"CVE-2015-10141": {
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-78",
"name": "Xdebug <= 2.5.5 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-10141.yaml"
},
"CVE-2015-1419": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
"name": "vsftpd <= 3.0.2 - Access Restriction Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-1419.yaml"
},
"CVE-2015-1427": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-284",
"name": "ElasticSearch - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1427.yaml"
},
"CVE-2015-1503": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "IceWarp Mail Server <11.1.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1503.yaml"
},
"CVE-2015-1579": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Slider Revolution - Local File Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1579.yaml"
},
"CVE-2015-1635": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-94",
"name": "Microsoft Windows 'HTTP.sys' - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1635.yaml"
},
"CVE-2015-1880": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Fortinet FortiOS <=5.2.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1880.yaml"
},
"CVE-2015-20067": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "WP Attachment Export < 0.2.4 - Unrestricted File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-20067.yaml"
},
"CVE-2015-2067": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Magento Server MAGMI - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2067.yaml"
},
"CVE-2015-2068": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Magento Server Mass Importer - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2068.yaml"
},
"CVE-2015-2080": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2080.yaml"
},
"CVE-2015-2166": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Ericsson Drutt MSDP - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2166.yaml"
},
"CVE-2015-2196": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "WordPress Spider Calendar <=1.4.9 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2196.yaml"
},
"CVE-2015-2208": {
"name": "CVE-2015-2208",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2015-2208.yaml"
},
"CVE-2015-2755": {
"cvss": 6.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cwe": "CWE-352",
"name": "WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2755.yaml"
},
"CVE-2015-2794": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-264",
"name": "DotNetNuke 07.04.00 - Administration Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2794.yaml"
},
"CVE-2015-2807": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Navis DocumentCloud <0.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2807.yaml"
},
"CVE-2015-2863": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-601",
"name": "Kaseya Virtual System Administrator - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2863.yaml"
},
"CVE-2015-2996": {
"cvss": 8.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:C",
"cwe": "CWE-22",
"name": "SysAid Help Desk <15.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2996.yaml"
},
"CVE-2015-3035": {
"cvss": 7.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
"cwe": "CWE-22",
"name": "TP-LINK - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3035.yaml"
},
"CVE-2015-3224": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-284",
"name": "Ruby on Rails Web Console - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3224.yaml"
},
"CVE-2015-3306": {
"cvss": 10.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
"cwe": "CWE-284",
"name": "ProFTPd - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-3306.yaml"
},
"CVE-2015-3337": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Elasticsearch - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3337.yaml"
},
"CVE-2015-3648": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-22",
"name": "ResourceSpace - Local File inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3648.yaml"
},
"CVE-2015-3897": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Bonita BPM Portal <6.5.3 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3897.yaml"
},
"CVE-2015-4050": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-284",
"name": "Symfony - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4050.yaml"
},
"CVE-2015-4062": {
"cvss": 6.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "WordPress NewStatPress 0.9.8 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4062.yaml"
},
"CVE-2015-4063": {
"cvss": 3.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:S/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "NewStatPress <0.9.9 - Cross-Site Scripting",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4063.yaml"
},
"CVE-2015-4074": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4074.yaml"
},
"CVE-2015-4127": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Church Admin <0.810 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4127.yaml"
},
"CVE-2015-4414": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4414.yaml"
},
"CVE-2015-4455": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4455.yaml"
},
"CVE-2015-4632": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Koha 3.20.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4632.yaml"
},
"CVE-2015-4666": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Xceedium Xsuite <=2.4.4.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4666.yaml"
},
"CVE-2015-4668": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Xsuite <=2.4.4.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4668.yaml"
},
"CVE-2015-4694": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4694.yaml"
},
"CVE-2015-5354": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cwe": "CWE-601",
"name": "Novius OS 5.0.1-elche - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5354.yaml"
},
"CVE-2015-5461": {
"cvss": 6.4,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
"name": "WordPress StageShow <5.0.9 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5461.yaml"
},
"CVE-2015-5469": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5469.yaml"
},
"CVE-2015-5471": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Swim Team <= v1.44.10777 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5471.yaml"
},
"CVE-2015-5531": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "ElasticSearch <1.6.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5531.yaml"
},
"CVE-2015-5688": {
"cvss": 5.0,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe": "CWE-22",
"name": "Geddy <13.0.8 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5688.yaml"
},
"CVE-2015-6477": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "Nordex NC2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-6477.yaml"
},
"CVE-2015-6544": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Combodo iTop <2.2.0-2459 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-6544.yaml"
},
"CVE-2015-6920": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-6920.yaml"
},
"CVE-2015-7245": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "D-Link DVG-N5402SP - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7245.yaml"
},
"CVE-2015-7297": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe": "CWE-89",
"name": "Joomla! Core SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7297.yaml"
},
"CVE-2015-7377": {
"cvss": 4.3,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cwe": "CWE-79",
"name": "WordPress Pie-Register <2.0.19 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7377.yaml"
},
"CVE-2015-7450": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "IBM WebSphere Java Object Deserialization - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7450.yaml"
},
"CVE-2015-7501": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Red Hat JBoss - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7501.yaml"
},
"CVE-2015-7780": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ManageEngine Firewall Analyzer <8.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7780.yaml"
},
"CVE-2015-7823": {
"cvss": 5.8,
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
"name": "Kentico CMS 8.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7823.yaml"
},
"CVE-2015-8349": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SourceBans <2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8349.yaml"
},
"CVE-2015-8350": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8350.yaml"
},
"CVE-2015-8399": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Atlassian Confluence <5.8.17 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8399.yaml"
},
"CVE-2015-8562": {
"cvss": 7.5,
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
"name": "Joomla HTTP Header Unauthenticated - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8562.yaml"
},
"CVE-2015-8813": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
"cwe": "CWE-918",
"name": "Umbraco <7.4.0- Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8813.yaml"
},
"CVE-2015-9312": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NewStatPress <=1.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9312.yaml"
},
"CVE-2015-9323": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9323.yaml"
},
"CVE-2015-9406": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "mTheme Unus < 2.3 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9406.yaml"
},
"CVE-2015-9414": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Symposium <=15.8.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9414.yaml"
},
"CVE-2015-9415": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-20",
"name": "BJ Lazy Load (Timthumb) <= 0.7.5 - Remote File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9415.yaml"
},
"CVE-2015-9480": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress RobotCPA 5 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9480.yaml"
},
"CVE-2015-9499": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9499.yaml"
},
"CVE-2016-0957": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Adobe AEM Dispatcher <4.15 - Rules Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-0957.yaml"
},
"CVE-2016-1000126": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Admin Font Editor <=1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000126.yaml"
},
"CVE-2016-1000127": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress AJAX Random Post <=2.00 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000127.yaml"
},
"CVE-2016-1000128": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress anti-plagiarism <=3.60 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000128.yaml"
},
"CVE-2016-1000129": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000129.yaml"
},
"CVE-2016-1000130": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress e-search <=1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000130.yaml"
},
"CVE-2016-1000131": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress e-search <=1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000131.yaml"
},
"CVE-2016-1000132": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000132.yaml"
},
"CVE-2016-1000133": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000133.yaml"
},
"CVE-2016-1000134": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000134.yaml"
},
"CVE-2016-1000135": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000135.yaml"
},
"CVE-2016-1000136": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress heat-trackr 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000136.yaml"
},
"CVE-2016-1000137": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000137.yaml"
},
"CVE-2016-1000138": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Admin Font Editor <=1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000138.yaml"
},
"CVE-2016-1000139": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000139.yaml"
},
"CVE-2016-1000140": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress New Year Firework <=1.1.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000140.yaml"
},
"CVE-2016-1000141": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Page Layout builder v1.9.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000141.yaml"
},
"CVE-2016-1000142": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000142.yaml"
},
"CVE-2016-1000143": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Photoxhibit 2.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000143.yaml"
},
"CVE-2016-1000146": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000146.yaml"
},
"CVE-2016-1000148": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress S3 Video <=0.983 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000148.yaml"
},
"CVE-2016-1000149": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000149.yaml"
},
"CVE-2016-1000152": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Tidio-form <=1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000152.yaml"
},
"CVE-2016-1000153": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Tidio Gallery <=1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000153.yaml"
},
"CVE-2016-1000154": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WHIZZ <=1.0.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000154.yaml"
},
"CVE-2016-1000155": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WPSOLR <=8.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000155.yaml"
},
"CVE-2016-10033": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-88",
"name": "WordPress PHPMailer < 5.2.18 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml"
},
"CVE-2016-10108": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Western Digital MyCloud NAS - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10108.yaml"
},
"CVE-2016-10134": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Zabbix - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10134.yaml"
},
"CVE-2016-10367": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Opsview Monitor Pro - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10367.yaml"
},
"CVE-2016-10368": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Opsview Monitor Pro - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10368.yaml"
},
"CVE-2016-10924": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Wordpress Zedna eBook download <1.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10924.yaml"
},
"CVE-2016-10940": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress zm-gallery plugin 1.0 SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10940.yaml"
},
"CVE-2016-10956": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-20",
"name": "WordPress Mail Masta 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10956.yaml"
},
"CVE-2016-10960": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "WordPress wSecure Lite < 2.4 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10960.yaml"
},
"CVE-2016-10973": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10973.yaml"
},
"CVE-2016-10976": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Safe Editor Plugin < 1.2 - CSS/JS-injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10976.yaml"
},
"CVE-2016-10993": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ScoreMe Theme - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10993.yaml"
},
"CVE-2016-15041": {
"name": "MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15041.yaml"
},
"CVE-2016-15042": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15042.yaml"
},
"CVE-2016-15043": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WP Mobile Detector <= 3.5 - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15043.yaml"
},
"CVE-2016-1555": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "NETGEAR WNAP320 Access Point Firmware - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1555.yaml"
},
"CVE-2016-2004": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "HP Data Protector - Arbitrary Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2016/CVE-2016-2004.yaml"
},
"CVE-2016-2389": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-2389.yaml"
},
"CVE-2016-3081": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Apache S2-032 Struts - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3081.yaml"
},
"CVE-2016-3088": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Apache ActiveMQ Fileserver - Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3088.yaml"
},
"CVE-2016-3510": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-119",
"name": "Oracle WebLogic Server Java Object Deserialization - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2016/CVE-2016-3510.yaml"
},
"CVE-2016-3978": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Fortinet FortiOS - Open Redirect/Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3978.yaml"
},
"CVE-2016-4437": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4437.yaml"
},
"CVE-2016-4975": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-93",
"name": "Apache mod_userdir CRLF injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4975.yaml"
},
"CVE-2016-4977": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-19",
"name": "Spring Security OAuth2 Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4977.yaml"
},
"CVE-2016-5649": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-5649.yaml"
},
"CVE-2016-5674": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "NUUO NVR camera `debugging_center_utils_.php` - Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-5674.yaml"
},
"CVE-2016-6195": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "vBulletin <= 4.2.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6195.yaml"
},
"CVE-2016-6210": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "OpenSSH username enumeration < v7.3",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2016-6210-2803.yaml"
},
"CVE-2016-6277": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "NETGEAR Routers - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6277.yaml"
},
"CVE-2016-6601": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6601.yaml"
},
"CVE-2016-7552": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-7552.yaml"
},
"CVE-2016-7834": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Sony IPELA Engine IP Camera - Hardcoded Account",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-7834.yaml"
},
"CVE-2016-7981": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SPIP <3.1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-7981.yaml"
},
"CVE-2016-8527": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Aruba Airwave <8.2.3.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-8527.yaml"
},
"CVE-2016-8706": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-190",
"name": "Memcached Server SASL Authentication - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2016/CVE-2016-8706.yaml"
},
"CVE-2016-8735": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Tomcat - Remote Code Execution via JMX Ports",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2016/CVE-2016-8735.yaml"
},
"CVE-2016-9299": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-90",
"name": "Jenkins CLI - HTTP Java Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2016/CVE-2016-9299.yaml"
},
"CVE-2017-0929": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-0929.yaml"
},
"CVE-2017-1000027": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Koozali Foundation SME Server - Open redirect",
"severity": "low",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2017-1000027.yaml"
},
"CVE-2017-1000028": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000028.yaml"
},
"CVE-2017-1000029": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000029.yaml"
},
"CVE-2017-1000163": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Phoenix Framework - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000163.yaml"
},
"CVE-2017-1000170": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000170.yaml"
},
"CVE-2017-1000353": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Jenkins CLI - Java Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2017/CVE-2017-1000353.yaml"
},
"CVE-2017-1000486": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-326",
"name": "Primetek Primefaces 5.x - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000486.yaml"
},
"CVE-2017-10075": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"name": "Oracle Content Server - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10075.yaml"
},
"CVE-2017-10271": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "Oracle WebLogic Server - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10271.yaml"
},
"CVE-2017-10974": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Yaws 1.91 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10974.yaml"
},
"CVE-2017-11107": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpLDAPadmin <= 1.2.3 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11107.yaml"
},
"CVE-2017-11165": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "DataTaker DT80 dEX 1.50.012 - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11165.yaml"
},
"CVE-2017-11317": {
"name": "Telerik UI for ASP.NET AJAX Inadequate Encryption Strength",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2017-11317.yaml"
},
"CVE-2017-11444": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Subrion CMS <4.1.5.10 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11444.yaml"
},
"CVE-2017-11512": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11512.yaml"
},
"CVE-2017-11586": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "FineCMS <5.0.9 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11586.yaml"
},
"CVE-2017-11610": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-276",
"name": "XML-RPC Server - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11610.yaml"
},
"CVE-2017-11629": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FineCMS <=5.0.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11629.yaml"
},
"CVE-2017-12138": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "XOOPS Core 2.5.8 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12138.yaml"
},
"CVE-2017-12149": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Jboss Application Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12149.yaml"
},
"CVE-2017-12542": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12542.yaml"
},
"CVE-2017-12544": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "HPE System Management - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12544.yaml"
},
"CVE-2017-12583": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DokuWiki - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12583.yaml"
},
"CVE-2017-12611": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Apache Struts2 S2-053 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12611.yaml"
},
"CVE-2017-12615": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Apache Tomcat Servers - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12615.yaml"
},
"CVE-2017-12617": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Apache Tomcat - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12617.yaml"
},
"CVE-2017-12629": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-611",
"name": "Apache Solr <= 7.1 - XML Entity Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12629.yaml"
},
"CVE-2017-12635": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12635.yaml"
},
"CVE-2017-12636": {
"name": "Couchdb Arbitrary Command Execution (CVE-2017-12636)",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2017-12636.yaml"
},
"CVE-2017-12637": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SAP NetWeaver Application Server Java 7.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12637.yaml"
},
"CVE-2017-12794": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Django Debug Page - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12794.yaml"
},
"CVE-2017-14135": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "OpenDreambox 2.0.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14135.yaml"
},
"CVE-2017-14186": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14186.yaml"
},
"CVE-2017-14524": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "OpenText Documentum Administrator 7.2.0180.0055 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14524.yaml"
},
"CVE-2017-14535": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Trixbox - 2.8.0.4 OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14535.yaml"
},
"CVE-2017-14537": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Trixbox 2.8.0 - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14537.yaml"
},
"CVE-2017-14622": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14622.yaml"
},
"CVE-2017-14651": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14651.yaml"
},
"CVE-2017-14725": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress < 4.8.2 - Authenticated Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14725.yaml"
},
"CVE-2017-14849": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Node.js <8.6.0 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14849.yaml"
},
"CVE-2017-14942": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-552",
"name": "Intelbras WRN 150 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14942.yaml"
},
"CVE-2017-15287": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Dreambox WebControl 2.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15287.yaml"
},
"CVE-2017-15363": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15363.yaml"
},
"CVE-2017-15647": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "FiberHome Routers - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15647.yaml"
},
"CVE-2017-15715": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Apache httpd <=2.4.29 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15715.yaml"
},
"CVE-2017-15944": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Palo Alto Network PAN-OS - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15944.yaml"
},
"CVE-2017-16806": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Ulterius Server < 1.9.5.0 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16806.yaml"
},
"CVE-2017-16877": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Nextjs <2.4.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16877.yaml"
},
"CVE-2017-16894": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Laravel <5.5.21 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16894.yaml"
},
"CVE-2017-17043": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17043.yaml"
},
"CVE-2017-17059": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17059.yaml"
},
"CVE-2017-17092": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress < 4.9.1 - Authenticated JavaScript File Upload",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17092.yaml"
},
"CVE-2017-17451": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Mailster <=1.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17451.yaml"
},
"CVE-2017-17562": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Embedthis GoAhead <3.6.5 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17562.yaml"
},
"CVE-2017-17731": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "DedeCMS 5.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17731.yaml"
},
"CVE-2017-17736": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-425",
"name": "Kentico - Installer Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17736.yaml"
},
"CVE-2017-17762": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Episerver 7 - Blind XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17762.yaml"
},
"CVE-2017-18024": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "AvantFAX 3.3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18024.yaml"
},
"CVE-2017-18349": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Fastjson Insecure Deserialization - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18349.yaml"
},
"CVE-2017-18362": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18362.yaml"
},
"CVE-2017-18487": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "AdPush < 1.44 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18487.yaml"
},
"CVE-2017-18490": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18490.yaml"
},
"CVE-2017-18491": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18491.yaml"
},
"CVE-2017-18492": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18492.yaml"
},
"CVE-2017-18493": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18493.yaml"
},
"CVE-2017-18494": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18494.yaml"
},
"CVE-2017-18496": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18496.yaml"
},
"CVE-2017-18500": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18500.yaml"
},
"CVE-2017-18501": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Social Login by BestWebSoft < 0.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18501.yaml"
},
"CVE-2017-18502": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18502.yaml"
},
"CVE-2017-18505": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "BestWebSoft's Twitter < 2.55 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18505.yaml"
},
"CVE-2017-18516": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18516.yaml"
},
"CVE-2017-18517": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18517.yaml"
},
"CVE-2017-18518": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18518.yaml"
},
"CVE-2017-18527": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18527.yaml"
},
"CVE-2017-18528": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18528.yaml"
},
"CVE-2017-18529": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18529.yaml"
},
"CVE-2017-18530": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rating by BestWebSoft < 0.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18530.yaml"
},
"CVE-2017-18532": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18532.yaml"
},
"CVE-2017-18536": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18536.yaml"
},
"CVE-2017-18537": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18537.yaml"
},
"CVE-2017-18542": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18542.yaml"
},
"CVE-2017-18556": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18556.yaml"
},
"CVE-2017-18557": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18557.yaml"
},
"CVE-2017-18558": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18558.yaml"
},
"CVE-2017-18562": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18562.yaml"
},
"CVE-2017-18564": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18564.yaml"
},
"CVE-2017-18565": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Updater by BestWebSoft < 1.35 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18565.yaml"
},
"CVE-2017-18566": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18566.yaml"
},
"CVE-2017-18580": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18580.yaml"
},
"CVE-2017-18590": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Timesheet Plugin < 0.1.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18590.yaml"
},
"CVE-2017-18598": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Qards - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18598.yaml"
},
"CVE-2017-18638": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Graphite <=1.1.5 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18638.yaml"
},
"CVE-2017-20192": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Formidable Forms < 2.05.02 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-20192.yaml"
},
"CVE-2017-20194": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-20194.yaml"
},
"CVE-2017-3131": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3131.yaml"
},
"CVE-2017-3132": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Fortinet FortiOS < 5.6.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3132.yaml"
},
"CVE-2017-3133": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Fortinet FortiOS < 5.6.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3133.yaml"
},
"CVE-2017-3506": {
"cvss": 7.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"name": "Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3506.yaml"
},
"CVE-2017-3528": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3528.yaml"
},
"CVE-2017-3881": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Cisco IOS 12.2(55)SE11 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2017/CVE-2017-3881.yaml"
},
"CVE-2017-4011": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-4011.yaml"
},
"CVE-2017-5487": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Core < 4.7.1 - Username Enumeration",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2017-5487-3022.yaml"
},
"CVE-2017-5521": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "NETGEAR Routers - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5521.yaml"
},
"CVE-2017-5631": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "KMCIS CaseAware - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5631.yaml"
},
"CVE-2017-5638": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Apache Struts 2 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5638.yaml"
},
"CVE-2017-5645": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Log4j Server - Deserialization Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2017/CVE-2017-5645.yaml"
},
"CVE-2017-5689": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Intel Active Management - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5689.yaml"
},
"CVE-2017-5868": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-93",
"name": "OpenVPN Access Server 2.1.4 - CRLF Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5868.yaml"
},
"CVE-2017-5871": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Odoo <= 8.0-20160726 & 9.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5871.yaml"
},
"CVE-2017-5982": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Kodi 17.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5982.yaml"
},
"CVE-2017-5983": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5983.yaml"
},
"CVE-2017-6090": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "PhpColl 2.5.1 Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-6090.yaml"
},
"CVE-2017-6360": {
"name": "QNAP QTS RCE",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2017-6360-3047.yaml"
},
"CVE-2017-6361": {
"name": "QNAP QTS RCE",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2017-6361-3049.yaml"
},
"CVE-2017-6478": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-6478.yaml"
},
"CVE-2017-7269": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-119",
"name": "Windows Server 2003 & IIS 6.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7269.yaml"
},
"CVE-2017-7391": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Magmi 0.7.22 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7391.yaml"
},
"CVE-2017-7504": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7504.yaml"
},
"CVE-2017-7529": {
"name": "Nginx Remote Integer Overflow",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2017-7529-3066.yaml"
},
"CVE-2017-7615": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-640",
"name": "MantisBT <=2.30 - Arbitrary Password Reset/Admin Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7615.yaml"
},
"CVE-2017-7855": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp WebMail 11.3.1.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7855.yaml"
},
"CVE-2017-7921": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Hikvision - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7921.yaml"
},
"CVE-2017-7925": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Dahua Security - Configuration File Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7925.yaml"
},
"CVE-2017-8046": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8046.yaml"
},
"CVE-2017-8225": {
"cvss": 9.8,
"cwe": "CWE-200",
"name": "GoAhead Camera - Credential Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8225.yaml"
},
"CVE-2017-8229": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-255",
"name": "Amcrest IP Camera Web Management - Data Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8229.yaml"
},
"CVE-2017-8917": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Joomla! <3.7.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8917.yaml"
},
"CVE-2017-9140": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Reflected XSS - Telerik Reporting Module",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9140.yaml"
},
"CVE-2017-9248": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-522",
"name": "RCE - Progress Telerik UI",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2017-9248.yaml"
},
"CVE-2017-9288": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9288.yaml"
},
"CVE-2017-9416": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Odoo 8.0/9.0/10.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9416.yaml"
},
"CVE-2017-9506": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9506.yaml"
},
"CVE-2017-9791": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Apache Struts2 S2-053 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9791.yaml"
},
"CVE-2017-9805": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Struts2 S2-052 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9805.yaml"
},
"CVE-2017-9822": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9822.yaml"
},
"CVE-2017-9833": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "BOA Web Server 0.94.14 - Arbitrary File Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9833.yaml"
},
"CVE-2017-9841": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "PHPUnit - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml"
},
"CVE-2017-9965": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9965.yaml"
},
"CVE-2018-0101": {
"name": "Cisco ASA Denial-of-Service # Leads to RCE",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2018-0101.yaml"
},
"CVE-2018-0127": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Cisco RV132W/RV134W Router - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0127.yaml"
},
"CVE-2018-0171": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Cisco Smart Install - Configuration Download",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-0171.yaml"
},
"CVE-2018-0296": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "Cisco ASA - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0296.yaml"
},
"CVE-2018-1000129": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jolokia 1.3.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000129.yaml"
},
"CVE-2018-1000130": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Jolokia Agent - JNDI Code Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000130.yaml"
},
"CVE-2018-1000226": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-732",
"name": "Cobbler - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000226.yaml"
},
"CVE-2018-1000533": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "GitList < 0.6.0 Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000533.yaml"
},
"CVE-2018-1000600": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000600.yaml"
},
"CVE-2018-1000671": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Sympa version =>6.2.16 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000671.yaml"
},
"CVE-2018-1000856": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000856.yaml"
},
"CVE-2018-1000861": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Jenkins - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000861.yaml"
},
"CVE-2018-10088": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-119",
"name": "XiongMai uc-httpd 1.0.0 - Buffer Overflow",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10088.yaml"
},
"CVE-2018-10093": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "AudioCodes 420HD - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10093.yaml"
},
"CVE-2018-10095": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Dolibarr <7.0.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10095.yaml"
},
"CVE-2018-10141": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10141.yaml"
},
"CVE-2018-10201": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Ncomputing vSPace Pro 10 and 11 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10201.yaml"
},
"CVE-2018-10230": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zend Server <9.13 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10230.yaml"
},
"CVE-2018-10245": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "AWStats <= 7.5 - Full Path Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10245.yaml"
},
"CVE-2018-10383": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10383.yaml"
},
"CVE-2018-10562": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Dasan GPON Devices - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10562.yaml"
},
"CVE-2018-10735": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NagiosXI <= 5.4.12 `commandline.php` SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10735.yaml"
},
"CVE-2018-10736": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NagiosXI <= 5.4.12 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10736.yaml"
},
"CVE-2018-10737": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NagiosXI <= 5.4.12 logbook.php SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10737.yaml"
},
"CVE-2018-10738": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NagiosXI <= 5.4.12 menuaccess.php - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10738.yaml"
},
"CVE-2018-10818": {
"name": "LG NAS Devices - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2018-10818.yaml"
},
"CVE-2018-10822": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "D-Link Routers - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10822.yaml"
},
"CVE-2018-10823": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link Routers - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10823.yaml"
},
"CVE-2018-10942": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Prestashop AttributeWizardPro Module - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10942.yaml"
},
"CVE-2018-10956": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10956.yaml"
},
"CVE-2018-11133": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Quest KACE SMA /common/run_cross_report.php 'fmt' XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11133.yaml"
},
"CVE-2018-11138": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Quest KACE System Management Appliance 8.0.318 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11138.yaml"
},
"CVE-2018-11222": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-20",
"name": "Pandora FMS <=7.0NG.722 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11222.yaml"
},
"CVE-2018-11227": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Monstra CMS <=3.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11227.yaml"
},
"CVE-2018-11231": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Opencart Divido - Sql Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11231.yaml"
},
"CVE-2018-11409": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Splunk <=7.0.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11409.yaml"
},
"CVE-2018-11473": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Monstra CMS 3.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11473.yaml"
},
"CVE-2018-11510": {
"name": "CVE-2018-11510 ASUSTOR-rce",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2018-11510.yaml"
},
"CVE-2018-11511": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11511.yaml"
},
"CVE-2018-11686": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "FlexPaper/FlowPaper 2.3.6 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11686.yaml"
},
"CVE-2018-11709": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11709.yaml"
},
"CVE-2018-11759": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Apache Tomcat JK Connect <=1.2.44 - Manager Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11759.yaml"
},
"CVE-2018-11776": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Apache Struts2 S2-057 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11776.yaml"
},
"CVE-2018-11784": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "Apache Tomcat - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11784.yaml"
},
"CVE-2018-12031": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Eaton Intelligent Power Manager 1.6 - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12031.yaml"
},
"CVE-2018-12054": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Schools Alert Management Script - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12054.yaml"
},
"CVE-2018-1207": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Dell iDRAC7/8 Devices - Remote Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1207.yaml"
},
"CVE-2018-12095": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OEcms 3.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12095.yaml"
},
"CVE-2018-1217": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1217.yaml"
},
"CVE-2018-12296": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-732",
"name": "Seagate NAS OS 4.3.15.1 - Server Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12296.yaml"
},
"CVE-2018-12300": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Seagate NAS OS 4.3.15.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12300.yaml"
},
"CVE-2018-12455": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Intelbras NPLUG 1.0.0.14 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12455.yaml"
},
"CVE-2018-1247": {
"name": "RSA Authentication Manager XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2018-1247-3243.yaml"
},
"CVE-2018-12613": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "PhpMyAdmin <4.8.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12613.yaml"
},
"CVE-2018-12634": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "CirCarLife Scada <4.3 - System Log Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12634.yaml"
},
"CVE-2018-12675": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "SV3C HD Camera L Series - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12675.yaml"
},
"CVE-2018-1271": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Spring MVC Framework - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1271.yaml"
},
"CVE-2018-1273": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Spring Data Commons - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml"
},
"CVE-2018-12909": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Webgrind <= 1.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12909.yaml"
},
"CVE-2018-12998": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zoho manageengine - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12998.yaml"
},
"CVE-2018-13317": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "TOTOLINK A3002RU 1.0.8 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13317.yaml"
},
"CVE-2018-1335": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Tika < 1.1.8 - Header Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1335.yaml"
},
"CVE-2018-13379": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Fortinet FortiOS - Credentials Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13379.yaml"
},
"CVE-2018-13380": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Fortinet FortiOS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13380.yaml"
},
"CVE-2018-13880": {
"name": "Fortinet FortiOS Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2018-13880-3289.yaml"
},
"CVE-2018-13980": {
"cvss": 5.5,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13980.yaml"
},
"CVE-2018-14013": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14013.yaml"
},
"CVE-2018-14064": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "VelotiSmart Wifi - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14064.yaml"
},
"CVE-2018-14474": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Orange Forum 1.4.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14474.yaml"
},
"CVE-2018-14574": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Django - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14574.yaml"
},
"CVE-2018-14728": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Responsive filemanager 9.13.1 Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14728.yaml"
},
"CVE-2018-14912": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "cgit < 1.2.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14912.yaml"
},
"CVE-2018-14916": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-732",
"name": "Loytec LGATE-902 <6.4.2 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14916.yaml"
},
"CVE-2018-14918": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "LOYTEC LGATE-902 6.3.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14918.yaml"
},
"CVE-2018-14931": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14931.yaml"
},
"CVE-2018-14933": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "NUUO NVRmini - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14933.yaml"
},
"CVE-2018-15138": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "LG-Ericsson iPECS NMS 30M - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15138.yaml"
},
"CVE-2018-15473": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-362",
"name": "OpenSSH Username Enumeration <= v7.7",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2018-15473.yaml"
},
"CVE-2018-15517": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"cwe": "CWE-918",
"name": "D-Link Central WifiManager - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15517.yaml"
},
"CVE-2018-15531": {
"name": "javaMelody XXE",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2018-15531.yaml"
},
"CVE-2018-15535": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Responsive FileManager <9.13.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15535.yaml"
},
"CVE-2018-15640": {
"name": "Odoo LFI",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2018-15640-3340.yaml"
},
"CVE-2018-15657": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "SureMDM Local / Remote File Inclusion",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2018-15657.yaml"
},
"CVE-2018-15745": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Argus Surveillance DVR 4.0.0.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15745.yaml"
},
"CVE-2018-15811": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-326",
"name": "DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15811.yaml"
},
"CVE-2018-15917": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jorani Leave Management System 0.6.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15917.yaml"
},
"CVE-2018-15961": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Adobe ColdFusion - Unrestricted File Upload Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15961.yaml"
},
"CVE-2018-16059": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16059.yaml"
},
"CVE-2018-16133": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16133.yaml"
},
"CVE-2018-16139": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16139.yaml"
},
"CVE-2018-16159": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Gift Voucher <4.1.8 - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16159.yaml"
},
"CVE-2018-16167": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "LogonTracer <=1.2.0 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16167.yaml"
},
"CVE-2018-16283": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16283.yaml"
},
"CVE-2018-16288": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "LG SuperSign EZ CMS 2.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16288.yaml"
},
"CVE-2018-16299": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Localize My Post 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16299.yaml"
},
"CVE-2018-16341": {
"name": "Nuxeo Authentication Bypass Remote Code Execution",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2018-16341-3381.yaml"
},
"CVE-2018-16363": {
"name": "WordPress File Manager < 3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16363.yaml"
},
"CVE-2018-16668": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-287",
"name": "CirCarLife <4.3 - Improper Authentication",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16668.yaml"
},
"CVE-2018-16670": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-287",
"name": "CirCarLife <4.3 - Improper Authentication",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16670.yaml"
},
"CVE-2018-16671": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "CirCarLife <4.3 - Improper Authentication",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16671.yaml"
},
"CVE-2018-16716": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "NCBI ToolBox - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16716.yaml"
},
"CVE-2018-16761": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Eventum <3.4.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16761.yaml"
},
"CVE-2018-16763": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "FUEL CMS 1.4.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16763.yaml"
},
"CVE-2018-16836": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Rubedo CMS <=3.4.0 - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16836.yaml"
},
"CVE-2018-16979": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-113",
"name": "Monstra CMS 3.0.4 - HTTP Header Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16979.yaml"
},
"CVE-2018-17082": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache2 - Transfer-Encoding Chunked XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17082.yaml"
},
"CVE-2018-17153": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Western Digital MyCloud NAS - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17153.yaml"
},
"CVE-2018-17173": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "LG Supersign EZ CMS - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17173.yaml"
},
"CVE-2018-17207": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17207.yaml"
},
"CVE-2018-17246": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Kibana - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17246.yaml"
},
"CVE-2018-17254": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Joomla! JCK Editor SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17254.yaml"
},
"CVE-2018-17283": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Zoho ManageEngine OpManager - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17283.yaml"
},
"CVE-2018-17422": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "DotCMS < 5.0.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17422.yaml"
},
"CVE-2018-17431": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Comodo Unified Threat Management Web Console - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17431.yaml"
},
"CVE-2018-18069": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18069.yaml"
},
"CVE-2018-18264": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Kubernetes Dashboard <1.10.1 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18264.yaml"
},
"CVE-2018-18323": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Centos Web Panel 0.9.8.480 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18323.yaml"
},
"CVE-2018-18325": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-326",
"name": "DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18325.yaml"
},
"CVE-2018-18326": {
"name": "DotNetNuke Cookie Deserialization Probing",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2018-18326-3440.yaml"
},
"CVE-2018-18570": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Planon <Live Build 41 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18570.yaml"
},
"CVE-2018-18608": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DedeCMS 5.7 SP2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18608.yaml"
},
"CVE-2018-18775": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microstrategy Web 7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18775.yaml"
},
"CVE-2018-18777": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Microstrategy Web 7 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18777.yaml"
},
"CVE-2018-18778": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "ACME mini_httpd <1.30 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18778.yaml"
},
"CVE-2018-18809": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "TIBCO JasperReports Library - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18809.yaml"
},
"CVE-2018-18925": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-384",
"name": "Gogs (Go Git Service) 0.11.66 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18925.yaml"
},
"CVE-2018-19127": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "PHPCMS 2008 - Remote Code Execution via Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19127.yaml"
},
"CVE-2018-19136": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19136.yaml"
},
"CVE-2018-19137": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19137.yaml"
},
"CVE-2018-19207": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-425",
"name": "WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19207.yaml"
},
"CVE-2018-19276": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "OpenMRS Platform < 2.24.0 - Insecure Object Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19276.yaml"
},
"CVE-2018-19287": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Ninja Forms <3.3.18 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19287.yaml"
},
"CVE-2018-19326": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19326.yaml"
},
"CVE-2018-19365": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-22",
"name": "Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19365.yaml"
},
"CVE-2018-19386": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19386.yaml"
},
"CVE-2018-19410": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "PRTG Network Monitor - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19410.yaml"
},
"CVE-2018-19439": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19439.yaml"
},
"CVE-2018-19458": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "PHP Proxy 3.0.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19458.yaml"
},
"CVE-2018-19518": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-88",
"name": "PHP imap - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2018/CVE-2018-19518.yaml"
},
"CVE-2018-19749": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19749.yaml"
},
"CVE-2018-19751": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19751.yaml"
},
"CVE-2018-19752": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19752.yaml"
},
"CVE-2018-19753": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Tarantella Enterprise <3.11 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19753.yaml"
},
"CVE-2018-19877": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19877.yaml"
},
"CVE-2018-19892": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19892.yaml"
},
"CVE-2018-19914": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19914.yaml"
},
"CVE-2018-19915": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD <=4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19915.yaml"
},
"CVE-2018-20009": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20009.yaml"
},
"CVE-2018-20010": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20010.yaml"
},
"CVE-2018-20011": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20011.yaml"
},
"CVE-2018-20062": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "ThinkPHP 5.0.23 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20062.yaml"
},
"CVE-2018-20462": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress JSmol2WP <=1.07 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20462.yaml"
},
"CVE-2018-20463": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress JSmol2WP <=1.07 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20463.yaml"
},
"CVE-2018-20470": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Tyto Sahi pro 7.x/8.x - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20470.yaml"
},
"CVE-2018-20526": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Roxy Fileman 1.4.5 - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20526.yaml"
},
"CVE-2018-20608": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Imcat 4.4 - Phpinfo Configuration",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20608.yaml"
},
"CVE-2018-20824": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20824.yaml"
},
"CVE-2018-20985": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "WordPress Payeezy Pay <=2.97 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20985.yaml"
},
"CVE-2018-2392": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-611",
"name": "SAP Internet Graphics Server (IGS) - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2392.yaml"
},
"CVE-2018-25019": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"name": ">",
"severity": "critical",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2018/CVE-2018-25019-sfwd_lms-9d4f47af-294a-4c3a-accd-9ae674916a38.yaml"
},
"CVE-2018-25031": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cwe": "CWE-20",
"name": "Swagger UI < 3.38.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2018/CVE-2018-25031.yaml"
},
"CVE-2018-25114": {
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-94",
"name": "osCommerce 2.3.4.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-25114.yaml"
},
"CVE-2018-2628": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Oracle WebLogic Server Deserialization - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2018/CVE-2018-2628.yaml"
},
"CVE-2018-2791": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"name": "Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2791.yaml"
},
"CVE-2018-2893": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Oracle WebLogic Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2018/CVE-2018-2893.yaml"
},
"CVE-2018-2894": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Oracle WebLogic Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2894.yaml"
},
"CVE-2018-3167": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Oracle E-Business Suite - Blind SSRF",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3167.yaml"
},
"CVE-2018-3238": {
"cvss": 6.9,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N",
"name": "Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3238.yaml"
},
"CVE-2018-3714": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "node-srv - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3714.yaml"
},
"CVE-2018-3760": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Ruby On Rails - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3760.yaml"
},
"CVE-2018-3810": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3810.yaml"
},
"CVE-2018-5230": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Atlassian Jira Confluence - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5230.yaml"
},
"CVE-2018-5233": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Grav CMS <1.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5233.yaml"
},
"CVE-2018-5316": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5316.yaml"
},
"CVE-2018-5715": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SugarCRM 3.5.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5715.yaml"
},
"CVE-2018-6008": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6008.yaml"
},
"CVE-2018-6184": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Zeit Next.js < 4.2.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6184.yaml"
},
"CVE-2018-6200": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "vBulletin - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6200.yaml"
},
"CVE-2018-6389": {
"name": "Wordpress DoS",
"severity": "low",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2018-6389-3579.yaml"
},
"CVE-2018-6530": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6530.yaml"
},
"CVE-2018-6605": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6605.yaml"
},
"CVE-2018-6882": {
"cvss": 6.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zimbra Collaboration Suite - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6882.yaml"
},
"CVE-2018-6910": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "DedeCMS 5.7 - Path Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6910.yaml"
},
"CVE-2018-6961": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "VMware NSX SD-WAN Edge - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6961.yaml"
},
"CVE-2018-7192": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < 1.10.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7192.yaml"
},
"CVE-2018-7193": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < 1.10.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7193.yaml"
},
"CVE-2018-7196": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < 1.10.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7196.yaml"
},
"CVE-2018-7251": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Anchor CMS 0.12.3 - Error Log Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7251.yaml"
},
"CVE-2018-7282": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "TITool PrintMonitor - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7282.yaml"
},
"CVE-2018-7314": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Joomla! Component PrayerCenter 3.0.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7314.yaml"
},
"CVE-2018-7422": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Site Editor <=1.1.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7422.yaml"
},
"CVE-2018-7467": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "AxxonSoft Axxon Next - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7467.yaml"
},
"CVE-2018-7490": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "uWSGI PHP Plugin Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7490.yaml"
},
"CVE-2018-7600": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Drupal - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml"
},
"CVE-2018-7602": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Drupal - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7602.yaml"
},
"CVE-2018-7653": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "YzmCMS v3.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7653.yaml"
},
"CVE-2018-7662": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "CouchCMS <= 2.0 - Path Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7662.yaml"
},
"CVE-2018-7667": {
"name": "Adminer - 4.3.1 Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2018-7667.yaml"
},
"CVE-2018-7700": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7700.yaml"
},
"CVE-2018-7719": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Acrolinx Server <5.2.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7719.yaml"
},
"CVE-2018-7765": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Schneider Electric U.motion Builder - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7765.yaml"
},
"CVE-2018-7841": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Schneider Electric U.motion Builder - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7841.yaml"
},
"CVE-2018-8006": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache ActiveMQ <=5.15.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8006.yaml"
},
"CVE-2018-8011": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-119",
"name": "Apache HTTP Server - NULL Pointer Dereference",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-8011.yaml"
},
"CVE-2018-8024": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache Spark UI - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8024.yaml"
},
"CVE-2018-8033": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Apache OFBiz - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8033.yaml"
},
"CVE-2018-8715": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "AppWeb - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8715.yaml"
},
"CVE-2018-8719": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-532",
"name": "WordPress WP Security Audit Log 3.1.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8719.yaml"
},
"CVE-2018-8727": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8727.yaml"
},
"CVE-2018-8770": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Cobub Razor 0.8.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8770.yaml"
},
"CVE-2018-8823": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "PrestaShop Responsive Mega Menu Module - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8823.yaml"
},
"CVE-2018-9118": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9118.yaml"
},
"CVE-2018-9126": {
"name": "DotNetNuke DNNarticle Module 11 - Directory Traversal (CVE-2018-9126)",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2018-9126-3657.yaml"
},
"CVE-2018-9161": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "PrismaWEB - Credentials Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9161.yaml"
},
"CVE-2018-9205": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9205.yaml"
},
"CVE-2018-9206": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9206.yaml"
},
"CVE-2018-9845": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-178",
"name": "Etherpad Lite <1.6.4 - Admin Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9845.yaml"
},
"CVE-2018-9995": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "TBK DVR4104/DVR4216 Devices - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9995.yaml"
},
"CVE-2019-0192": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Solr - Deserialization of Untrusted Data",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0192.yaml"
},
"CVE-2019-0193": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Apache Solr DataImportHandler <8.2.0 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0193.yaml"
},
"CVE-2019-0221": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache Tomcat - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0221.yaml"
},
"CVE-2019-0230": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1321",
"name": "Apache Struts <=2.5.20 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0230.yaml"
},
"CVE-2019-0232": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0232.yaml"
},
"CVE-2019-0604": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Microsoft SharePoint - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2019/CVE-2019-0604.yaml"
},
"CVE-2019-1003000": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Jenkins Script Security Plugin <=1.49 - Sandbox Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003000.yaml"
},
"CVE-2019-1003030": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-693",
"name": "Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003030.yaml"
},
"CVE-2019-10068": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Kentico CMS Insecure Deserialization Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10068.yaml"
},
"CVE-2019-10092": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10092.yaml"
},
"CVE-2019-10098": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10098.yaml"
},
"CVE-2019-1010287": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Timesheet Next Gen <=1.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1010287.yaml"
},
"CVE-2019-1010290": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Babel - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1010290.yaml"
},
"CVE-2019-10232": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10232.yaml"
},
"CVE-2019-10405": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jenkins <=2.196 - Cookie Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10405.yaml"
},
"CVE-2019-10475": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jenkins build-metrics 1.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10475.yaml"
},
"CVE-2019-10647": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "ZZZCMS ZZZPHP 1.6.3 \u2013 Remote PHP Code Execution (RCE)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2019-10647.yaml"
},
"CVE-2019-10692": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Google Maps <7.11.18 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10692.yaml"
},
"CVE-2019-10717": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"cwe": "CWE-22",
"name": "BlogEngine.NET 3.3.7.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10717.yaml"
},
"CVE-2019-10758": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"name": "mongo-express Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10758.yaml"
},
"CVE-2019-11013": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Nimble Streamer <=3.5.4-9 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11013.yaml"
},
"CVE-2019-11043": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-119",
"name": "PHP-FPM Path Info Buffer Underflow - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11043.yaml"
},
"CVE-2019-11248": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"name": "Debug Endpoint pprof - Exposure Detection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11248.yaml"
},
"CVE-2019-11253": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-400",
"name": "Kubernetes API Server - YAML Parsing DoS (Billion Laughs)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11253.yaml"
},
"CVE-2019-11370": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Carel pCOWeb <B1.2.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11370.yaml"
},
"CVE-2019-11507": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11507.yaml"
},
"CVE-2019-11510": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Pulse Connect Secure SSL VPN Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11510.yaml"
},
"CVE-2019-11580": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11580.yaml"
},
"CVE-2019-11581": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Atlassian Jira Server-Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11581.yaml"
},
"CVE-2019-11600": {
"name": "OpenProject SQLi",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2019-11600-3758.yaml"
},
"CVE-2019-11869": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Yuzo <5.12.94 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11869.yaml"
},
"CVE-2019-11886": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11886.yaml"
},
"CVE-2019-12276": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "GrandNode 4.40 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12276.yaml"
},
"CVE-2019-12314": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Deltek Maconomy 2.2.5 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12314.yaml"
},
"CVE-2019-12461": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WebPort 1.19.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12461.yaml"
},
"CVE-2019-12581": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12581.yaml"
},
"CVE-2019-12583": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-425",
"name": "Zyxel ZyWall UAG/USG - Account Creation Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12583.yaml"
},
"CVE-2019-12593": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "IceWarp Mail Server <=10.4.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12593.yaml"
},
"CVE-2019-12616": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"cwe": "CWE-352",
"name": "phpMyAdmin < 4.9.0 - CSRF",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2019-12616-3794.yaml"
},
"CVE-2019-12725": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Zeroshell 3.9.0 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12725.yaml"
},
"CVE-2019-12935": {
"cvss": 7.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"cwe": "CWE-79",
"name": "Shopware < 5.5.8 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12935.yaml"
},
"CVE-2019-12962": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LiveZilla Server 8.0.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12962.yaml"
},
"CVE-2019-12985": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Citrix SD-WAN Center - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12985.yaml"
},
"CVE-2019-12986": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Citrix SD-WAN Center - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12986.yaml"
},
"CVE-2019-12987": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Citrix SD-WAN Center - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12987.yaml"
},
"CVE-2019-12988": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Citrix SD-WAN Center - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12988.yaml"
},
"CVE-2019-12989": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Citrix SD-WAN and NetScaler SD-WAN - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12989.yaml"
},
"CVE-2019-12990": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Citrix SD-WAN Center - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12990.yaml"
},
"CVE-2019-13101": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "D-Link DIR-600M - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13101.yaml"
},
"CVE-2019-13372": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "D-Link Central WiFi Manager CWM(100) - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13372.yaml"
},
"CVE-2019-13392": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MindPalette NateMail 3.0.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13392.yaml"
},
"CVE-2019-13396": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "FlightPath - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13396.yaml"
},
"CVE-2019-13462": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "Lansweeper Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13462.yaml"
},
"CVE-2019-13608": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Citrix StoreFront Server - XML External Entity",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13608.yaml"
},
"CVE-2019-14205": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14205.yaml"
},
"CVE-2019-14206": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-22",
"name": "Nevma Adaptive Images - Arbitrary File Deletion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14206.yaml"
},
"CVE-2019-14223": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Alfresco Share - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14223.yaml"
},
"CVE-2019-14251": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "T24 Web Server - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14251.yaml"
},
"CVE-2019-14287": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-755",
"name": "Sudo <= 1.8.27 - Security Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2019/CVE-2019-14287.yaml"
},
"CVE-2019-14312": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Aptana Jaxer 1.0.3.4547 - Local File inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14312.yaml"
},
"CVE-2019-14322": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Pallets Werkzeug <0.15.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14322.yaml"
},
"CVE-2019-14470": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress UserPro 4.9.32 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14470.yaml"
},
"CVE-2019-14530": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "OpenEMR <5.0.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14530.yaml"
},
"CVE-2019-14696": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14696.yaml"
},
"CVE-2019-14750": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < 1.12.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14750.yaml"
},
"CVE-2019-14789": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Custom 404 Pro < 3.2.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14789.yaml"
},
"CVE-2019-14950": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Live Chat Support <= 8.0.27 \u2014 Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14950.yaml"
},
"CVE-2019-14974": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SugarCRM Enterprise 9.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14974.yaml"
},
"CVE-2019-15043": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-306",
"name": "Grafana - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15043.yaml"
},
"CVE-2019-15107": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Webmin <= 1.920 - Unauthenticated Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15107.yaml"
},
"CVE-2019-15501": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15501.yaml"
},
"CVE-2019-15642": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Webmin < 1.920 - Authenticated Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15642.yaml"
},
"CVE-2019-15713": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress My Calendar <= 3.1.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15713.yaml"
},
"CVE-2019-15774": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "ND Booking < 2.5 - Unauthenticated Options Change",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15774.yaml"
},
"CVE-2019-1579": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-134",
"name": "Palo Alto GlobalProtect - PreAuth RCE",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2019-1579.yaml"
},
"CVE-2019-15811": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD <=4.13.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15811.yaml"
},
"CVE-2019-15823": {
"name": "WPS Hide Login <= 1.5.2.2  - Login Page Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15823.yaml"
},
"CVE-2019-15829": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Gallery Photoblocks < 1.1.43 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15829.yaml"
},
"CVE-2019-15858": {
"name": "Unauthenticated Woody Ad Snippets WordPress Plugin RCE",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2019-15858-3889.yaml"
},
"CVE-2019-15859": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Socomec DIRIS A-40 Devices Password Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15859.yaml"
},
"CVE-2019-15889": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Download Manager <2.9.94 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15889.yaml"
},
"CVE-2019-16057": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link DNS-320 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16057.yaml"
},
"CVE-2019-16072": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Enigma NMS < 65.0.0 - Authenticated OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16072.yaml"
},
"CVE-2019-16097": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-862",
"name": "Harbor <=1.82.0 - Privilege Escalation",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16097.yaml"
},
"CVE-2019-16123": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "PilusCart <=1.4.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16123.yaml"
},
"CVE-2019-16270": {
"name": "WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2019-16270.yaml"
},
"CVE-2019-16278": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "nostromo 1.9.6 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16278.yaml"
},
"CVE-2019-16313": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-798",
"name": "ifw8 Router ROM v4.31 - Credential Discovery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16313.yaml"
},
"CVE-2019-16332": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress API Bearer Auth <20190907 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16332.yaml"
},
"CVE-2019-16469": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-917",
"name": "Adobe Experience Manager - Expression Language Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16469.yaml"
},
"CVE-2019-16525": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Checklist <1.1.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16525.yaml"
},
"CVE-2019-1653": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1653.yaml"
},
"CVE-2019-16662": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "rConfig 3.9.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16662.yaml"
},
"CVE-2019-16663": {
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2019-16663.yaml"
},
"CVE-2019-16759": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "vBulletin 5.0.0-5.5.4 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16759.yaml"
},
"CVE-2019-16920": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link Routers - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16920.yaml"
},
"CVE-2019-16931": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Visualizer <3.3.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16931.yaml"
},
"CVE-2019-16932": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "Visualizer <3.3.1 - Blind Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16932.yaml"
},
"CVE-2019-16996": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Metinfo 7.0.0 beta - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16996.yaml"
},
"CVE-2019-16997": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Metinfo 7.0.0 beta - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16997.yaml"
},
"CVE-2019-17228": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-345",
"name": "Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17228.yaml"
},
"CVE-2019-17230": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": "WordPress OneTone theme <= 3.0.6 \u2013 Unauthenticated Options Changes",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17230.yaml"
},
"CVE-2019-17231": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "WordPress OneTone theme <= 3.0.6 \u2013 Unauthenticated Stored XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17231.yaml"
},
"CVE-2019-17232": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-306",
"name": "WordPress Ultimate FAQs <= 1.8.24 \u2013 Unauthenticated Options Import and Export",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17232.yaml"
},
"CVE-2019-17233": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "WordPress Ultimate FAQs <= 1.8.24 \u2013 Unauthenticated HTML Content Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17233.yaml"
},
"CVE-2019-17270": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Yachtcontrol Webapplication 1.0 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17270.yaml"
},
"CVE-2019-17382": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-639",
"name": "Zabbix <=4.4 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17382.yaml"
},
"CVE-2019-17418": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "MetInfo 7.0.0 beta - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17418.yaml"
},
"CVE-2019-17444": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-521",
"name": "Jfrog Artifactory <6.17.0 - Default Admin Password",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17444.yaml"
},
"CVE-2019-17503": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-425",
"name": "Kirona Dynamic Resource Scheduler - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17503.yaml"
},
"CVE-2019-17506": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "D-Link DIR-868L/817LW - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17506.yaml"
},
"CVE-2019-17538": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Jiangnan Online Judge 0.8.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17538.yaml"
},
"CVE-2019-17558": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Apache Solr <=8.3.1 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17558.yaml"
},
"CVE-2019-17564": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17564.yaml"
},
"CVE-2019-17574": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-639",
"name": "Popup-Maker < 1.8.12 - Broken Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17574.yaml"
},
"CVE-2019-17662": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "ThinVNC 1.0b1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17662.yaml"
},
"CVE-2019-17671": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17671.yaml"
},
"CVE-2019-1821": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1821.yaml"
},
"CVE-2019-18217": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-835",
"name": "ProFTPD < 1.3.6b - Remote Unauthenticated DoS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-18217.yaml"
},
"CVE-2019-18371": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Xiaomi Mi WiFi R3G Routers - Local file Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18371.yaml"
},
"CVE-2019-18393": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Ignite Realtime Openfire <4.42 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18393.yaml"
},
"CVE-2019-18394": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18394.yaml"
},
"CVE-2019-18665": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "DOMOS 5.5 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18665.yaml"
},
"CVE-2019-18818": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-640",
"name": "strapi CMS <3.0.0-beta.17.5 - Admin Password Reset",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18818.yaml"
},
"CVE-2019-18922": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Allied Telesis AT-GS950/8 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18922.yaml"
},
"CVE-2019-18935": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Telerix ASP.NET AJAX CVE-2019-18935",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2019-18935.yaml"
},
"CVE-2019-18952": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Xfilesharing 2.5.1 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18952.yaml"
},
"CVE-2019-18957": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MicroStrategy Library <11.1.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18957.yaml"
},
"CVE-2019-1898": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Cisco RV110W RV130W RV215W Router - Information leakage",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1898.yaml"
},
"CVE-2019-19134": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19134.yaml"
},
"CVE-2019-19368": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19368.yaml"
},
"CVE-2019-19411": {
"cvss": 3.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-665",
"name": "Huawei Firewall - Local File Inclusion",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19411.yaml"
},
"CVE-2019-1943": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Cisco Small Business 200,300 and 500 Series Switches - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1943.yaml"
},
"CVE-2019-19719": {
"name": "Tableau Server XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2019-19719-4040.yaml"
},
"CVE-2019-19743": {
"name": "D-Link DIR-615 - Privilege Escalation",
"severity": "none",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2019-19743.yaml"
},
"CVE-2019-19781": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Citrix ADC and Gateway - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19781.yaml"
},
"CVE-2019-19822": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "TOTOLINK/Realtek Routers - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19822.yaml"
},
"CVE-2019-19823": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "TOTOLINK/Realtek Routers - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19823.yaml"
},
"CVE-2019-19824": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TOTOLINK Realtek SD Routers - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19824.yaml"
},
"CVE-2019-19825": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "TOTOLINK/Realtek Routers - CAPTCHA Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19825.yaml"
},
"CVE-2019-19908": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpMyChat-Plus 1.98 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19908.yaml"
},
"CVE-2019-19985": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19985.yaml"
},
"CVE-2019-20085": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "TVT NVMS 1000 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20085.yaml"
},
"CVE-2019-20141": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20141.yaml"
},
"CVE-2019-20176": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-400",
"name": "Pure-FTPd < 1.0.50 - DoS via Resource Exhaustion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-20176.yaml"
},
"CVE-2019-20183": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Simple Employee Records System 1.0 - Unrestricted File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20183.yaml"
},
"CVE-2019-20210": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress CTHthemes - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20210.yaml"
},
"CVE-2019-20224": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Pandora FMS 7.0NG - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20224.yaml"
},
"CVE-2019-20354": {
"name": "piSignage 2.6.4 Directory Traversal",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2019-20354.yaml"
},
"CVE-2019-20504": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20504.yaml"
},
"CVE-2019-20933": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "InfluxDB <1.7.6 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20933.yaml"
},
"CVE-2019-25141": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25141.yaml"
},
"CVE-2019-25152": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"name": "Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25152.yaml"
},
"CVE-2019-25213": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-264",
"name": "WordPress Advanced Access Manager - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25213.yaml"
},
"CVE-2019-25246": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"name": "BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25246.yaml"
},
"CVE-2019-2578": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"name": "Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2578.yaml"
},
"CVE-2019-2579": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"name": "Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2579.yaml"
},
"CVE-2019-2588": {
"cvss": 4.9,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"name": "Oracle Business Intelligence - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2588.yaml"
},
"CVE-2019-2616": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"name": "Oracle Business Intelligence/XML Publisher - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2616.yaml"
},
"CVE-2019-2725": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Oracle WebLogic Server - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2725.yaml"
},
"CVE-2019-2729": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "Oracle WebLogic Server Administration Console - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2729.yaml"
},
"CVE-2019-2767": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"name": "Oracle Business Intelligence Publisher - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2767.yaml"
},
"CVE-2019-3396": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Atlassian Confluence Server - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3396.yaml"
},
"CVE-2019-3398": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Atlassian Confluence Download Attachments - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3398.yaml"
},
"CVE-2019-3401": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-863",
"name": "Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3401.yaml"
},
"CVE-2019-3402": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jira < 8.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3402.yaml"
},
"CVE-2019-3403": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-863",
"name": "Jira - Incorrect Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3403.yaml"
},
"CVE-2019-3799": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Spring Cloud Config Server - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3799.yaml"
},
"CVE-2019-3911": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LabKey Server Community Edition <18.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3911.yaml"
},
"CVE-2019-3912": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "LabKey Server Community Edition <18.3.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3912.yaml"
},
"CVE-2019-3929": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Barco/AWIND OEM Presentation Platform - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3929.yaml"
},
"CVE-2019-4061": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-200",
"name": "IBM BigFix Platform - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-4061.yaml"
},
"CVE-2019-4716": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-4716.yaml"
},
"CVE-2019-5127": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "YouPHPTube Encoder 2.3 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5127.yaml"
},
"CVE-2019-5128": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "YouPHPTube Encoder - Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5128.yaml"
},
"CVE-2019-5129": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "YouPHPTube Encoder 2.3 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5129.yaml"
},
"CVE-2019-5418": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Rails File Content Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml"
},
"CVE-2019-5434": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Revive Adserver 4.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5434.yaml"
},
"CVE-2019-5544": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-787",
"name": "VMware ESXi SLP - Heap Overflow DoS",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-5544.yaml"
},
"CVE-2019-5591": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "FortiOS - Insecure LDAP Configuration Detection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5591.yaml"
},
"CVE-2019-6112": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Sell Media 2.4.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6112.yaml"
},
"CVE-2019-6340": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Drupal - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6340.yaml"
},
"CVE-2019-6443": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-125",
"name": "NTPsec > 1.1.3 - 'ctl_getitem' Out-of-Bounds Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2019/CVE-2019-6443.yaml"
},
"CVE-2019-6703": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6703.yaml"
},
"CVE-2019-6715": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6715.yaml"
},
"CVE-2019-6793": {
"cvss": 7.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-918",
"name": "GitLab Enterprise Edition - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6793.yaml"
},
"CVE-2019-6799": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "phpMyAdmin <4.8.5 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6799.yaml"
},
"CVE-2019-6802": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-74",
"name": "Pypiserver <1.2.5 - Carriage Return Line Feed Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6802.yaml"
},
"CVE-2019-7139": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Magento - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7139.yaml"
},
"CVE-2019-7192": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "QNAP QTS and Photo Station 6.0.3 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7192.yaml"
},
"CVE-2019-7194": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "QNAP Photo Station < 6.0.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7194.yaml"
},
"CVE-2019-7195": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "QNAP Photo Station - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7195.yaml"
},
"CVE-2019-7219": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7219.yaml"
},
"CVE-2019-7238": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Sonatype Nexus Repository Manager  <3.15.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7238.yaml"
},
"CVE-2019-7254": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "eMerge E3 1.00-06 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7254.yaml"
},
"CVE-2019-7255": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Linear eMerge E3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7255.yaml"
},
"CVE-2019-7256": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "eMerge E3 1.00-06 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7256.yaml"
},
"CVE-2019-7275": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Optergy Proton/Enterprise Building Management System - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7275.yaml"
},
"CVE-2019-7276": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7276.yaml"
},
"CVE-2019-7315": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Genie Access WIP3BVAF IP Camera - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7315.yaml"
},
"CVE-2019-7481": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "SonicWall SRA 4600 VPN - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7481.yaml"
},
"CVE-2019-7543": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "KindEditor 4.1.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7543.yaml"
},
"CVE-2019-7609": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Kibana Timelion - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7609.yaml"
},
"CVE-2019-8086": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Adobe Experience Manager - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8086.yaml"
},
"CVE-2019-8390": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "qdPM 9.1 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8390.yaml"
},
"CVE-2019-8442": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Jira - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8442.yaml"
},
"CVE-2019-8446": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-863",
"name": "Jira Improper Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8446.yaml"
},
"CVE-2019-8449": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "Jira <8.4.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8449.yaml"
},
"CVE-2019-8451": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Jira <8.4.0 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8451.yaml"
},
"CVE-2019-8903": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Totaljs <3.2.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8903.yaml"
},
"CVE-2019-8937": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "HotelDruid 2.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8937.yaml"
},
"CVE-2019-8943": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-22",
"name": "WordPress Core 5.0.0 - Crop-image Shell Upload",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8943.yaml"
},
"CVE-2019-8982": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8982.yaml"
},
"CVE-2019-9041": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "ZZZCMS 1.6.1 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9041.yaml"
},
"CVE-2019-9082": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "ThinkPHP < 3.2.4 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9082.yaml"
},
"CVE-2019-9193": {
"name": "PostgreSQL 9.3-12.3 Authenticated Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2019/CVE-2019-9193.yaml"
},
"CVE-2019-9194": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "elFinder <= 2.1.47 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9194.yaml"
},
"CVE-2019-9618": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress GraceMedia Media Player 1.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9618.yaml"
},
"CVE-2019-9621": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Zimbra Collaboration Suite - SSRF",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9621.yaml"
},
"CVE-2019-9632": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "ESAFENET CDG - Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9632.yaml"
},
"CVE-2019-9670": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-611",
"name": "Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9670.yaml"
},
"CVE-2019-9726": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Homematic CCU3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9726.yaml"
},
"CVE-2019-9733": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "JFrog Artifactory 6.7.3 - Admin Login Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9733.yaml"
},
"CVE-2019-9757": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "LabKey Server 19.1.0 - XML External Entity (XXE)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9757.yaml"
},
"CVE-2019-9762": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PHPSHE 1.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9762.yaml"
},
"CVE-2019-9874": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Sitecore Experience Platform - Deserialization of Untrusted Data",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9874.yaml"
},
"CVE-2019-9879": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "WPGraphQL 0.2.3 - User Creation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9879.yaml"
},
"CVE-2019-9880": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-306",
"name": "WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9880.yaml"
},
"CVE-2019-9881": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-306",
"name": "WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9881.yaml"
},
"CVE-2019-9912": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Google Maps < 7.10.43 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9912.yaml"
},
"CVE-2019-9915": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "GetSimple CMS 3.3.13 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9915.yaml"
},
"CVE-2019-9922": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! Harmis Messenger 1.2.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9922.yaml"
},
"CVE-2019-9955": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zyxel - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9955.yaml"
},
"CVE-2019-9978": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Social Warfare <3.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml"
},
"CVE-2020-0618": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Microsoft SQL Server Reporting Services - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-0618.yaml"
},
"CVE-2020-0646": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-91",
"name": "Microsoft .NET Framework - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2020/CVE-2020-0646.yaml"
},
"CVE-2020-0796": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-119",
"name": "Microsoft SMBv3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-0796.yaml"
},
"CVE-2020-10124": {
"name": "SolarWindsOrion LFI",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2020-10124.yaml"
},
"CVE-2020-10148": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SolarWinds Orion API - Auth Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10148.yaml"
},
"CVE-2020-10189": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "ManageEngine Desktop Central Java Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10189.yaml"
},
"CVE-2020-10199": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "Sonatype Nexus Repository Manager 3 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10199.yaml"
},
"CVE-2020-10204": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Sonatype Nexus Repository Manager 3 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10204.yaml"
},
"CVE-2020-10220": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "rConfig 3.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10220.yaml"
},
"CVE-2020-10221": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "rConfig <= 3.9.4 - Authenticated OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10221.yaml"
},
"CVE-2020-10257": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "ThemeREX Addons - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10257.yaml"
},
"CVE-2020-10532": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "WatchGuard Fireware AD Helper Component - Credentials Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10532.yaml"
},
"CVE-2020-10546": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "rConfig 3.9.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10546.yaml"
},
"CVE-2020-10547": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "rConfig 3.9.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10547.yaml"
},
"CVE-2020-10548": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "rConfig 3.9.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10548.yaml"
},
"CVE-2020-10549": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "rConfig <=3.9.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10549.yaml"
},
"CVE-2020-10770": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-918",
"name": "Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10770.yaml"
},
"CVE-2020-10973": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "WAVLINK - Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10973.yaml"
},
"CVE-2020-10987": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Tenda AC15 AC1900 version 15.03.05.19 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10987.yaml"
},
"CVE-2020-11034": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "GLPI <9.4.6 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11034.yaml"
},
"CVE-2020-11110": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Grafana <= 6.7.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11110.yaml"
},
"CVE-2020-11441": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-93",
"name": "phpMyAdmin 5.0.2 - CRLF Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11441.yaml"
},
"CVE-2020-11450": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "MicroStrategy Web 10.4 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11450.yaml"
},
"CVE-2020-11455": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "LimeSurvey 4.1.11 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11455.yaml"
},
"CVE-2020-1147": {
"name": "RCE at SharePoint Server (.NET Framework & Visual Studio) detection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-1147-4404.yaml"
},
"CVE-2020-11514": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11514.yaml"
},
"CVE-2020-11515": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11515.yaml"
},
"CVE-2020-11529": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Grav < 1.7 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11529.yaml"
},
"CVE-2020-11530": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Chop Slider 3 - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11530.yaml"
},
"CVE-2020-11546": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "SuperWebmailer 7.21.0.01526 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11546.yaml"
},
"CVE-2020-11547": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "PRTG Network Monitor <20.1.57.1745 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11547.yaml"
},
"CVE-2020-11581": {
"name": "jira template injection",
"severity": "cretical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2020-11581.yaml"
},
"CVE-2020-11710": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Kong Admin <=2.03 - Admin API Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11710.yaml"
},
"CVE-2020-11732": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11732.yaml"
},
"CVE-2020-11738": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11738.yaml"
},
"CVE-2020-11798": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11798.yaml"
},
"CVE-2020-11853": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11853.yaml"
},
"CVE-2020-11854": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Micro Focus UCMDB - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11854.yaml"
},
"CVE-2020-11930": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress GTranslate <2.8.52 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11930.yaml"
},
"CVE-2020-11975": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Apache Unomi - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11975.yaml"
},
"CVE-2020-11978": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Apache Airflow <=1.10.10 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11978.yaml"
},
"CVE-2020-11981": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Apache Airflow <=1.10.10 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-11981.yaml"
},
"CVE-2020-11984": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-120",
"name": "Apache HTTP Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11984.yaml"
},
"CVE-2020-11991": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Apache Cocoon 2.1.12 - XML Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11991.yaml"
},
"CVE-2020-12054": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12054.yaml"
},
"CVE-2020-12116": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Zoho ManageEngine OpManger - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12116.yaml"
},
"CVE-2020-12124": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "WAVLINK WN530H4 live_api.cgi - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12124.yaml"
},
"CVE-2020-12127": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "WAVLINK WN530H4 M30H4.V5030.190403 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12127.yaml"
},
"CVE-2020-12145": {
"name": "Silver Peak Authentication Bypass \u2014 CVE-2020\u201312145",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-12145-4467.yaml"
},
"CVE-2020-12256": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "rConfig 3.9.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12256.yaml"
},
"CVE-2020-12259": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "rConfig 3.9.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12259.yaml"
},
"CVE-2020-12262": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12262.yaml"
},
"CVE-2020-12271": {
"name": "Sophos XG Firewall Pre-Auth SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2020-12271-4473.yaml"
},
"CVE-2020-12447": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Onkyo TX-NR585 Web Interface - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12447.yaml"
},
"CVE-2020-12478": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "TeamPass 2.1.27.36 - Improper Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12478.yaml"
},
"CVE-2020-12641": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Roundcube Webmail - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12641.yaml"
},
"CVE-2020-12720": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "vBulletin SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12720.yaml"
},
"CVE-2020-12800": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12800.yaml"
},
"CVE-2020-12832": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Simple File List - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12832.yaml"
},
"CVE-2020-13117": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Wavlink Multiple AP - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13117.yaml"
},
"CVE-2020-13121": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Submitty <= 20.04.01 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13121.yaml"
},
"CVE-2020-13125": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"name": "Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13125.yaml"
},
"CVE-2020-13158": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Artica Proxy Community Edition <4.30.000000 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13158.yaml"
},
"CVE-2020-13167": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Netsweeper <=6.4.3 - Python Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13167.yaml"
},
"CVE-2020-13258": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contentful <=2020-05-21 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13258.yaml"
},
"CVE-2020-13379": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"cwe": "CWE-918",
"name": "Grafana 3.0.1-7.0.1 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13379.yaml"
},
"CVE-2020-13405": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Microweber <1.1.20 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13405.yaml"
},
"CVE-2020-13483": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Bitrix24 <=20.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13483.yaml"
},
"CVE-2020-13638": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "rConfig 3.9 - Authentication Bypass(Admin Login)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13638.yaml"
},
"CVE-2020-13640": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "wpDiscuz <= 5.3.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13640.yaml"
},
"CVE-2020-13700": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-639",
"name": "WordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13700.yaml"
},
"CVE-2020-13820": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Extreme Management Center 8.4.1.24 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13820.yaml"
},
"CVE-2020-13851": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Artica Pandora FMS 7.44 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13851.yaml"
},
"CVE-2020-13886": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Intelbras TIP 200/200 LITE/300 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13886.yaml"
},
"CVE-2020-13927": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1188",
"name": "Airflow Experimental <1.10.11 - REST API Auth Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13927.yaml"
},
"CVE-2020-13935": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2020/CVE-2020-13935.yaml"
},
"CVE-2020-13937": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-922",
"name": "Apache Kylin - Exposed Configuration File",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13937.yaml"
},
"CVE-2020-13942": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Unomi <1.5.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13942.yaml"
},
"CVE-2020-13945": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-522",
"name": "Apache APISIX - Insufficiently Protected Credentials",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13945.yaml"
},
"CVE-2020-14092": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress PayPal Pro <1.1.65 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14092.yaml"
},
"CVE-2020-14144": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Gitea 1.1.0 - 1.12.5 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14144.yaml"
},
"CVE-2020-14179": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14179.yaml"
},
"CVE-2020-14181": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Jira Server and Data Center - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14181.yaml"
},
"CVE-2020-14295": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cacti 1.2.12 - SQL Injection / Remote Code Execution",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2020-14295.yaml"
},
"CVE-2020-14408": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Agentejo Cockpit 0.10.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14408.yaml"
},
"CVE-2020-14413": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NeDi 1.9C - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14413.yaml"
},
"CVE-2020-14644": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-14644.yaml"
},
"CVE-2020-14750": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Oracle WebLogic Server - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14750.yaml"
},
"CVE-2020-14815": {
"name": "Oracle Business Intelligence XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2020-14815-4563.yaml"
},
"CVE-2020-14864": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Oracle Fusion - Directory Traversal/Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14864.yaml"
},
"CVE-2020-14882": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Oracle Weblogic Server - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14882.yaml"
},
"CVE-2020-14883": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"name": "Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14883.yaml"
},
"CVE-2020-15004": {
"name": "OX App Suite XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2020-15004-4587.yaml"
},
"CVE-2020-15050": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Suprema BioStar <2.8.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15050.yaml"
},
"CVE-2020-15051": {
"name": "Artica Proxy before 4.30.000000. - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2020-15051.yaml"
},
"CVE-2020-15053": {
"name": "Artica Proxy CE before 4.28.030.418 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2020-15053.yaml"
},
"CVE-2020-15081": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-548",
"name": "PrestaShop < 1.7.6.6 - Information Exposure via Upload Directory",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15081.yaml"
},
"CVE-2020-15129": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Traefik - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15129.yaml"
},
"CVE-2020-15148": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Yii 2 < 2.0.38 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15148.yaml"
},
"CVE-2020-15227": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Nette Framework - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15227.yaml"
},
"CVE-2020-15415": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "DrayTek Vigor - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15415.yaml"
},
"CVE-2020-15500": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "TileServer GL <=3.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15500.yaml"
},
"CVE-2020-15505": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-706",
"name": "MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15505.yaml"
},
"CVE-2020-15568": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-913",
"name": "TerraMaster TOS <.1.29 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15568.yaml"
},
"CVE-2020-15718": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "RosarioSIS 6.7.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15718.yaml"
},
"CVE-2020-15867": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"name": "Gogs 0.5.5 - 0.12.2 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15867.yaml"
},
"CVE-2020-15895": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "D-Link DIR-816L 2.x - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15895.yaml"
},
"CVE-2020-15906": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-307",
"name": "Tiki Wiki CMS GroupWare - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15906.yaml"
},
"CVE-2020-15920": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Mida eFramework <=2.9.0 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15920.yaml"
},
"CVE-2020-16139": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "Cisco Unified IP Conference Station 7937G - Denial-of-Service",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16139.yaml"
},
"CVE-2020-16248": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16248.yaml"
},
"CVE-2020-16270": {
"name": "Olimpoks XSS",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-16270-4637.yaml"
},
"CVE-2020-16846": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "SaltStack <=3002 - Shell Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16846.yaml"
},
"CVE-2020-16920": {
"name": "Unauthenticated Multiple D-Link Routers RCE",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-16920-4648.yaml"
},
"CVE-2020-16952": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-346",
"name": "Microsoft SharePoint - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16952.yaml"
},
"CVE-2020-17362": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Nova Lite < 1.3.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17362.yaml"
},
"CVE-2020-17453": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17453.yaml"
},
"CVE-2020-17456": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17456.yaml"
},
"CVE-2020-17463": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Fuel CMS 1.4.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17463.yaml"
},
"CVE-2020-17496": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "vBulletin 5.5.4 - 5.6.2- Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17496.yaml"
},
"CVE-2020-17505": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Artica Web Proxy 4.30 - OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17505.yaml"
},
"CVE-2020-17506": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17506.yaml"
},
"CVE-2020-17518": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"name": "Apache Flink 1.5.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17518.yaml"
},
"CVE-2020-17519": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Apache Flink - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17519.yaml"
},
"CVE-2020-17526": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Apache Airflow <1.10.14 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17526.yaml"
},
"CVE-2020-17530": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "Apache Struts 2.0.0-2.5.25 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17530.yaml"
},
"CVE-2020-17558": {
"name": "Apache Solr RCE",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-17558.yaml"
},
"CVE-2020-18268": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Z-Blog <=1.5.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-18268.yaml"
},
"CVE-2020-19282": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jeesns 1.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19282.yaml"
},
"CVE-2020-19283": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jeesns 1.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19283.yaml"
},
"CVE-2020-19295": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jeesns 1.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19295.yaml"
},
"CVE-2020-19360": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "FHEM 6.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19360.yaml"
},
"CVE-2020-19363": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Vtiger CRM v7.2.0 - Directory Listing",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19363.yaml"
},
"CVE-2020-1938": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-1938.yaml"
},
"CVE-2020-1943": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache OFBiz <=16.11.07 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-1943.yaml"
},
"CVE-2020-19515": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "qdPM 9.1 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19515.yaml"
},
"CVE-2020-1956": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Apache Kylin 3.0.1 - Command Injection Vulnerability",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-1956.yaml"
},
"CVE-2020-1957": {
"name": "Apache Shiro - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2020-1957.yaml"
},
"CVE-2020-19625": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Gridx 1.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19625.yaml"
},
"CVE-2020-19719": {
"name": "Tableau Server DOM XSS",
"severity": "hight",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-19719-2(1).yaml"
},
"CVE-2020-20285": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ZZcms - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20285.yaml"
},
"CVE-2020-20300": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WeiPHP 5.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20300.yaml"
},
"CVE-2020-2036": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2036.yaml"
},
"CVE-2020-20601": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "ThinkCMF X2.2.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20601.yaml"
},
"CVE-2020-20627": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-306",
"name": "GiveWP - Missing Authorization to Settings Update",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20627.yaml"
},
"CVE-2020-2096": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2096.yaml"
},
"CVE-2020-20982": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "shadoweb wdja v1.5.1 - Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20982.yaml"
},
"CVE-2020-20988": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DomainMOD 4.13.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20988.yaml"
},
"CVE-2020-21012": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2020-21012.yaml"
},
"CVE-2020-2103": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-200",
"name": "Jenkins <=2.218 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2103.yaml"
},
"CVE-2020-21224": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-88",
"name": "Inspur ClusterEngine 4.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21224.yaml"
},
"CVE-2020-2140": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jenkin Audit Trail <=3.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2140.yaml"
},
"CVE-2020-2199": {
"name": "Jenkins Subversion Partial Release Manager XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2020-2199-4757.yaml"
},
"CVE-2020-21998": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "HomeAutomation 3.3.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21998.yaml"
},
"CVE-2020-22165": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "PHPGurukul Hospital Management System 4.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22165.yaml"
},
"CVE-2020-22208": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "74cms - ajax_street.php 'x' SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22208.yaml"
},
"CVE-2020-22209": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "74cms - ajax_common.php SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22209.yaml"
},
"CVE-2020-22210": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "74cms - ajax_officebuilding.php SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22210.yaml"
},
"CVE-2020-22211": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "74cms - ajax_street.php 'key' SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22211.yaml"
},
"CVE-2020-22840": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "b2evolution CMS <6.11.6 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22840.yaml"
},
"CVE-2020-23015": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "OPNsense <=20.1.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23015.yaml"
},
"CVE-2020-23517": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Aryanic HighMail (High CMS) - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23517.yaml"
},
"CVE-2020-23575": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Kyocera Printer d-COPIA253MF - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23575.yaml"
},
"CVE-2020-23697": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Monstra CMS 3.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23697.yaml"
},
"CVE-2020-23814": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XXL-JOB v2.2.0 \u2014 Stored Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23814.yaml"
},
"CVE-2020-23972": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-434",
"name": "Joomla! Component GMapFP 3.5 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23972.yaml"
},
"CVE-2020-24148": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-918",
"name": "Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24148.yaml"
},
"CVE-2020-24186": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress wpDiscuz <=7.0.4 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24186.yaml"
},
"CVE-2020-24223": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Mara CMS  7.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24223.yaml"
},
"CVE-2020-24285": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24285.yaml"
},
"CVE-2020-24312": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "WordPress Plugin File Manager (wp-file-manager) Backup Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24312.yaml"
},
"CVE-2020-24391": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Mongo-Express - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24391.yaml"
},
"CVE-2020-24550": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "EpiServer Find <13.2.7 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24550.yaml"
},
"CVE-2020-24571": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "NexusDB <4.50.23 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24571.yaml"
},
"CVE-2020-24579": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "D-Link DSL 2888a - Authentication Bypass/Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24579.yaml"
},
"CVE-2020-24589": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-611",
"name": "WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24589.yaml"
},
"CVE-2020-24597": {
"name": "Directory traversal in com_media",
"severity": "low",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2020-24597.yaml"
},
"CVE-2020-24609": {
"name": "Savsoft Quiz 5 Stored XSS",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2020-24609-4838.yaml"
},
"CVE-2020-24701": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OX Appsuite - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24701.yaml"
},
"CVE-2020-24765": {
"name": "iMind Server Information Leak",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2020-24765-4841.yaml"
},
"CVE-2020-24881": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "OsTicket < 1.14.3 - Server Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24881.yaml"
},
"CVE-2020-24902": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Quixplorer <=2.4.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24902.yaml"
},
"CVE-2020-24903": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cute Editor for ASP.NET 6.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24903.yaml"
},
"CVE-2020-24912": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "QCube Cross-Site-Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24912.yaml"
},
"CVE-2020-24949": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "PHP-Fusion 9.03.50 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24949.yaml"
},
"CVE-2020-25078": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25078.yaml"
},
"CVE-2020-25200": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-203",
"name": "Pritunl VPN Server 1.29.2145.25 - Username Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25200.yaml"
},
"CVE-2020-25213": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress File Manager Plugin - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25213.yaml"
},
"CVE-2020-25223": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Sophos UTM Preauth - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25223.yaml"
},
"CVE-2020-25495": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Xinuo Openserver 5/6 - Cross-Site scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25495.yaml"
},
"CVE-2020-25506": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link DNS-320 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25506.yaml"
},
"CVE-2020-2551": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Oracle WebLogic Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2551.yaml"
},
"CVE-2020-25540": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ThinkAdmin 6 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25540.yaml"
},
"CVE-2020-2555": {
"name": "WebLogic Server Deserialization RCE",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-2555.yaml"
},
"CVE-2020-25780": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Commvault CommCell - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25780.yaml"
},
"CVE-2020-25864": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25864.yaml"
},
"CVE-2020-26073": {
"name": "Cisco SD-WAN vManage Software - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26073.yaml"
},
"CVE-2020-26153": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26153.yaml"
},
"CVE-2020-26214": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Alerta < 8.1.0 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26214.yaml"
},
"CVE-2020-26217": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "XStream <1.4.14 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26217.yaml"
},
"CVE-2020-26248": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"cwe": "CWE-89",
"name": "PrestaShop Product Comments <4.2.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26248.yaml"
},
"CVE-2020-26258": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "XStream <1.4.15 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26258.yaml"
},
"CVE-2020-26413": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26413.yaml"
},
"CVE-2020-26836": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "SAP Solution Manager - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26836.yaml"
},
"CVE-2020-26876": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "WordPress WP Courses Plugin Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26876.yaml"
},
"CVE-2020-26879": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Ruckus vRioT IoT Controller - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26879.yaml"
},
"CVE-2020-26919": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26919.yaml"
},
"CVE-2020-26935": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "phpMyAdmin < 5.0.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26935.yaml"
},
"CVE-2020-26948": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Emby < 4.5.0 - Server Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26948.yaml"
},
"CVE-2020-27191": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "LionWiki <3.2.12 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27191.yaml"
},
"CVE-2020-2733": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2733.yaml"
},
"CVE-2020-27361": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27361.yaml"
},
"CVE-2020-27467": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Processwire CMS <2.7.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27467.yaml"
},
"CVE-2020-27481": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Good Layers LMS Plugin <= 2.1.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27481.yaml"
},
"CVE-2020-27615": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Loginizer < 1.6.4 \u2013 Unauthenticated SQL Injection via `log` Parameter",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27615.yaml"
},
"CVE-2020-27735": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wing FTP 6.4.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27735.yaml"
},
"CVE-2020-27838": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "KeyCloak - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27838.yaml"
},
"CVE-2020-27866": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "NETGEAR - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27866.yaml"
},
"CVE-2020-27982": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp WebMail 11.4.5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27982.yaml"
},
"CVE-2020-27986": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "SonarQube - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27986.yaml"
},
"CVE-2020-28185": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "TerraMaster TOS < 4.2.06 - User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28185.yaml"
},
"CVE-2020-28187": {
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2020-28187.yaml"
},
"CVE-2020-28188": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TerraMaster TOS - Unauthenticated Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28188.yaml"
},
"CVE-2020-28208": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-203",
"name": "Rocket.Chat <3.9.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28208.yaml"
},
"CVE-2020-28351": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28351.yaml"
},
"CVE-2020-28429": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "geojson2kml - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28429.yaml"
},
"CVE-2020-28653": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28653.yaml"
},
"CVE-2020-2883": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Oracle WebLogic Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-2883.yaml"
},
"CVE-2020-28871": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Monitorr 1.7.6m - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28871.yaml"
},
"CVE-2020-28976": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "WordPress Canto 1.3.0 - Blind Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28976.yaml"
},
"CVE-2020-29047": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "WP Hotel Booking < 1.10.4 - PHP Object Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29047.yaml"
},
"CVE-2020-29134": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "TOTVS Fluig <= 1.7.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29134.yaml"
},
"CVE-2020-29164": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PacsOne Server <7.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29164.yaml"
},
"CVE-2020-29214": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Alumni Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29214.yaml"
},
"CVE-2020-29227": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Car Rental Management System 1.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29227.yaml"
},
"CVE-2020-29279": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "74CMS - Remote File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29279.yaml"
},
"CVE-2020-29284": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Sourcecodester Multi Restaurant Table Reservation System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2020-29284.yaml"
},
"CVE-2020-29390": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Zeroshell 3.9.3 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29390.yaml"
},
"CVE-2020-29395": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29395.yaml"
},
"CVE-2020-29453": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29453.yaml"
},
"CVE-2020-29583": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-522",
"name": "ZyXel USG - Hardcoded Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29583.yaml"
},
"CVE-2020-29597": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "IncomCMS 2.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29597.yaml"
},
"CVE-2020-3187": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "Cisco Adaptive Security Appliance Software/Cisco Firepower Threat Defense - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3187.yaml"
},
"CVE-2020-3452": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3452.yaml"
},
"CVE-2020-35131": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Cockpit CMS 0.6.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35131.yaml"
},
"CVE-2020-35234": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-532",
"name": "SMTP WP Plugin Directory Listing",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35234.yaml"
},
"CVE-2020-35338": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Wireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential Detection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35338.yaml"
},
"CVE-2020-35359": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-770",
"name": "Pure-FTPd 1.0.48 - Denial of Service",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-35359.yaml"
},
"CVE-2020-35476": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "OpenTSDB <=2.4.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35476.yaml"
},
"CVE-2020-35489": {
"name": "WordPress Contact Form 7 Plugin - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2020-35489-5041.yaml"
},
"CVE-2020-35572": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-94",
"name": "Adminer 4.7.8 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2020-35572.yaml"
},
"CVE-2020-35580": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SearchBlox <9.2.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35580.yaml"
},
"CVE-2020-35598": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Advanced Comment System 1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35598.yaml"
},
"CVE-2020-35613": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SQL injection in com_users list view",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2020-35613.yaml"
},
"CVE-2020-35713": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35713.yaml"
},
"CVE-2020-35729": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Klog Server <=2.41 - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35729.yaml"
},
"CVE-2020-35736": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "GateOne 1.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35736.yaml"
},
"CVE-2020-35749": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Simple Job Board <2.9.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35749.yaml"
},
"CVE-2020-35774": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "twitter-server Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35774.yaml"
},
"CVE-2020-3580": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cisco ASA/FTD Software - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3580.yaml"
},
"CVE-2020-35846": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Agentejo Cockpit < 0.11.2 - NoSQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35846.yaml"
},
"CVE-2020-35847": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Agentejo Cockpit <0.11.2 - NoSQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35847.yaml"
},
"CVE-2020-35848": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Agentejo Cockpit <0.12.0 - NoSQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35848.yaml"
},
"CVE-2020-35951": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"cwe": "CWE-306",
"name": "Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35951.yaml"
},
"CVE-2020-35984": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 2.7.2 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35984.yaml"
},
"CVE-2020-35985": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 2.7.2 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35985.yaml"
},
"CVE-2020-35986": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 2.7.2 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35986.yaml"
},
"CVE-2020-35987": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 2.7.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35987.yaml"
},
"CVE-2020-36112": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "CSE Bookstore 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36112.yaml"
},
"CVE-2020-36155": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36155.yaml"
},
"CVE-2020-36287": {
"name": "Jira Dashboard Gadgets / Information Disclosure",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2020-36287.yaml"
},
"CVE-2020-36289": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-863",
"name": "Jira Server and Data Center - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36289.yaml"
},
"CVE-2020-36333": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-285",
"name": "ThemeGrill Demo Importer < 1.6.2 - Database Reset",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36333.yaml"
},
"CVE-2020-36365": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Smartstore <4.1.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36365.yaml"
},
"CVE-2020-36510": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress 15Zine <3.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36510.yaml"
},
"CVE-2020-36705": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Adning Advertising <= 1.5.5 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36705.yaml"
},
"CVE-2020-36708": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36708.yaml"
},
"CVE-2020-36723": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "ListingPro < 2.6.1 - Sensitive Data Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36723.yaml"
},
"CVE-2020-36728": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"name": "WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36728.yaml"
},
"CVE-2020-36731": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36731.yaml"
},
"CVE-2020-36836": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-862",
"name": "WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36836.yaml"
},
"CVE-2020-36884": {
"cwe": "CWE-918",
"name": "BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36884.yaml"
},
"CVE-2020-37123": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Pinger 1.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-37123.yaml"
},
"CVE-2020-3952": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "VMware vCenter Server LDAP Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3952.yaml"
},
"CVE-2020-4038": {
"name": "Graphql Playground XSS",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2020-4038.yaml"
},
"CVE-2020-4427": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "IBM Data Risk Manager - Authentication Bypass via SAML",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-4427.yaml"
},
"CVE-2020-4429": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "IBM Data Risk Manager - Hardcoded Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-4429.yaml"
},
"CVE-2020-4463": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"cwe": "CWE-611",
"name": "IBM Maximo Asset Management Information Disclosure - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-4463.yaml"
},
"CVE-2020-5191": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPGurukul Hospital Management System - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5191.yaml"
},
"CVE-2020-5192": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Hospital Management System 4.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5192.yaml"
},
"CVE-2020-5284": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"name": "Next.js <9.3.2 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5284.yaml"
},
"CVE-2020-5307": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5307.yaml"
},
"CVE-2020-5377": {
"name": "Dell OpenManage Administrator Auth Bypass CVE-2020-5377",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-5377-5151.yaml"
},
"CVE-2020-5398": {
"name": "Spring MVC RFD",
"severity": "highx",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2020-5398-5152.yaml"
},
"CVE-2020-5405": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"name": "Spring Cloud Config - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5405.yaml"
},
"CVE-2020-5410": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Spring Cloud Config Server - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5410.yaml"
},
"CVE-2020-5412": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"name": "Spring Cloud Netflix - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5412.yaml"
},
"CVE-2020-5515": {
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2020-5515.yaml"
},
"CVE-2020-5722": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Grandstream UCM6200 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5722.yaml"
},
"CVE-2020-5766": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5766.yaml"
},
"CVE-2020-5775": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"cwe": "CWE-918",
"name": "Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5775.yaml"
},
"CVE-2020-5776": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "MAGMI - Cross-Site Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5776.yaml"
},
"CVE-2020-5777": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Magento Mass Importer  <0.7.24 - Remote Auth Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5777.yaml"
},
"CVE-2020-5847": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "UnRaid <=6.80 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5847.yaml"
},
"CVE-2020-5902": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "F5 BIG-IP TMUI - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5902.yaml"
},
"CVE-2020-6009": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "critical",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2020/CVE-2020-6009-sfwd_lms-5e29b10e-81d5-4247-bfe8-2400bcd9aef9.yaml"
},
"CVE-2020-6171": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CLink Office 2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6171.yaml"
},
"CVE-2020-6207": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "SAP Solution Manager 7.2 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6207.yaml"
},
"CVE-2020-6287": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6287.yaml"
},
"CVE-2020-6308": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6308.yaml"
},
"CVE-2020-6637": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "OpenSIS 7.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6637.yaml"
},
"CVE-2020-6950": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Eclipse Mojarra - Local File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6950.yaml"
},
"CVE-2020-7048": {
"name": "Wordpress Database Reset",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2020-7048-5228.yaml"
},
"CVE-2020-7107": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7107.yaml"
},
"CVE-2020-7108": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "medium",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2020/CVE-2020-7108-sfwd_lms-07b1efbd-0caf-412d-ac1b-ab1b27c32b8c.yaml"
},
"CVE-2020-7136": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7136.yaml"
},
"CVE-2020-7209": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "LinuxKI Toolset <= 6.01 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7209.yaml"
},
"CVE-2020-7246": {
"name": "qdPM Authenticated Remote Code Execution",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-7246-5240.yaml"
},
"CVE-2020-7247": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-755",
"name": "OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-7247.yaml"
},
"CVE-2020-7318": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7318.yaml"
},
"CVE-2020-7473": {
"name": "Citrix ShareFile StorageZones Unauthenticated Access",
"severity": "hight",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2020-7473-5252.yaml"
},
"CVE-2020-7796": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7796.yaml"
},
"CVE-2020-7943": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Puppet Server/PuppetDB - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7943.yaml"
},
"CVE-2020-7961": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7961.yaml"
},
"CVE-2020-7980": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7980.yaml"
},
"CVE-2020-8091": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "TYPO3 Cross-Site Scripting Vulnerability",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-8091-5269.yaml"
},
"CVE-2020-8115": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Revive Adserver <=5.0.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8115.yaml"
},
"CVE-2020-8163": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Ruby on Rails <5.0.1 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8163.yaml"
},
"CVE-2020-8191": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Citrix ADC/Gateway - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8191.yaml"
},
"CVE-2020-8193": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"name": "Citrix - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8193.yaml"
},
"CVE-2020-8194": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"cwe": "CWE-94",
"name": "Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8194.yaml"
},
"CVE-2020-8209": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Citrix XenMobile Server - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8209.yaml"
},
"CVE-2020-8451": {
"name": "jira ssrf",
"severity": "hight",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2020-8451.yaml"
},
"CVE-2020-8497": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "Artica Pandora FMS <=7.42 - Arbitrary File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8497.yaml"
},
"CVE-2020-8512": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8512.yaml"
},
"CVE-2020-8515": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "DrayTek - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8515.yaml"
},
"CVE-2020-8615": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"cwe": "CWE-352",
"name": "Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8615.yaml"
},
"CVE-2020-8641": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Lotus Core CMS 1.0.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8641.yaml"
},
"CVE-2020-8644": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "playSMS <1.4.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8644.yaml"
},
"CVE-2020-8654": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "EyesOfNetwork 5.1-5.3 - SQL Injection/Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8654.yaml"
},
"CVE-2020-8656": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "EyesOfNetwork - Hardcoded API Key & SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8656.yaml"
},
"CVE-2020-8657": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "EyesOfNetwork - Hardcoded API Key",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8657.yaml"
},
"CVE-2020-8771": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WordPress Time Capsule < 1.21.16 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8771.yaml"
},
"CVE-2020-8772": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "WordPress InfiniteWP <1.9.4.5 - Authorization Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8772.yaml"
},
"CVE-2020-8813": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Cacti v1.2.8 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8813.yaml"
},
"CVE-2020-8982": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8982.yaml"
},
"CVE-2020-9036": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jeedom <=4.0.38 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9036.yaml"
},
"CVE-2020-9039": {
"name": "Couchbase Server - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9039.yaml"
},
"CVE-2020-9043": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "WordPress wpCentral <1.5.1 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9043.yaml"
},
"CVE-2020-9047": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-347",
"name": "exacqVision Web Service - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9047.yaml"
},
"CVE-2020-9054": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Zyxel NAS Firmware 5.21- Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9054.yaml"
},
"CVE-2020-9274": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-824",
"name": "Pure-FTPd \u2264 1.0.49 - DoS via Uninitialized Pointer",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-9274.yaml"
},
"CVE-2020-9314": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Oracle iPlanet Web Server 7.0.x - Image Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9314.yaml"
},
"CVE-2020-9315": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Oracle iPlanet Web Server 7.0.x - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9315.yaml"
},
"CVE-2020-9344": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9344.yaml"
},
"CVE-2020-9365": {
"name": "Pure-FTPd 1.0.24 - Security Vulnerability",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-9365.yaml"
},
"CVE-2020-9376": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-74",
"name": "D-Link DIR-610 Devices - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9376.yaml"
},
"CVE-2020-9402": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Django SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2020/CVE-2020-9402.yaml"
},
"CVE-2020-9425": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-670",
"name": "rConfig <3.9.4 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9425.yaml"
},
"CVE-2020-9480": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Apache Spark - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9480.yaml"
},
"CVE-2020-9483": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "SkyWalking SQLI",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9483.yaml"
},
"CVE-2020-9484": {
"cvss": 7.0,
"cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Tomcat Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9484.yaml"
},
"CVE-2020-9490": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-444",
"name": "Apache HTTP Server 2.4.20-2.4.43 - HTTP/2 Cache-Digest DoS",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2020-9490.yaml"
},
"CVE-2020-9496": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-502",
"name": "Apache OFBiz 17.12.03 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9496.yaml"
},
"CVE-2020-9547": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "FasterXML jackson-databind - Deserialization Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9547.yaml"
},
"CVE-2020-9548": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9548.yaml"
},
"CVE-2020-9757": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Craft CMS < 3.3.0 - Server-Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9757.yaml"
},
"CVE-2021-1472": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Cisco Small Business RV Series - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1472.yaml"
},
"CVE-2021-1497": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Cisco HyperFlex HX Data Platform - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1497.yaml"
},
"CVE-2021-1498": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Cisco HyperFlex HX Data Platform - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1498.yaml"
},
"CVE-2021-1499": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-306",
"name": "Cisco HyperFlex HX Data Platform - Arbitrary File Upload",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1499.yaml"
},
"CVE-2021-20021": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20021.yaml"
},
"CVE-2021-20031": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "SonicWall SonicOS 7.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20031.yaml"
},
"CVE-2021-20038": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20038.yaml"
},
"CVE-2021-20086": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1321",
"name": "Odoo Apps - Cross-Site Scripting via Prototype Pollution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20086.yaml"
},
"CVE-2021-20090": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Buffalo WSR-2533DHPL2 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20090.yaml"
},
"CVE-2021-20091": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Buffalo WSR-2533DHPL2 - Configuration File Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20091.yaml"
},
"CVE-2021-20092": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Buffalo WSR-2533DHPL2 - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20092.yaml"
},
"CVE-2021-20114": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "TCExam <= 14.8.1 - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20114.yaml"
},
"CVE-2021-20123": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Draytek VigorConnect 1.6.0-B - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20123.yaml"
},
"CVE-2021-20124": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Draytek VigorConnect 6.0-B3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20124.yaml"
},
"CVE-2021-20137": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Gryphon Tower - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20137.yaml"
},
"CVE-2021-20150": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "Trendnet AC2600 TEW-827DRU - Credentials Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20150.yaml"
},
"CVE-2021-20158": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20158.yaml"
},
"CVE-2021-20167": {
"cvss": 8.0,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20167.yaml"
},
"CVE-2021-20323": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20323.yaml"
},
"CVE-2021-20617": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Acmailer - Improper Access Control to OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20617.yaml"
},
"CVE-2021-20792": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20792.yaml"
},
"CVE-2021-20837": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "MovableType - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20837.yaml"
},
"CVE-2021-21087": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Adobe ColdFusion - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21087.yaml"
},
"CVE-2021-21234": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Spring Boot Actuator Logview Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21234.yaml"
},
"CVE-2021-21246": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "OneDev < 4.0.3 - User Access Token Leak",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21246.yaml"
},
"CVE-2021-21287": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "MinIO Browser API - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21287.yaml"
},
"CVE-2021-21307": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Lucee Admin - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21307.yaml"
},
"CVE-2021-21311": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Adminer <4.7.9 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21311.yaml"
},
"CVE-2021-21315": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Node.JS System Information Library <5.3.1 - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21315.yaml"
},
"CVE-2021-21345": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"name": "XStream < 1.4.16 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21345.yaml"
},
"CVE-2021-2135": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Oracle WebLogic Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-2135.yaml"
},
"CVE-2021-21351": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "XStream <1.4.16 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21351.yaml"
},
"CVE-2021-21389": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "BuddyPress REST API  <7.2.1 - Privilege Escalation/Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21389.yaml"
},
"CVE-2021-21402": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Jellyfin <10.7.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21402.yaml"
},
"CVE-2021-21479": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-74",
"name": "SCIMono <0.0.19 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21479.yaml"
},
"CVE-2021-21745": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-352",
"name": "ZTE MF971R - Referer authentication bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21745.yaml"
},
"CVE-2021-21799": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advantech R-SeeNet 2.4.12 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21799.yaml"
},
"CVE-2021-21800": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advantech R-SeeNet 2.4.12 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21800.yaml"
},
"CVE-2021-21801": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advantech R-SeeNet - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21801.yaml"
},
"CVE-2021-21802": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advantech R-SeeNet - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21802.yaml"
},
"CVE-2021-21803": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advantech R-SeeNet - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21803.yaml"
},
"CVE-2021-21805": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Advantech R-SeeNet 2.4.12 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21805.yaml"
},
"CVE-2021-21816": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "D-Link DIR-3040 1.13B03 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21816.yaml"
},
"CVE-2021-21881": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21881.yaml"
},
"CVE-2021-21972": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "VMware vSphere Client (HTML5) - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21972.yaml"
},
"CVE-2021-21973": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "VMware vSphere - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21973.yaml"
},
"CVE-2021-21975": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "vRealize Operations Manager API - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21975.yaml"
},
"CVE-2021-21978": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "VMware View Planner <4.6 SP1- Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21978.yaml"
},
"CVE-2021-21985": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "VMware vSphere Client (HTML5) - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21985.yaml"
},
"CVE-2021-22005": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "VMware vCenter Server - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22005.yaml"
},
"CVE-2021-22017": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "vCenter Server - Improper Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22017.yaml"
},
"CVE-2021-22053": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22053.yaml"
},
"CVE-2021-22054": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "VMWare Workspace ONE UEM - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22054.yaml"
},
"CVE-2021-22122": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FortiWeb - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22122.yaml"
},
"CVE-2021-22123": {
"name": "FortiWeb - OS command injection (Authenticated)",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2021-22123.yaml"
},
"CVE-2021-22145": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-209",
"name": "Elasticsearch 7.10.0-7.13.3 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22145.yaml"
},
"CVE-2021-22175": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "GitLab CI Lint API - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22175.yaml"
},
"CVE-2021-22205": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "GitLab CE/EE - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22205.yaml"
},
"CVE-2021-22214": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Gitlab CE/EE 10.5 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22214.yaml"
},
"CVE-2021-22502": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Micro Focus Operations Bridge Reporter - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22502.yaml"
},
"CVE-2021-22707": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "EVlink City < R8 V3.4.0.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22707.yaml"
},
"CVE-2021-22873": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Revive Adserver <5.1.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22873.yaml"
},
"CVE-2021-22881": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Ruby on Rails - Open Redirect via Host Header Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22881.yaml"
},
"CVE-2021-22911": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Rocket.Chat <=3.13 - NoSQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22911.yaml"
},
"CVE-2021-22986": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "F5 iControl REST - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22986.yaml"
},
"CVE-2021-23241": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23241.yaml"
},
"CVE-2021-23337": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Lodash Template - Server-Side Template Injection (RCE)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23337.yaml"
},
"CVE-2021-23394": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "elFinder < 2.1.58 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23394.yaml"
},
"CVE-2021-24139": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "10Web Photo Gallery < 1.5.55 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24139.yaml"
},
"CVE-2021-24145": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24145.yaml"
},
"CVE-2021-24146": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"name": "WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24146.yaml"
},
"CVE-2021-24150": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24150.yaml"
},
"CVE-2021-24155": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24155.yaml"
},
"CVE-2021-24165": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Ninja Forms <3.4.34 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24165.yaml"
},
"CVE-2021-24169": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24169.yaml"
},
"CVE-2021-24170": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "User Profile Picture < 2.5.0 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24170.yaml"
},
"CVE-2021-24176": {
"name": "WordPress JH 404 Logger XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2021-24176-5633.yaml"
},
"CVE-2021-24210": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress PhastPress <1.111 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24210.yaml"
},
"CVE-2021-24212": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WooCommerce Help Scout - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24212.yaml"
},
"CVE-2021-24213": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "GiveWP <= 2.9.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24213.yaml"
},
"CVE-2021-24214": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24214.yaml"
},
"CVE-2021-24215": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24215.yaml"
},
"CVE-2021-24219": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": "All Thrive Themes and Plugins - Unauthenticated Option Update",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24219.yaml"
},
"CVE-2021-24220": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-434",
"name": "Multiple Thrive Themes < 2.0.0 -  Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24220.yaml"
},
"CVE-2021-24226": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "AccessAlly <3.5.7 - Sensitive Information Leakage",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24226.yaml"
},
"CVE-2021-24227": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Patreon WordPress  <1.7.0 - Unauthenticated Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24227.yaml"
},
"CVE-2021-24235": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24235.yaml"
},
"CVE-2021-24236": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Imagements <=1.2.5 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24236.yaml"
},
"CVE-2021-24237": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Realteo <=1.2.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24237.yaml"
},
"CVE-2021-24239": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Pie Register <3.7.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24239.yaml"
},
"CVE-2021-24245": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Stop Spammers <2021.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24245.yaml"
},
"CVE-2021-24274": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24274.yaml"
},
"CVE-2021-24275": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Popup by Supsystic <1.10.5 - Cross-Site scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24275.yaml"
},
"CVE-2021-24276": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24276.yaml"
},
"CVE-2021-24278": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24278.yaml"
},
"CVE-2021-24284": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24284.yaml"
},
"CVE-2021-24285": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Car Seller - Auto Classifieds Script - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24285.yaml"
},
"CVE-2021-24286": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24286.yaml"
},
"CVE-2021-24287": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24287.yaml"
},
"CVE-2021-24288": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress AcyMailing <7.5.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24288.yaml"
},
"CVE-2021-24291": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24291.yaml"
},
"CVE-2021-24295": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24295.yaml"
},
"CVE-2021-24298": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24298.yaml"
},
"CVE-2021-24300": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WooCommerce <1.13.22 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24300.yaml"
},
"CVE-2021-24316": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24316.yaml"
},
"CVE-2021-24320": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24320.yaml"
},
"CVE-2021-24335": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24335.yaml"
},
"CVE-2021-24340": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress Statistics <13.0.8 - Blind SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24340.yaml"
},
"CVE-2021-24342": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress JNews Theme <8.0.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24342.yaml"
},
"CVE-2021-24347": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-178",
"name": "WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24347.yaml"
},
"CVE-2021-24351": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24351.yaml"
},
"CVE-2021-24358": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24358.yaml"
},
"CVE-2021-24364": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Jannah Theme <5.4.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24364.yaml"
},
"CVE-2021-24370": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24370.yaml"
},
"CVE-2021-24387": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24387.yaml"
},
"CVE-2021-24389": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress FoodBakery <2.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24389.yaml"
},
"CVE-2021-24406": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress wpForo Forum < 1.9.7 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24406.yaml"
},
"CVE-2021-24407": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Jannah Theme <5.4.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24407.yaml"
},
"CVE-2021-24409": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Prismatic < 2.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24409.yaml"
},
"CVE-2021-24435": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24435.yaml"
},
"CVE-2021-24436": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24436.yaml"
},
"CVE-2021-24442": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Wordpress Polls Widget < 1.5.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24442.yaml"
},
"CVE-2021-24452": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24452.yaml"
},
"CVE-2021-24472": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24472.yaml"
},
"CVE-2021-24488": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Post Grid <2.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24488.yaml"
},
"CVE-2021-24495": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24495.yaml"
},
"CVE-2021-24498": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24498.yaml"
},
"CVE-2021-24499": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Workreap - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24499.yaml"
},
"CVE-2021-24510": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24510.yaml"
},
"CVE-2021-24522": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ProfilePress < 3.1.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24522.yaml"
},
"CVE-2021-24527": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Profile Builder < 3.4.9 - Improper Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24527.yaml"
},
"CVE-2021-24554": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24554.yaml"
},
"CVE-2021-24627": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "G Auto-Hyperlink <= 1.0.1 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24627.yaml"
},
"CVE-2021-24644": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Images to WebP < 1.9 - Authenticated Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24644.yaml"
},
"CVE-2021-24647": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24647.yaml"
},
"CVE-2021-24657": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Limit Login Attempts WordPress - Stored Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24657.yaml"
},
"CVE-2021-24666": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24666.yaml"
},
"CVE-2021-24681": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Duplicate Page WordPress - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24681.yaml"
},
"CVE-2021-24731": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Pie Register < 3.7.1.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24731.yaml"
},
"CVE-2021-24746": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24746.yaml"
},
"CVE-2021-24750": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24750.yaml"
},
"CVE-2021-24762": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Perfect Survey <1.5.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24762.yaml"
},
"CVE-2021-24786": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Download Monitor < 4.4.5 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24786.yaml"
},
"CVE-2021-24791": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24791.yaml"
},
"CVE-2021-24827": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Asgaros Forum <1.15.13 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24827.yaml"
},
"CVE-2021-24838": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress AnyComment <0.3.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24838.yaml"
},
"CVE-2021-24849": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24849.yaml"
},
"CVE-2021-24862": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24862.yaml"
},
"CVE-2021-24875": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24875.yaml"
},
"CVE-2021-24876": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24876.yaml"
},
"CVE-2021-24878": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SupportCandy < 2.2.7 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24878.yaml"
},
"CVE-2021-24891": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24891.yaml"
},
"CVE-2021-24910": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Transposh Translation <1.0.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24910.yaml"
},
"CVE-2021-24915": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Contest Gallery < 13.1.0.6 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24915.yaml"
},
"CVE-2021-24916": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-284",
"name": "WordPress Qubely < 1.8.6 - Unauthenticated Email Sending",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24916.yaml"
},
"CVE-2021-24917": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "WordPress WPS Hide Login <1.9.1 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24917.yaml"
},
"CVE-2021-24926": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Domain Check <1.0.17 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24926.yaml"
},
"CVE-2021-24931": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24931.yaml"
},
"CVE-2021-24934": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24934.yaml"
},
"CVE-2021-24940": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24940.yaml"
},
"CVE-2021-24943": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Registrations for the Events Calendar < 2.7.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24943.yaml"
},
"CVE-2021-24946": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24946.yaml"
},
"CVE-2021-24947": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"name": "WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24947.yaml"
},
"CVE-2021-24956": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Blog2Social < 6.8.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24956.yaml"
},
"CVE-2021-24970": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24970.yaml"
},
"CVE-2021-24979": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Paid Memberships Pro < 2.6.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24979.yaml"
},
"CVE-2021-24987": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Super Socializer <7.13.30 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24987.yaml"
},
"CVE-2021-24991": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24991.yaml"
},
"CVE-2021-24997": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-862",
"name": "WordPress Guppy <=1.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24997.yaml"
},
"CVE-2021-25003": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25003.yaml"
},
"CVE-2021-25008": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25008.yaml"
},
"CVE-2021-25016": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Chaty < 2.8.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25016.yaml"
},
"CVE-2021-25028": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Event Tickets < 5.2.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25028.yaml"
},
"CVE-2021-25032": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "PublishPress Capabilities < 2.3.1 - Missing Authorization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25032.yaml"
},
"CVE-2021-25033": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Noptin < 1.6.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25033.yaml"
},
"CVE-2021-25052": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "WordPress Button Generator <2.3.3 - Remote File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25052.yaml"
},
"CVE-2021-25055": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25055.yaml"
},
"CVE-2021-25063": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25063.yaml"
},
"CVE-2021-25065": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25065.yaml"
},
"CVE-2021-25067": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Landing Page Builder < 1.4.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25067.yaml"
},
"CVE-2021-25074": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25074.yaml"
},
"CVE-2021-25075": {
"cvss": 3.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25075.yaml"
},
"CVE-2021-25078": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Affiliates Manager < 2.9.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25078.yaml"
},
"CVE-2021-25079": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contact Form Entries < 1.2.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25079.yaml"
},
"CVE-2021-25082": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WordPress Popup Builder < 4.0.7 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25082.yaml"
},
"CVE-2021-25085": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WOOF WordPress plugin - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25085.yaml"
},
"CVE-2021-25094": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25094.yaml"
},
"CVE-2021-25099": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress GiveWP <2.17.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25099.yaml"
},
"CVE-2021-25104": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Ocean Extra <1.9.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25104.yaml"
},
"CVE-2021-25111": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress English Admin <1.5.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25111.yaml"
},
"CVE-2021-25112": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WHMCS Bridge <6.4b - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25112.yaml"
},
"CVE-2021-25114": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25114.yaml"
},
"CVE-2021-25118": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Yoast SEO 16.7-17.2 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25118.yaml"
},
"CVE-2021-25120": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Easy Social Feed < 6.2.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25120.yaml"
},
"CVE-2021-25161": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Aruba Instant Access Point (IAP) - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25161.yaml"
},
"CVE-2021-25281": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "SaltStack Salt <3002.5 - Auth Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25281.yaml"
},
"CVE-2021-25282": {
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2021-25282.yaml"
},
"CVE-2021-25296": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25296.yaml"
},
"CVE-2021-25297": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25297.yaml"
},
"CVE-2021-25298": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25298.yaml"
},
"CVE-2021-25299": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Nagios XI 5.7.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25299.yaml"
},
"CVE-2021-25646": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-732",
"name": "Apache Druid - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25646.yaml"
},
"CVE-2021-25864": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Hue Magic 3.0.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25864.yaml"
},
"CVE-2021-25899": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Void Aural Rec Monitor 9.0.0.1 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25899.yaml"
},
"CVE-2021-26072": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Atlassian Confluence < 5.8.6 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26072.yaml"
},
"CVE-2021-26084": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "Confluence Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26084.yaml"
},
"CVE-2021-26085": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-425",
"name": "Atlassian Confluence Server - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26085.yaml"
},
"CVE-2021-26086": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Atlassian Jira Limited - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26086.yaml"
},
"CVE-2021-26119": {
"name": "Tiki Wiki chained RCE",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2021-26119.yaml"
},
"CVE-2021-26247": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cacti - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26247.yaml"
},
"CVE-2021-26292": {
"name": "AfterLogic Aurora and WebMail Pro < 7.7.9 - Full Path Disclosure",
"severity": "low",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2021-26292.yaml"
},
"CVE-2021-26294": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26294.yaml"
},
"CVE-2021-26295": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache OFBiz <17.12.06 - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yaml"
},
"CVE-2021-26475": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "EPrints 3.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26475.yaml"
},
"CVE-2021-26598": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-287",
"name": "ImpressCMS <1.4.3 - Incorrect Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26598.yaml"
},
"CVE-2021-26599": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ImpressCMS < 1.4.3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26599.yaml"
},
"CVE-2021-26702": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "EPrints 3.4.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26702.yaml"
},
"CVE-2021-26710": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26710.yaml"
},
"CVE-2021-26722": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LinkedIn Oncall 1.4.0 XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2021-26722-5874.yaml"
},
"CVE-2021-26723": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Jenzabar 9.2x-9.2.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26723.yaml"
},
"CVE-2021-26812": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26812.yaml"
},
"CVE-2021-26855": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "Microsoft Exchange Server SSRF Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml"
},
"CVE-2021-26947": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Odoo <= 15.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26947.yaml"
},
"CVE-2021-27124": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Doctor Appointment System 1.0 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27124.yaml"
},
"CVE-2021-27132": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Sercomm VD625 Smart Modems - CRLF Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27132.yaml"
},
"CVE-2021-27250": {
"name": "D-LINK DAP-2020 webproc \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2021-27250.yaml"
},
"CVE-2021-27309": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Clansphere CMS 2011.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27309.yaml"
},
"CVE-2021-27310": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Clansphere CMS 2011.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27310.yaml"
},
"CVE-2021-27314": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Doctor Appointment System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27314.yaml"
},
"CVE-2021-27315": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Doctor Appointment System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27315.yaml"
},
"CVE-2021-27316": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Doctor Appointment System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27316.yaml"
},
"CVE-2021-27319": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Doctor Appointment System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27319.yaml"
},
"CVE-2021-27320": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Doctor Appointment System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27320.yaml"
},
"CVE-2021-27330": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27330.yaml"
},
"CVE-2021-27358": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-306",
"name": "Grafana Unauthenticated Snapshot Creation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27358.yaml"
},
"CVE-2021-27519": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FUDForum 3.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27519.yaml"
},
"CVE-2021-27520": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FUDForum 3.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27520.yaml"
},
"CVE-2021-27561": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "YeaLink DM 3.6.0.20 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27561.yaml"
},
"CVE-2021-27648": {
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2021-27648.yaml"
},
"CVE-2021-27651": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Pega Infinity - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27651.yaml"
},
"CVE-2021-27670": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Appspace 6.2.4 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27670.yaml"
},
"CVE-2021-27748": {
"name": "IBM WebSphere HCL Digital Experience - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2021-27748.yaml"
},
"CVE-2021-27850": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Tapestry - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27850.yaml"
},
"CVE-2021-27856": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "FatPipe WARP/IPVPN/MPVPN - Backdoor Account",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27856.yaml"
},
"CVE-2021-27858": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "FatPipe WARP/IPVPN/MPVPN - Authorization Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27858.yaml"
},
"CVE-2021-27877": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"name": "Veritas Backup Exec - Broken Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-27877.yaml"
},
"CVE-2021-27905": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Apache Solr <=8.8.1 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27905.yaml"
},
"CVE-2021-27909": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Mautic <3.3.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27909.yaml"
},
"CVE-2021-27931": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-611",
"name": "LumisXP <10.0.0 - Blind XML External Entity Attack",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27931.yaml"
},
"CVE-2021-27964": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "SonLogger - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27964.yaml"
},
"CVE-2021-28073": {
"name": "Ntopng Authentication Bypass",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/cve-2021-28073-5939.yaml"
},
"CVE-2021-28149": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Hongdian H8922 3.0.5 Devices - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28149.yaml"
},
"CVE-2021-28150": {
"cvss": 5.5,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "Hongdian H8922 3.0.5 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28150.yaml"
},
"CVE-2021-28151": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Hongdian H8922 3.0.5 - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28151.yaml"
},
"CVE-2021-28164": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Eclipse Jetty - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28164.yaml"
},
"CVE-2021-28169": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Eclipse Jetty ConcatServlet - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28169.yaml"
},
"CVE-2021-28377": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Joomla! ChronoForums 2.0.11 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28377.yaml"
},
"CVE-2021-28419": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SEO Panel 4.8.0 - 'order_col' Blind SQL Injection",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2021-28419.yaml"
},
"CVE-2021-28480": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28480.yaml"
},
"CVE-2021-28481": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28481.yaml"
},
"CVE-2021-28799": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-285",
"name": "QNAP HBS 3 - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28799.yaml"
},
"CVE-2021-28854": {
"name": "VICIdial - Multiple sensitive Information disclosure",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2021-28854-5969.yaml"
},
"CVE-2021-28918": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-704",
"name": "Netmask NPM Package - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28918.yaml"
},
"CVE-2021-28937": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-312",
"name": "Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28937.yaml"
},
"CVE-2021-29006": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "rConfig 3.9.6 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29006.yaml"
},
"CVE-2021-29115": {
"name": "CVE-2021-29115 Spring Expression Language RCE",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2021-29115.yaml"
},
"CVE-2021-29156": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-74",
"name": "LDAP Injection In OpenAM",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29156.yaml"
},
"CVE-2021-29200": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache OFBiz < 17.12.07 - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29200.yaml"
},
"CVE-2021-29203": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29203.yaml"
},
"CVE-2021-29441": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-290",
"name": "Nacos <1.4.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29441.yaml"
},
"CVE-2021-29442": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Nacos <1.4.1 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29442.yaml"
},
"CVE-2021-29484": {
"cvss": 6.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "Ghost CMS <=4.32 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29484.yaml"
},
"CVE-2021-29490": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Jellyfin 10.7.2 - Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29490.yaml"
},
"CVE-2021-29505": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "XStream <1.4.17 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29505.yaml"
},
"CVE-2021-29622": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Prometheus - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29622.yaml"
},
"CVE-2021-29625": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Adminer <=4.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29625.yaml"
},
"CVE-2021-3002": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Seo Panel 4.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3002.yaml"
},
"CVE-2021-30047": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "vsftpd < 3.0.3 - DoS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-30047.yaml"
},
"CVE-2021-30049": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SysAid Technologies 20.3.64 b14 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30049.yaml"
},
"CVE-2021-3007": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Laminas Project laminas-http - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3007.yaml"
},
"CVE-2021-30116": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-522",
"name": "Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30116.yaml"
},
"CVE-2021-30118": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30118.yaml"
},
"CVE-2021-30128": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache OFBiz <17.12.07 - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30128.yaml"
},
"CVE-2021-30134": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Php-mod/curl Library <2.3.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30134.yaml"
},
"CVE-2021-30151": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sidekiq <=6.2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30151.yaml"
},
"CVE-2021-3017": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Intelbras WIN 300/WRN 342 - Credentials Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3017.yaml"
},
"CVE-2021-30175": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ZEROF Web Server 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30175.yaml"
},
"CVE-2021-3018": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "IPeakCMS 3.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3018.yaml"
},
"CVE-2021-3019": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ffay lanproxy Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3019.yaml"
},
"CVE-2021-30203": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Dzzoffice 2.02.1 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30203.yaml"
},
"CVE-2021-30213": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Knowage Suite 7.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30213.yaml"
},
"CVE-2021-30461": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "VoipMonitor <24.61 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30461.yaml"
},
"CVE-2021-30497": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Ivanti Avalanche 6.3.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30497.yaml"
},
"CVE-2021-3064": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-121",
"name": "PAN-OS - Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2021-3064.yaml"
},
"CVE-2021-3110": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop 1.7.7.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3110.yaml"
},
"CVE-2021-31195": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-79",
"name": "Microsoft Exchange Server - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31195.yaml"
},
"CVE-2021-3122": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "NCR Command Center Agent 16.3 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-3122.yaml"
},
"CVE-2021-31249": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-74",
"name": "CHIYU TCP/IP Converter - Carriage Return Line Feed Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31249.yaml"
},
"CVE-2021-31250": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CHIYU TCP/IP Converter - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31250.yaml"
},
"CVE-2021-3129": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3129.yaml"
},
"CVE-2021-31316": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "CentOS Web Panel - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31316.yaml"
},
"CVE-2021-31324": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "CentOS Web Panel - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31324.yaml"
},
"CVE-2021-3152": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Home Assistant HACS - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3152.yaml"
},
"CVE-2021-31537": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31537.yaml"
},
"CVE-2021-3156": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-193",
"name": "Sudo Baron Samedit - Local Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2021/CVE-2021-3156.yaml"
},
"CVE-2021-31581": {
"cvss": 4.4,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"name": "Akkadian Provisioning Manager - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31581.yaml"
},
"CVE-2021-31589": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31589.yaml"
},
"CVE-2021-31602": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31602.yaml"
},
"CVE-2021-31682": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WebCTRL OEM <= 6.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31682.yaml"
},
"CVE-2021-31755": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-787",
"name": "Tenda Router AC11 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31755.yaml"
},
"CVE-2021-31800": {
"name": "Impacket directory traversal",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2021-31800.yaml"
},
"CVE-2021-31805": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "Apache Struts2 S2-062 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31805.yaml"
},
"CVE-2021-31856": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Layer5 Meshery 0.5.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31856.yaml"
},
"CVE-2021-31862": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SysAid 20.4.74 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31862.yaml"
},
"CVE-2021-32030": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "ASUS GT-AC2900 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32030.yaml"
},
"CVE-2021-32172": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Maian Cart <=3.8 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32172.yaml"
},
"CVE-2021-3223": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Node RED Dashboard <2.26.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3223.yaml"
},
"CVE-2021-32305": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Websvn <2.6.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32305.yaml"
},
"CVE-2021-3239": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "E-Learning System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3239.yaml"
},
"CVE-2021-32478": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32478.yaml"
},
"CVE-2021-32618": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Python Flask-Security - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32618.yaml"
},
"CVE-2021-32648": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"name": "OctoberCMS - Account Takeover",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32648.yaml"
},
"CVE-2021-32682": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "elFinder 2.1.58 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32682.yaml"
},
"CVE-2021-32789": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32789.yaml"
},
"CVE-2021-32819": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"name": "Nodejs Squirrelly - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32819.yaml"
},
"CVE-2021-32820": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"name": "Express-handlebars - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32820.yaml"
},
"CVE-2021-32853": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "Erxes <0.23.0 - Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32853.yaml"
},
"CVE-2021-3287": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Zoho ManageEngine OpManager < 12.5.329 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3287.yaml"
},
"CVE-2021-3293": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "emlog 5.3.1 Path Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3293.yaml"
},
"CVE-2021-3297": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3297.yaml"
},
"CVE-2021-33044": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Dahua IPC/VTH/VTO - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33044.yaml"
},
"CVE-2021-33045": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Dahua IPC/VTH/VTO - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33045.yaml"
},
"CVE-2021-33221": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "CommScope Ruckus IoT Controller - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33221.yaml"
},
"CVE-2021-33357": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "RaspAP <=2.6.5 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33357.yaml"
},
"CVE-2021-33544": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Geutebruck - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33544.yaml"
},
"CVE-2021-33558": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Boa 0.94.13 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33558.yaml"
},
"CVE-2021-33564": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-88",
"name": "Ruby Dragonfly <1.4.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33564.yaml"
},
"CVE-2021-33690": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "SAP NetWeaver Development Infrastructure - Server Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33690.yaml"
},
"CVE-2021-3374": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Rstudio Shiny Server <1.5.16 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3374.yaml"
},
"CVE-2021-33766": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"name": "Microsoft Exchange - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33766.yaml"
},
"CVE-2021-3377": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "npm ansi_up v4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3377.yaml"
},
"CVE-2021-3378": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "FortiLogger 4.4.2.2 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3378.yaml"
},
"CVE-2021-33807": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Cartadis Gespage 8.2.1 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33807.yaml"
},
"CVE-2021-33829": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Drupal 7 CKEditor XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33829.yaml"
},
"CVE-2021-33851": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Customize Login Image <3.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33851.yaml"
},
"CVE-2021-33904": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Accela Civic Platform <=21.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33904.yaml"
},
"CVE-2021-34187": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Chamilo model.ajax.php - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34187.yaml"
},
"CVE-2021-34370": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Accela Civic Platform <=21.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34370.yaml"
},
"CVE-2021-34427": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Eclipse BIRT Viewer - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34427.yaml"
},
"CVE-2021-34429": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Eclipse Jetty - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34429.yaml"
},
"CVE-2021-34473": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "Exchange Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml"
},
"CVE-2021-34621": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress ProfilePress  3.0.0-3.1.3 - Admin User Creation Weakness",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34621.yaml"
},
"CVE-2021-34622": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "WordPress ProfilePress <= 3.1.3 - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34622.yaml"
},
"CVE-2021-34624": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34624.yaml"
},
"CVE-2021-34630": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "GTranslate < 2.8.65 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34630.yaml"
},
"CVE-2021-34640": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34640.yaml"
},
"CVE-2021-34643": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34643.yaml"
},
"CVE-2021-34805": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "FAUST iServer 9.0.018.018.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34805.yaml"
},
"CVE-2021-35042": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Django QuerySet.order_by - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2021/CVE-2021-35042.yaml"
},
"CVE-2021-35064": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Kramer VIAware - Privilege Escalation and Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35064.yaml"
},
"CVE-2021-35211": {
"name": "SolarWinds Serv-U FTP - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35211.yaml"
},
"CVE-2021-35250": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SolarWinds Serv-U 15.3 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35250.yaml"
},
"CVE-2021-35265": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MaxSite CMS > V106 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35265.yaml"
},
"CVE-2021-35323": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Bludit 3.13.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35323.yaml"
},
"CVE-2021-35336": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1188",
"name": "Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35336.yaml"
},
"CVE-2021-35380": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "TermTalk Server 3.24.0.2 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35380.yaml"
},
"CVE-2021-35394": {
"name": "RealTek AP Router SDK - Arbitrary Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35394.yaml"
},
"CVE-2021-35395": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "RealTek Jungle SDK - Arbitrary Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35395.yaml"
},
"CVE-2021-35464": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "ForgeRock OpenAM <7.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35464.yaml"
},
"CVE-2021-35488": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Thruk 2.40-2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35488.yaml"
},
"CVE-2021-35587": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Oracle Access Manager - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35587.yaml"
},
"CVE-2021-3577": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Motorola Baby Monitors - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3577.yaml"
},
"CVE-2021-36260": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Hikvision IP camera/NVR - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36260.yaml"
},
"CVE-2021-36356": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Kramer VIAware - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36356.yaml"
},
"CVE-2021-36380": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36380.yaml"
},
"CVE-2021-36450": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36450.yaml"
},
"CVE-2021-3654": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Nova noVNC - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3654.yaml"
},
"CVE-2021-36580": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "IceWarp Mail Server - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36580.yaml"
},
"CVE-2021-36646": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "KodExplorer - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36646.yaml"
},
"CVE-2021-36748": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36748.yaml"
},
"CVE-2021-36749": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "Apache Druid - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36749.yaml"
},
"CVE-2021-36754": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-119",
"name": "PowerDNS Authoritative Server - Denial of Service",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-36754.yaml"
},
"CVE-2021-36873": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36873.yaml"
},
"CVE-2021-36888": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "WordPress Image Hover Ultimate - Unauthenticated Settings Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36888.yaml"
},
"CVE-2021-37216": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "QSAN Storage Manager <3.3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37216.yaml"
},
"CVE-2021-37291": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "KevinLAB BEMS 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37291.yaml"
},
"CVE-2021-37292": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"name": "KevinLAB BEMS (Building Energy Management System) - Backdoor Account",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37292.yaml"
},
"CVE-2021-37304": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-732",
"name": "Jeecg Boot <= 2.4.5 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37304.yaml"
},
"CVE-2021-37305": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-732",
"name": "Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37305.yaml"
},
"CVE-2021-37415": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Zoho ManageEngine ServiceDesk Plus - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37415.yaml"
},
"CVE-2021-37416": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37416.yaml"
},
"CVE-2021-37538": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop SmartBlog <4.0.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37538.yaml"
},
"CVE-2021-37573": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Tiny Java Web Server - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37573.yaml"
},
"CVE-2021-37580": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Apache ShenYu Admin JWT - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37580.yaml"
},
"CVE-2021-37589": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Virtua Software Cobranca <12R - Blind SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37589.yaml"
},
"CVE-2021-37598": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-863",
"name": "WP Cerber < 8.9.3 - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37598.yaml"
},
"CVE-2021-37704": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"name": "phpfastcache - phpinfo Resource Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37704.yaml"
},
"CVE-2021-37833": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Hotel Druid 3.0.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37833.yaml"
},
"CVE-2021-37859": {
"name": "Mattermost XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2021-37859.yaml"
},
"CVE-2021-38146": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38146.yaml"
},
"CVE-2021-38147": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Wipro Holmes Orchestrator 20.4.1 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38147.yaml"
},
"CVE-2021-38154": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-732",
"name": "Canon Devices - Authentication Bypass in Catwalk Server",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38154.yaml"
},
"CVE-2021-38156": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Nagios XI < 5.8.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38156.yaml"
},
"CVE-2021-3831": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-80",
"name": "Gnuboard 5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3831.yaml"
},
"CVE-2021-38314": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "WordPress Redux Framework <=4.2.11 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38314.yaml"
},
"CVE-2021-38540": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Airflow - Unauthenticated Variable Import",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38540.yaml"
},
"CVE-2021-38647": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Microsoft Open Management Infrastructure - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38647.yaml"
},
"CVE-2021-38702": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cyberoam NetGenie Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38702.yaml"
},
"CVE-2021-38704": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ClinicCases 7.3.3 Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38704.yaml"
},
"CVE-2021-38751": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-116",
"name": "ExponentCMS <= 2.6 - Host Header Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38751.yaml"
},
"CVE-2021-39141": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "XStream 1.4.18 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39141.yaml"
},
"CVE-2021-39144": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"name": "XStream 1.4.18 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39144.yaml"
},
"CVE-2021-39146": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "XStream 1.4.18 - Arbitrary Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39146.yaml"
},
"CVE-2021-39152": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "XStream <1.4.18 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39152.yaml"
},
"CVE-2021-39165": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Cachet <=2.3.18 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39165.yaml"
},
"CVE-2021-39211": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "GLPI 9.2/<9.5.6 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39211.yaml"
},
"CVE-2021-39226": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-287",
"name": "Grafana Snapshot - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39226.yaml"
},
"CVE-2021-39312": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress True Ranker <2.2.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39312.yaml"
},
"CVE-2021-39316": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress DZS Zoomsounds <=6.50 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39316.yaml"
},
"CVE-2021-39320": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Under Construction <1.19 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39320.yaml"
},
"CVE-2021-39322": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39322.yaml"
},
"CVE-2021-39327": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "WordPress BulletProof Security 5.1 Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39327.yaml"
},
"CVE-2021-39341": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"name": "OptinMonster Plugin < 2.6.5 - Unprotected REST-API",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39341.yaml"
},
"CVE-2021-39350": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39350.yaml"
},
"CVE-2021-39411": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Hospital Management System 1.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39411.yaml"
},
"CVE-2021-39433": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "BIQS IT Biqs-drive v1.83 Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39433.yaml"
},
"CVE-2021-39501": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "EyouCMS 1.5.4 Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39501.yaml"
},
"CVE-2021-40149": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40149.yaml"
},
"CVE-2021-40150": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40150.yaml"
},
"CVE-2021-40247": {
"name": "Budget and Expense Tracker System  SQL\u6ce8\u5165 - \u7ed5\u8fc7B&E Tracker\u767b\u5f55CVE-2021-40247",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2021-40247.yaml"
},
"CVE-2021-40272": {
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IRTS OP5 Monitor - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40272.yaml"
},
"CVE-2021-40323": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Cobbler <3.3.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40323.yaml"
},
"CVE-2021-40438": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40438.yaml"
},
"CVE-2021-4045": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "TP-Link Tapo c200 1.1.15 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2021-4045.yaml"
},
"CVE-2021-40524": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-434",
"name": "Pure-FTPd 1.0.23 < 1.0.50 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-40524.yaml"
},
"CVE-2021-40539": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-706",
"name": "Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40539.yaml"
},
"CVE-2021-40542": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Opensis-Classic 8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40542.yaml"
},
"CVE-2021-40651": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "OS4Ed OpenSIS Community 8.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40651.yaml"
},
"CVE-2021-40655": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "D-Link DIR-605 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40655.yaml"
},
"CVE-2021-40661": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "IND780 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40661.yaml"
},
"CVE-2021-4073": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "RegistrationMagic <= 5.0.1.7 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4073.yaml"
},
"CVE-2021-40822": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Geoserver - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40822.yaml"
},
"CVE-2021-40856": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-706",
"name": "Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40856.yaml"
},
"CVE-2021-40859": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40859.yaml"
},
"CVE-2021-40868": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cloudron 6.2 Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40868.yaml"
},
"CVE-2021-40870": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-23",
"name": "Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40870.yaml"
},
"CVE-2021-40875": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "Gurock TestRail Application files.md5 Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40875.yaml"
},
"CVE-2021-40908": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Purchase Order Management v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2021-40908.yaml"
},
"CVE-2021-40960": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Galera WebTemplate 1.0 Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40960.yaml"
},
"CVE-2021-40968": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40968.yaml"
},
"CVE-2021-40969": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40969.yaml"
},
"CVE-2021-40970": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40970.yaml"
},
"CVE-2021-40971": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40971.yaml"
},
"CVE-2021-40972": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40972.yaml"
},
"CVE-2021-40973": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40973.yaml"
},
"CVE-2021-40978": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "MKdocs 1.2.2 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40978.yaml"
},
"CVE-2021-41097": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cwe": "CWE-1321",
"name": "Aurelia-Path < 1.1.7 - Prototype Pollution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41097.yaml"
},
"CVE-2021-41174": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41174.yaml"
},
"CVE-2021-41192": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-1188",
"name": "Redash Setup Configuration - Default Secrets Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41192.yaml"
},
"CVE-2021-41266": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "MinIO Operator Console Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41266.yaml"
},
"CVE-2021-41277": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Metabase - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41277.yaml"
},
"CVE-2021-41282": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "pfSense - Arbitrary File Write",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41282.yaml"
},
"CVE-2021-41291": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ECOA Building Automation System - Directory Traversal Content Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41291.yaml"
},
"CVE-2021-41293": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ECOA Building Automation System - Arbitrary File Retrieval",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41293.yaml"
},
"CVE-2021-41349": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"name": "Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41349.yaml"
},
"CVE-2021-41381": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Payara Micro Community 5.2021.6 Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41381.yaml"
},
"CVE-2021-41419": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "QVIS NVR/DVR - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41419.yaml"
},
"CVE-2021-41432": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FlatPress 1.2.1 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41432.yaml"
},
"CVE-2021-41460": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "ECShop 4.1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41460.yaml"
},
"CVE-2021-41467": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "JustWriting - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41467.yaml"
},
"CVE-2021-41569": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-829",
"name": "SAS/Internet 9.4 1520 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41569.yaml"
},
"CVE-2021-41648": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "PuneethReddyHC action.php SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41648.yaml"
},
"CVE-2021-41649": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PuneethReddyHC Online Shopping System homeaction.php SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41649.yaml"
},
"CVE-2021-41653": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "TP-Link - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41653.yaml"
},
"CVE-2021-41691": {
"name": "openSIS Student Information System 8.0 SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41691.yaml"
},
"CVE-2021-41749": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "CraftCMS SEOmatic - Server-Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41749.yaml"
},
"CVE-2021-41773": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Apache 2.4.49 - Path Traversal and Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml"
},
"CVE-2021-41826": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "PlaceOS 1.2109.1 - Open Redirection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41826.yaml"
},
"CVE-2021-41878": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "i-Panel Administration System 2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41878.yaml"
},
"CVE-2021-4191": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-287",
"name": "GitLab GraphQL API User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4191.yaml"
},
"CVE-2021-41951": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Resourcespace - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41951.yaml"
},
"CVE-2021-42013": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42013.yaml"
},
"CVE-2021-42063": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42063.yaml"
},
"CVE-2021-42071": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42071.yaml"
},
"CVE-2021-42192": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "KONGA 0.14.9 - Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42192.yaml"
},
"CVE-2021-42237": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Sitecore Experience Platform Pre-Auth RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42237.yaml"
},
"CVE-2021-42258": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "BillQuick Web Suite SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42258.yaml"
},
"CVE-2021-42359": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42359.yaml"
},
"CVE-2021-42392": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "H2 Database Console - JNDI Injection RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42392.yaml"
},
"CVE-2021-42551": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NetBiblio WebOPAC - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42551.yaml"
},
"CVE-2021-42565": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "myfactory FMS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42565.yaml"
},
"CVE-2021-42566": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "myfactory FMS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42566.yaml"
},
"CVE-2021-42567": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apereo CAS Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42567.yaml"
},
"CVE-2021-42627": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "D-Link DIR-615 - Unauthorized Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42627.yaml"
},
"CVE-2021-42663": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cwe": "CWE-79",
"name": "Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42663.yaml"
},
"CVE-2021-42667": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Event Booking and Reservation System 2.3.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42667.yaml"
},
"CVE-2021-42670": {
"name": "Engineers Online Portal 1.0 \u5bb9\u6613\u53d7\u5230\u4e09\u79cd\u7c7b\u578b\u7684SQL\u6ce8\u5165\u653b\u51fb",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2021-42670.yaml"
},
"CVE-2021-42887": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42887.yaml"
},
"CVE-2021-43062": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Fortinet FortiMail 7.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43062.yaml"
},
"CVE-2021-43136": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Formalms Auth Bypass",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2021-43136.yaml"
},
"CVE-2021-43287": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Pre-Auth Takeover of Build Pipelines in GoCD",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43287.yaml"
},
"CVE-2021-43421": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Studio-42 elFinder <2.1.60 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43421.yaml"
},
"CVE-2021-43495": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "AlquistManager Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43495.yaml"
},
"CVE-2021-43496": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Clustering Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43496.yaml"
},
"CVE-2021-43510": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Sourcecodester Simple Client Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43510.yaml"
},
"CVE-2021-43574": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Atmail 6.5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43574.yaml"
},
"CVE-2021-43725": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43725.yaml"
},
"CVE-2021-43734": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "kkFileview v4.0.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43734.yaml"
},
"CVE-2021-4374": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "WordPress Automatic Plugin - Unauthenticated Options Change",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4374.yaml"
},
"CVE-2021-43778": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43778.yaml"
},
"CVE-2021-43798": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Grafana v8.x - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43798.yaml"
},
"CVE-2021-4380": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Pinterest Automatic < 4.14.4 - Unauthenticated Arbitrary Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4380.yaml"
},
"CVE-2021-43810": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Admidio - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43810.yaml"
},
"CVE-2021-43831": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Gradio < 2.5.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43831.yaml"
},
"CVE-2021-44077": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Zoho ManageEngine ServiceDesk Plus - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44077.yaml"
},
"CVE-2021-44103": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "KOGA 0.14.9 - Privilege Escalation",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2021-44103-6544.yaml"
},
"CVE-2021-44138": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44138.yaml"
},
"CVE-2021-44139": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Alibaba Sentinel - Server-side request forgery (SSRF)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44139.yaml"
},
"CVE-2021-44152": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Reprise License Manager 14.2 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44152.yaml"
},
"CVE-2021-44228": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Apache Log4j2 Remote Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml"
},
"CVE-2021-44260": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WAVLINK AC1200 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44260.yaml"
},
"CVE-2021-4436": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "3DPrint Lite < 1.9.1.5 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4436.yaml"
},
"CVE-2021-44427": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Rosario Student Information System Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44427.yaml"
},
"CVE-2021-44451": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-522",
"name": "Apache Superset <=1.3.2 - Default Login",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44451.yaml"
},
"CVE-2021-4448": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-862",
"name": "Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4448.yaml"
},
"CVE-2021-4449": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "ZoomSounds Plugin - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4449.yaml"
},
"CVE-2021-44515": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Zoho ManageEngine Desktop Central - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44515.yaml"
},
"CVE-2021-44521": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"name": "Apache Cassandra Load UDF RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-44521.yaml"
},
"CVE-2021-44528": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Open Redirect in Host Authorization Middleware",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44528.yaml"
},
"CVE-2021-44529": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Ivanti EPM Cloud Services Appliance Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44529.yaml"
},
"CVE-2021-4462": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Employee Records System 1.0 - Unauthenticated File Upload RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4462.yaml"
},
"CVE-2021-4463": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4463.yaml"
},
"CVE-2021-44848": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-203",
"name": "Thinfinity VirtualUI User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44848.yaml"
},
"CVE-2021-45027": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Oliver 5 Library Server <8.00.008.053 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45027.yaml"
},
"CVE-2021-45043": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "HD-Network Realtime Monitoring System 2.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45043.yaml"
},
"CVE-2021-45046": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "Apache Log4j2 - Remote Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45046.yaml"
},
"CVE-2021-45092": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Thinfinity Iframe Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45092.yaml"
},
"CVE-2021-45232": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Apache APISIX Dashboard <2.10.1 - API Unauthorized Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45232.yaml"
},
"CVE-2021-45328": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Gitea < 1.4.3 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45328.yaml"
},
"CVE-2021-45380": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "AppCMS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45380.yaml"
},
"CVE-2021-45382": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45382.yaml"
},
"CVE-2021-45420": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Emerson Dixell XWEB-500 - Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45420.yaml"
},
"CVE-2021-45422": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Reprise License Manager 14.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45422.yaml"
},
"CVE-2021-45428": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-639",
"name": "Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45428.yaml"
},
"CVE-2021-45467": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Control Web Panel (CWP) - File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45467.yaml"
},
"CVE-2021-45793": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Slims9 Bulian 9.4.2 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45793.yaml"
},
"CVE-2021-45811": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "osTicket 1.15.x - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45811.yaml"
},
"CVE-2021-45967": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Pascom CPS Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45967.yaml"
},
"CVE-2021-45968": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Pascom CPS - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45968.yaml"
},
"CVE-2021-46005": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46005.yaml"
},
"CVE-2021-46068": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Vehicle Service Management System - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46068.yaml"
},
"CVE-2021-46069": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Vehicle Service Management System 1.0 - Stored Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46069.yaml"
},
"CVE-2021-46071": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ehicle Service Management System 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46071.yaml"
},
"CVE-2021-46072": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Vehicle Service Management System 1.0 - Stored Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46072.yaml"
},
"CVE-2021-46073": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Vehicle Service Management System 1.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46073.yaml"
},
"CVE-2021-46104": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "webp_server_go 0.4.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46104.yaml"
},
"CVE-2021-46107": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Ligeo Archives Ligeo Basics - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46107.yaml"
},
"CVE-2021-46371": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "AntD Admin - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46371.yaml"
},
"CVE-2021-46379": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "D-Link DIR850 ET850-1.08TRb03 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46379.yaml"
},
"CVE-2021-46381": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "D-Link DAP-1620 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46381.yaml"
},
"CVE-2021-46387": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46387.yaml"
},
"CVE-2021-46417": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46417.yaml"
},
"CVE-2021-46418": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"name": "Telesquare TLR-2855KS6 - Arbitrary File Creation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46418.yaml"
},
"CVE-2021-46419": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"name": "Telesquare TLR-2855KS6 - Arbitrary File Deletion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46419.yaml"
},
"CVE-2021-46422": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "SDT-CW3B1 1.1.0 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46422.yaml"
},
"CVE-2021-46424": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-306",
"name": "Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46424.yaml"
},
"CVE-2021-46704": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "GenieACS => 1.2.8 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46704.yaml"
},
"CVE-2021-47795": {
"cvss": 6.2,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-47795.yaml"
},
"CVE-2022-0087": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Keystone 6 Login Page - Open Redirect and Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0087.yaml"
},
"CVE-2022-0140": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "WordPress Visual Form Builder <3.0.8 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0140.yaml"
},
"CVE-2022-0147": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0147.yaml"
},
"CVE-2022-0148": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0148.yaml"
},
"CVE-2022-0149": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0149.yaml"
},
"CVE-2022-0150": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0150.yaml"
},
"CVE-2022-0165": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Page Builder KingComposer <=2.9.6 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0165.yaml"
},
"CVE-2022-0169": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Photo Gallery by 10Web < 1.6.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0169.yaml"
},
"CVE-2022-0188": {
"name": "CMP WordPress < 4.0.19 - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0188.yaml"
},
"CVE-2022-0189": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0189.yaml"
},
"CVE-2022-0201": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Permalink Manager <2.2.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0201.yaml"
},
"CVE-2022-0206": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress NewStatPress <1.3.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0206.yaml"
},
"CVE-2022-0208": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0208.yaml"
},
"CVE-2022-0212": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0212.yaml"
},
"CVE-2022-0218": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0218.yaml"
},
"CVE-2022-0220": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-116",
"name": "WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0220.yaml"
},
"CVE-2022-0228": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Popup Builder < 4.0.7 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0228.yaml"
},
"CVE-2022-0234": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0234.yaml"
},
"CVE-2022-0250": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0250.yaml"
},
"CVE-2022-0271": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LearnPress <4.1.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0271.yaml"
},
"CVE-2022-0281": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Microweber Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0281.yaml"
},
"CVE-2022-0288": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Ad Inserter <2.7.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0288.yaml"
},
"CVE-2022-0342": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Zyxel - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0342.yaml"
},
"CVE-2022-0346": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0346.yaml"
},
"CVE-2022-0349": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress NotificationX <2.3.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0349.yaml"
},
"CVE-2022-0378": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0378.yaml"
},
"CVE-2022-0381": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0381.yaml"
},
"CVE-2022-0412": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0412.yaml"
},
"CVE-2022-0415": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Gogs <0.12.6 - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0415.yaml"
},
"CVE-2022-0422": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress White Label CMS <2.2.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0422.yaml"
},
"CVE-2022-0424": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0424.yaml"
},
"CVE-2022-0429": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0429.yaml"
},
"CVE-2022-0432": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-1321",
"name": "Mastodon Prototype Pollution Vulnerability",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0432.yaml"
},
"CVE-2022-0434": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Page Views Count <2.4.15 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0434.yaml"
},
"CVE-2022-0437": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "karma-runner DOM-based Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0437.yaml"
},
"CVE-2022-0439": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0439.yaml"
},
"CVE-2022-0441": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "MasterStudy LMS <2.7.6 - Improper Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0441.yaml"
},
"CVE-2022-0479": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Popup Builder Plugin - SQL Injection and Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0479.yaml"
},
"CVE-2022-0482": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"name": "Easy!Appointments <1.4.3 - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0482.yaml"
},
"CVE-2022-0533": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0533.yaml"
},
"CVE-2022-0535": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress E2Pdf <1.16.45 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0535.yaml"
},
"CVE-2022-0540": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Atlassian Jira Seraph - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0540.yaml"
},
"CVE-2022-0543": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Redis Sandbox Escape - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-0543.yaml"
},
"CVE-2022-0591": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "Formcraft3 <3.8.28 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0591.yaml"
},
"CVE-2022-0592": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "MapSVG < 6.2.20 - Unauthenticated SQLi",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0592.yaml"
},
"CVE-2022-0594": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-863",
"name": "WordPress Shareaholic <9.7.6 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0594.yaml"
},
"CVE-2022-0595": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0595.yaml"
},
"CVE-2022-0597": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Microweber < 1.2.11 - Open Redirection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0597.yaml"
},
"CVE-2022-0599": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0599.yaml"
},
"CVE-2022-0651": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0651.yaml"
},
"CVE-2022-0653": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wordpress Profile Builder Plugin Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0653.yaml"
},
"CVE-2022-0656": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "uDraw <3.3.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0656.yaml"
},
"CVE-2022-0658": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "CommonsBooking < 2.6.8 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0658.yaml"
},
"CVE-2022-0660": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-209",
"name": "Microweber <1.2.11 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0660.yaml"
},
"CVE-2022-0666": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-93",
"name": "Microweber < 1.2.11 - CRLF Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0666.yaml"
},
"CVE-2022-0678": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber <1.2.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0678.yaml"
},
"CVE-2022-0679": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0679.yaml"
},
"CVE-2022-0692": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Rudloff alltube prior to 3.0.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0692.yaml"
},
"CVE-2022-0693": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Master Elements <=8.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0693.yaml"
},
"CVE-2022-0735": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "GitLab CE/EE - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0735.yaml"
},
"CVE-2022-0747": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Infographic Maker iList < 4.3.8 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0747.yaml"
},
"CVE-2022-0760": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Simple Link Directory <7.7.2 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0760.yaml"
},
"CVE-2022-0765": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Loco Translate < 2.6.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0765.yaml"
},
"CVE-2022-0769": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Users Ultra <= 3.1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0769.yaml"
},
"CVE-2022-0773": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Documentor <= 1.5.3 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0773.yaml"
},
"CVE-2022-0776": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "RevealJS postMessage <4.3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0776.yaml"
},
"CVE-2022-0781": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Nirweb Support <2.8.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0781.yaml"
},
"CVE-2022-0783": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Multiple Shipping Address Woocommerce < 2.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0783.yaml"
},
"CVE-2022-0784": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Title Experiments Free <9.0.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0784.yaml"
},
"CVE-2022-0785": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Daily Prayer Time <2022.03.01 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0785.yaml"
},
"CVE-2022-0786": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress KiviCare <2.3.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0786.yaml"
},
"CVE-2022-0787": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0787.yaml"
},
"CVE-2022-0788": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0788.yaml"
},
"CVE-2022-0814": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Ubigeo de Peru < 3.6.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0814.yaml"
},
"CVE-2022-0817": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress BadgeOS <=3.7.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0817.yaml"
},
"CVE-2022-0824": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Webmin <1.990 - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0824.yaml"
},
"CVE-2022-0826": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress WP Video Gallery <=1.7.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0826.yaml"
},
"CVE-2022-0827": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Best Books <=2.6.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0827.yaml"
},
"CVE-2022-0846": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SpeakOut Email Petitions < 2.14.15.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0846.yaml"
},
"CVE-2022-0864": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "UpdraftPlus < 1.22.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0864.yaml"
},
"CVE-2022-0867": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress ARPrice <3.6.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0867.yaml"
},
"CVE-2022-0869": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "nitely/spirit 0.12.3 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0869.yaml"
},
"CVE-2022-0870": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Gogs <0.12.5 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0870.yaml"
},
"CVE-2022-0873": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0873.yaml"
},
"CVE-2022-0879": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0879.yaml"
},
"CVE-2022-0885": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Member Hero <=1.0.9 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0885.yaml"
},
"CVE-2022-0899": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Header Footer Code Manager < 1.1.24 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0899.yaml"
},
"CVE-2022-0921": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2022-0921.yaml"
},
"CVE-2022-0928": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber < 1.2.12 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0928.yaml"
},
"CVE-2022-0948": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0948.yaml"
},
"CVE-2022-0949": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Stop Bad Bots <6.930 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0949.yaml"
},
"CVE-2022-0952": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "WordPress Sitemap by click5 <1.0.36 - Missing Authorization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0952.yaml"
},
"CVE-2022-0954": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber <1.2.11 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0954.yaml"
},
"CVE-2022-0963": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber <1.2.12 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0963.yaml"
},
"CVE-2022-0968": {
"cvss": 5.5,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-190",
"name": "Microweber <1.2.12 - Integer Overflow",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0968.yaml"
},
"CVE-2022-1007": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1007.yaml"
},
"CVE-2022-1013": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Personal Dictionary <1.3.4 - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1013.yaml"
},
"CVE-2022-1020": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "WordPress WooCommerce <3.1.2 - Arbitrary Function Call",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1020.yaml"
},
"CVE-2022-1026": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-522",
"name": "Kyocera Net View Address Book Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1026.yaml"
},
"CVE-2022-1029": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Limit Login Attempts - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1029.yaml"
},
"CVE-2022-1040": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Sophos Firewall <=18.5 MR3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1040.yaml"
},
"CVE-2022-1054": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress RSVP and Event Management <2.7.8 - Missing Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1054.yaml"
},
"CVE-2022-1057": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1057.yaml"
},
"CVE-2022-1058": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Gitea <1.16.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1058.yaml"
},
"CVE-2022-1119": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Simple File List <3.2.8 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1119.yaml"
},
"CVE-2022-1162": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "GitLab CE/EE - Hard-Coded Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1162.yaml"
},
"CVE-2022-1168": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WP JobSearch <1.5.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1168.yaml"
},
"CVE-2022-1170": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "JobMonster < 4.5.2.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1170.yaml"
},
"CVE-2022-1221": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1221.yaml"
},
"CVE-2022-1281": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Photo Gallery WordPress v1.6.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1281.yaml"
},
"CVE-2022-1329": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Elementor Website Builder - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1329.yaml"
},
"CVE-2022-1386": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1386.yaml"
},
"CVE-2022-1388": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "F5 BIG-IP iControl - REST Auth Bypass RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1388.yaml"
},
"CVE-2022-1390": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Admin Word Count Column 2.2 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1390.yaml"
},
"CVE-2022-1391": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Cab fare calculator < 1.0.4 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1391.yaml"
},
"CVE-2022-1392": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress Videos sync PDF <=1.7.4 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1392.yaml"
},
"CVE-2022-1398": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1398.yaml"
},
"CVE-2022-1439": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber <1.2.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1439.yaml"
},
"CVE-2022-1442": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress Metform <=2.1.3 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1442.yaml"
},
"CVE-2022-1453": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "RSVPMaker <= 9.2.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1453.yaml"
},
"CVE-2022-1574": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-352",
"name": "WordPress HTML2WP <=1.0.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1574.yaml"
},
"CVE-2022-1580": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-639",
"name": "Site Offline WP Plugin < 1.5.3 - Authorization Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1580.yaml"
},
"CVE-2022-1595": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1595.yaml"
},
"CVE-2022-1597": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WPQA <5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1597.yaml"
},
"CVE-2022-1598": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-306",
"name": "WordPress WPQA <5.5 - Improper Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1598.yaml"
},
"CVE-2022-1609": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "The School Management < 9.9.7 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1609.yaml"
},
"CVE-2022-1692": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "CP Image Store with Slideshow <= 1.0.67 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1692.yaml"
},
"CVE-2022-1711": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "draw.io < 18.0.5 - Server Side Request Forgery (SSRF)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1711.yaml"
},
"CVE-2022-1713": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Drawio <18.0.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1713.yaml"
},
"CVE-2022-1724": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Simple Membership <4.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1724.yaml"
},
"CVE-2022-1756": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Newsletter < 7.4.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1756.yaml"
},
"CVE-2022-1768": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress RSVPMaker <=9.3.2 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1768.yaml"
},
"CVE-2022-1815": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Drawio <18.1.2 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1815.yaml"
},
"CVE-2022-1883": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Terraboard <2.2.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1883.yaml"
},
"CVE-2022-1903": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "ARMember < 3.4.8 - Unauthenticated Admin Account Takeover",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1903.yaml"
},
"CVE-2022-1904": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1904.yaml"
},
"CVE-2022-1906": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Copyright Proof <=4.16 - Cross-Site-Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1906.yaml"
},
"CVE-2022-1910": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1910.yaml"
},
"CVE-2022-1916": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1916.yaml"
},
"CVE-2022-1933": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress CDI <5.1.9 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1933.yaml"
},
"CVE-2022-1937": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Awin Data Feed <=1.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1937.yaml"
},
"CVE-2022-1946": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Gallery <2.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1946.yaml"
},
"CVE-2022-1950": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Youzify < 1.2.0 - Unauthenticated SQLi",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1950.yaml"
},
"CVE-2022-1952": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1952.yaml"
},
"CVE-2022-1970": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "keycloak v18.0.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-1970.yaml"
},
"CVE-2022-2034": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-639",
"name": "WordPress Sensei LMS <4.5.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2034.yaml"
},
"CVE-2022-20713": {
"name": "CVE-2022-20713",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-20713.yaml"
},
"CVE-2022-2130": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
"cwe": "CWE-79",
"name": "Microweber < 1.2.17 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2130.yaml"
},
"CVE-2022-21371": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Oracle WebLogic Server Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21371.yaml"
},
"CVE-2022-21445": {
"name": "CVE-2022-21445",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-21445.yaml"
},
"CVE-2022-21500": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Oracle E-Business Suite <=12.2 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21500.yaml"
},
"CVE-2022-21587": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21587.yaml"
},
"CVE-2022-21661": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress <5.8.3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21661.yaml"
},
"CVE-2022-2168": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2168.yaml"
},
"CVE-2022-21705": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"name": "October CMS - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21705.yaml"
},
"CVE-2022-2174": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "microweber 1.2.18 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2174.yaml"
},
"CVE-2022-21826": {
"name": "CVE-2022-21826",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-21826.yaml"
},
"CVE-2022-2185": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "GitLab CE/EE - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2185.yaml"
},
"CVE-2022-2187": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2187.yaml"
},
"CVE-2022-2219": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Unyson < 2.7.27 - Cross Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2219.yaml"
},
"CVE-2022-22242": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Juniper Web Device Manager - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22242.yaml"
},
"CVE-2022-22536": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-444",
"name": "SAP Memory Pipes (MPI) Desynchronization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22536.yaml"
},
"CVE-2022-22733": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Apache ShardingSphere ElasticJob-UI privilege escalation",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22733.yaml"
},
"CVE-2022-22897": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22897.yaml"
},
"CVE-2022-2290": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Trilium <0.52.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2290.yaml"
},
"CVE-2022-22947": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Spring Cloud Gateway Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22947.yaml"
},
"CVE-2022-22954": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "VMware Workspace ONE Access - Server-Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22954.yaml"
},
"CVE-2022-22956": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "VMware Workspace ONE Access - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22956.yaml"
},
"CVE-2022-22963": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Spring Cloud - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yaml"
},
"CVE-2022-22965": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Spring - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22965.yaml"
},
"CVE-2022-22972": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22972.yaml"
},
"CVE-2022-23102": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "SINEMA Remote Connect Server < V2.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23102.yaml"
},
"CVE-2022-23131": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-290",
"name": "Zabbix - SAML SSO Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23131.yaml"
},
"CVE-2022-23134": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": "Zabbix Setup Configuration Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23134.yaml"
},
"CVE-2022-2314": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress VR Calendar <=2.3.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2314.yaml"
},
"CVE-2022-23178": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Crestron Device - Credentials Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23178.yaml"
},
"CVE-2022-23347": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "BigAnt Server v5.6.06 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23347.yaml"
},
"CVE-2022-23348": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-916",
"name": "BigAnt Server 5.6.06 - Improper Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23348.yaml"
},
"CVE-2022-23397": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23397.yaml"
},
"CVE-2022-23544": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "MeterSphere < 2.5.0 SSRF",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23544.yaml"
},
"CVE-2022-23642": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-23642.yaml"
},
"CVE-2022-2373": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2373.yaml"
},
"CVE-2022-2376": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress Directorist <7.3.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2376.yaml"
},
"CVE-2022-23779": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Zoho ManageEngine - Internal Hostname Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23779.yaml"
},
"CVE-2022-2379": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress Easy Student Results <=2.2.8 - Improper Authorization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2379.yaml"
},
"CVE-2022-23808": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpMyAdmin < 5.1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23808.yaml"
},
"CVE-2022-2383": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Feed Them Social <3.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2383.yaml"
},
"CVE-2022-23854": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23854.yaml"
},
"CVE-2022-23881": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "ZZZCMS zzzphp 2.1.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23881.yaml"
},
"CVE-2022-23898": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "MCMS 5.2.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23898.yaml"
},
"CVE-2022-23944": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"name": "Apache ShenYu Admin Unauth Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23944.yaml"
},
"CVE-2022-24086": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Adobe Commerce (Magento) - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24086.yaml"
},
"CVE-2022-24112": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-290",
"name": "Apache APISIX - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24112.yaml"
},
"CVE-2022-24124": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Casdoor 1.13.0 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24124.yaml"
},
"CVE-2022-24129": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"cwe": "CWE-918",
"name": "Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24129.yaml"
},
"CVE-2022-2414": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "FreeIPA - XML Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2414.yaml"
},
"CVE-2022-24181": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24181.yaml"
},
"CVE-2022-24223": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Atom CMS v2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24223.yaml"
},
"CVE-2022-24260": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "VoipMonitor - Pre-Auth SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24260.yaml"
},
"CVE-2022-24264": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Cuppa CMS v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24264.yaml"
},
"CVE-2022-24265": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Cuppa CMS v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24265.yaml"
},
"CVE-2022-24266": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Cuppa CMS v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24266.yaml"
},
"CVE-2022-24288": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Apache Airflow OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24288.yaml"
},
"CVE-2022-24384": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SmarterTools SmarterTrack - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24384.yaml"
},
"CVE-2022-2461": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2461.yaml"
},
"CVE-2022-2462": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Transposh <=1.0.8.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2462.yaml"
},
"CVE-2022-24627": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "AudioCodes Device Manager Express - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24627.yaml"
},
"CVE-2022-24637": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Open Web Analytics 1.7.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24637.yaml"
},
"CVE-2022-24643": {
"name": "OpenEMR v6.0.0 Stored XSS Vulnerability",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-24643.yaml"
},
"CVE-2022-2467": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Garage Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2467.yaml"
},
"CVE-2022-24681": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ManageEngine ADSelfService Plus <6121 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24681.yaml"
},
"CVE-2022-24682": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-116",
"name": "Zimbra Collaboration Suite < 8.8.15 - Improper Encoding",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24682.yaml"
},
"CVE-2022-24706": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1188",
"name": "CouchDB Erlang Distribution - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-24706.yaml"
},
"CVE-2022-24716": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Icinga Web 2 - Arbitrary File Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24716.yaml"
},
"CVE-2022-24816": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "GeoServer <1.2.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24816.yaml"
},
"CVE-2022-24819": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-359",
"name": "XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24819.yaml"
},
"CVE-2022-24856": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Flyte Console <0.52.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24856.yaml"
},
"CVE-2022-2486": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Wavlink WN535K2/WN535K3 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2486.yaml"
},
"CVE-2022-2487": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Wavlink WN535K2/WN535K3 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2487.yaml"
},
"CVE-2022-2488": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Wavlink WN535K2/WN535K3 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2488.yaml"
},
"CVE-2022-24899": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contao <4.13.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24899.yaml"
},
"CVE-2022-24900": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"name": "Piano LED Visualizer 1.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24900.yaml"
},
"CVE-2022-24990": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "TerraMaster TOS < 4.2.30 Server Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24990.yaml"
},
"CVE-2022-25061": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TP-Link TL-WR840N - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25061.yaml"
},
"CVE-2022-25082": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TOTOLink - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25082.yaml"
},
"CVE-2022-25084": {
"name": "TOTOLink T6 V5.9c.4085_B20190428 Command Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-25084.yaml"
},
"CVE-2022-25125": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "MCMS 5.2.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25125.yaml"
},
"CVE-2022-25148": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25148.yaml"
},
"CVE-2022-25149": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25149.yaml"
},
"CVE-2022-25216": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "DVDFab 12 Player/PlayerFab - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25216.yaml"
},
"CVE-2022-25226": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "ThinVNC - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25226.yaml"
},
"CVE-2022-25237": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-285",
"name": "Bonita Web 2021.2 - Authentication/Authorization Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25237.yaml"
},
"CVE-2022-25322": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ZEROF Web Server 2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25322.yaml"
},
"CVE-2022-25323": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ZEROF Web Server 2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25323.yaml"
},
"CVE-2022-2535": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-639",
"name": "SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2535.yaml"
},
"CVE-2022-25356": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-91",
"name": "Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25356.yaml"
},
"CVE-2022-25369": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-425",
"name": "Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25369.yaml"
},
"CVE-2022-2544": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "WordPress Ninja Job Board < 1.3.3 - Direct Request",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2544.yaml"
},
"CVE-2022-2546": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2546.yaml"
},
"CVE-2022-25481": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "ThinkPHP 5.0.24 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25481.yaml"
},
"CVE-2022-25485": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-829",
"name": "Cuppa CMS v1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25485.yaml"
},
"CVE-2022-25486": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-829",
"name": "Cuppa CMS v1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25486.yaml"
},
"CVE-2022-25487": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Atom CMS v2.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25487.yaml"
},
"CVE-2022-25488": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Atom CMS v2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25488.yaml"
},
"CVE-2022-25489": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Atom CMS v2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25489.yaml"
},
"CVE-2022-25497": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-552",
"name": "Cuppa CMS v1.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25497.yaml"
},
"CVE-2022-2551": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "WordPress Duplicator <1.4.7 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2551.yaml"
},
"CVE-2022-2552": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Duplicator < 1.4.7.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2552.yaml"
},
"CVE-2022-25568": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-1188",
"name": "MotionEye Config Info Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25568.yaml"
},
"CVE-2022-2599": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2599.yaml"
},
"CVE-2022-26134": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-917",
"name": "Confluence - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml"
},
"CVE-2022-26135": {
"cvss": 7.5,
"name": "Full-Read Server Side Request Forgery in Mobile Plugin for Jira Data Center and Server",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2022-26135.yaml"
},
"CVE-2022-26138": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Atlassian Questions For Confluence - Hardcoded Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26138.yaml"
},
"CVE-2022-26143": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Mitel MiCollab - Information Disclosure & Denial of Service",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26143.yaml"
},
"CVE-2022-26148": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-312",
"name": "Grafana & Zabbix Integration - Credentials Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26148.yaml"
},
"CVE-2022-26159": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-425",
"name": "Ametys CMS Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26159.yaml"
},
"CVE-2022-26233": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26233.yaml"
},
"CVE-2022-26263": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Yonyou U8 13.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26263.yaml"
},
"CVE-2022-2627": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Newspaper < 12 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2627.yaml"
},
"CVE-2022-26271": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "74cmsSE v3.4.1 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26271.yaml"
},
"CVE-2022-2633": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-610",
"name": "All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2633.yaml"
},
"CVE-2022-26352": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "DotCMS - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26352.yaml"
},
"CVE-2022-26564": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26564.yaml"
},
"CVE-2022-26585": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Mingsoft MCMS v5.2.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26585.yaml"
},
"CVE-2022-26833": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"cwe": "CWE-306",
"name": "Open Automation Software OAS Platform V16.00.0121 - Missing Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26833.yaml"
},
"CVE-2022-26960": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "elFinder <=2.1.60 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26960.yaml"
},
"CVE-2022-27043": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Yearning - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27043.yaml"
},
"CVE-2022-27228": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Bitrix Site Manager - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27228.yaml"
},
"CVE-2022-2733": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Openemr < 7.0.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2733.yaml"
},
"CVE-2022-27373": {
"name": "CVE-2022-27373",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-27373.yaml"
},
"CVE-2022-2756": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Kavita <0.5.4.1 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2756.yaml"
},
"CVE-2022-27593": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-610",
"name": "QNAP QTS Photo Station External Reference - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27593.yaml"
},
"CVE-2022-27849": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27849.yaml"
},
"CVE-2022-27924": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Zimbra Collaboration Suite - Memcached Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27924.yaml"
},
"CVE-2022-27925": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27925.yaml"
},
"CVE-2022-27926": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zimbra Collaboration (ZCS) - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27926.yaml"
},
"CVE-2022-27927": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Microfinance Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27927.yaml"
},
"CVE-2022-27984": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cuppa CMS v1.0 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27984.yaml"
},
"CVE-2022-27985": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cuppa CMS v1.0 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27985.yaml"
},
"CVE-2022-28022": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Purchase Order Management v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-28022.yaml"
},
"CVE-2022-28023": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Purchase Order Management v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-28023.yaml"
},
"CVE-2022-28032": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Atom CMS v2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28032.yaml"
},
"CVE-2022-28033": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Atom.CMS 2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28033.yaml"
},
"CVE-2022-28079": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "College Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28079.yaml"
},
"CVE-2022-28080": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Royal Event - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28080.yaml"
},
"CVE-2022-28090": {
"name": "Jspxcms < 10.2.0 - Unauthenticated SSRF",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-28090.yaml"
},
"CVE-2022-28117": {
"cvss": 4.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-918",
"name": "Navigate CMS 2.9.4 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28117.yaml"
},
"CVE-2022-28219": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-611",
"name": "Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28219.yaml"
},
"CVE-2022-2827": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "AMI MegaRAC User Enumeration Vulnerability",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-2827.yaml"
},
"CVE-2022-28290": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Country Selector <1.6.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28290.yaml"
},
"CVE-2022-28363": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Reprise License Manager 14.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28363.yaml"
},
"CVE-2022-28365": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-425",
"name": "Reprise License Manager 14.2 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28365.yaml"
},
"CVE-2022-28508": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MantisBT < 2.25.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28508.yaml"
},
"CVE-2022-2863": {
"cvss": 4.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress WPvivid Backup <0.9.76 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2863.yaml"
},
"CVE-2022-28666": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-287",
"name": "Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28666.yaml"
},
"CVE-2022-28923": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Caddy 2.4.6 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28923.yaml"
},
"CVE-2022-28955": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "D-Link DIR-816L - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28955.yaml"
},
"CVE-2022-28987": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-203",
"name": "Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28987.yaml"
},
"CVE-2022-29004": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Diary Management System 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29004.yaml"
},
"CVE-2022-29005": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Online Birth Certificate System 1.2 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29005.yaml"
},
"CVE-2022-29006": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Directory Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29006.yaml"
},
"CVE-2022-29007": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Dairy Farm Shop Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29007.yaml"
},
"CVE-2022-29009": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cyber Cafe Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29009.yaml"
},
"CVE-2022-29013": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Razer Sila Gaming Router - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29013.yaml"
},
"CVE-2022-29014": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29014.yaml"
},
"CVE-2022-29078": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Node.js Embedded JavaScript 3.1.6 - Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29078.yaml"
},
"CVE-2022-29081": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Zoho ManageEngine - Access Control Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29081.yaml"
},
"CVE-2022-29153": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-918",
"name": "HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29153.yaml"
},
"CVE-2022-29272": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Nagios XI <5.8.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29272.yaml"
},
"CVE-2022-29298": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SolarView Compact 6.00 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29298.yaml"
},
"CVE-2022-29299": {
"name": "SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-29299.yaml"
},
"CVE-2022-29301": {
"name": "SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-29301.yaml"
},
"CVE-2022-29303": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "SolarView Compact 6.00 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29303.yaml"
},
"CVE-2022-29316": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Complete Online Job Search System 1.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29316.yaml"
},
"CVE-2022-29349": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "kkFileView 4.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29349.yaml"
},
"CVE-2022-29383": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NETGEAR ProSafe SSL VPN firmware - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29383.yaml"
},
"CVE-2022-29455": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29455.yaml"
},
"CVE-2022-29464": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WSO2 Management - Arbitrary File Upload & Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29464.yaml"
},
"CVE-2022-29495": {
"name": "WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29495.yaml"
},
"CVE-2022-29499": {
"name": "Mitel MiVoice Connect Remote Code Execution",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-29499.yaml"
},
"CVE-2022-29548": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WSO2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29548.yaml"
},
"CVE-2022-29775": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "iSpy 7.2.2.0 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29775.yaml"
},
"CVE-2022-30073": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WBCE CMS 1.5.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30073.yaml"
},
"CVE-2022-30489": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wavlink WN-535G3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30489.yaml"
},
"CVE-2022-30512": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "School Dormitory Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30512.yaml"
},
"CVE-2022-30513": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30513.yaml"
},
"CVE-2022-30514": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30514.yaml"
},
"CVE-2022-30525": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Zyxel Firewall - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30525.yaml"
},
"CVE-2022-3062": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Simple File List < 4.4.12 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3062.yaml"
},
"CVE-2022-30776": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Atmail 6.5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30776.yaml"
},
"CVE-2022-30777": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Parallels H-Sphere 3.6.1713 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30777.yaml"
},
"CVE-2022-31101": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "Prestashop Blockwishlist 2.1.0 SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31101.yaml"
},
"CVE-2022-31126": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Roxy-WI - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31126.yaml"
},
"CVE-2022-31137": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Roxy-WI < 6.1.1.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31137.yaml"
},
"CVE-2022-31161": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Roxy-WI - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31161.yaml"
},
"CVE-2022-31181": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "PrestaShop - SQL Injection to Eval Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31181.yaml"
},
"CVE-2022-3124": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "Frontend File Manager < 21.3 - Unauthenticated File Renaming",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3124.yaml"
},
"CVE-2022-31260": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-306",
"name": "ResourceSpace - Metadata Export",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31260.yaml"
},
"CVE-2022-31268": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Gitblit 1.9.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31268.yaml"
},
"CVE-2022-31269": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"cwe": "CWE-798",
"name": "Linear eMerge E3-Series - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31269.yaml"
},
"CVE-2022-31299": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Haraj 3.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31299.yaml"
},
"CVE-2022-31373": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SolarView Compact 6.00 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31373.yaml"
},
"CVE-2022-3142": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NEX-Forms Plugin < 7.9.7 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3142.yaml"
},
"CVE-2022-31470": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Axigen WebMail - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31470.yaml"
},
"CVE-2022-31474": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "BackupBuddy - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31474.yaml"
},
"CVE-2022-31499": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31499.yaml"
},
"CVE-2022-31656": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "VMware - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31656.yaml"
},
"CVE-2022-31678": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-611",
"name": "VMWare Cloud Foundation NSX-V - XML External Entity (XXE)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31678.yaml"
},
"CVE-2022-31704": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "VMware vRealize Log Insight - Improper Access Control to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31704.yaml"
},
"CVE-2022-31706": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "VMware vRealize Log Insight - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31706.yaml"
},
"CVE-2022-31711": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "VMware vRealize Log Insight < v8.10.2 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31711.yaml"
},
"CVE-2022-31793": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "muhttpd <=1.1.5 - Local Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-31793.yaml"
},
"CVE-2022-31798": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-384",
"name": "Nortek Linear eMerge E3-Series - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31798.yaml"
},
"CVE-2022-31814": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31814.yaml"
},
"CVE-2022-31845": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "WAVLINK WN535 G3 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31845.yaml"
},
"CVE-2022-31846": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "WAVLINK WN535 G3 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31846.yaml"
},
"CVE-2022-31847": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31847.yaml"
},
"CVE-2022-31854": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Codoforum 5.1 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31854.yaml"
},
"CVE-2022-31879": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2022-31879.yaml"
},
"CVE-2022-31974": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31974.yaml"
},
"CVE-2022-31975": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31975.yaml"
},
"CVE-2022-31976": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31976.yaml"
},
"CVE-2022-31977": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31977.yaml"
},
"CVE-2022-31978": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31978.yaml"
},
"CVE-2022-31980": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2022-31980.yaml"
},
"CVE-2022-31981": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2022-31981.yaml"
},
"CVE-2022-31982": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2022-31982.yaml"
},
"CVE-2022-31983": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2022-31983.yaml"
},
"CVE-2022-31984": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Online Fire Reporting System v1.0 - SQL injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31984.yaml"
},
"CVE-2022-32007": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Complete Online Job Search System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32007.yaml"
},
"CVE-2022-32015": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Complete Online Job Search System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32015.yaml"
},
"CVE-2022-32018": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Complete Online Job Search System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32018.yaml"
},
"CVE-2022-32022": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Car Rental Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32022.yaml"
},
"CVE-2022-32024": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Car Rental Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32024.yaml"
},
"CVE-2022-32025": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Car Rental Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32025.yaml"
},
"CVE-2022-32026": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Car Rental Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32026.yaml"
},
"CVE-2022-32028": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Car Rental Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32028.yaml"
},
"CVE-2022-32094": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Hospital Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32094.yaml"
},
"CVE-2022-32159": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Open edX - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2022-32159.yaml"
},
"CVE-2022-32195": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Open edX <2022-06-06 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32195.yaml"
},
"CVE-2022-3236": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Sophos Firewall <= 19.0 MR1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3236.yaml"
},
"CVE-2022-32409": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32409.yaml"
},
"CVE-2022-3242": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "Microweber <1.3.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3242.yaml"
},
"CVE-2022-32429": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "MSNSwitch Firmware MNT.2408 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32429.yaml"
},
"CVE-2022-32430": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Lin CMS Spring Boot - Default JWT Token",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32430.yaml"
},
"CVE-2022-32444": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "u5cms v8.3.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32444.yaml"
},
"CVE-2022-3254": {
"name": "AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3254.yaml"
},
"CVE-2022-32770": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32770.yaml"
},
"CVE-2022-32771": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32771.yaml"
},
"CVE-2022-32772": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32772.yaml"
},
"CVE-2022-33098": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-33098.yaml"
},
"CVE-2022-33107": {
"name": "ThinkPHP 6.0.12 \u53cd\u5e8f\u5217\u5316 RCE",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2022-33107.yaml"
},
"CVE-2022-33119": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33119.yaml"
},
"CVE-2022-33174": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "Powertek Firmware <3.30.30 - Authorization Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33174.yaml"
},
"CVE-2022-33198": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress Accordions  - Unauthenticated Settings Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33198.yaml"
},
"CVE-2022-33891": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Apache Spark UI - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33891.yaml"
},
"CVE-2022-33901": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33901.yaml"
},
"CVE-2022-33965": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Visitor Statistics <=5.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33965.yaml"
},
"CVE-2022-34045": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "WAVLINK WN530HG4 - Improper Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34045.yaml"
},
"CVE-2022-34046": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "WAVLINK WN533A8 - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34046.yaml"
},
"CVE-2022-34047": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "WAVLINK WN530HG4 - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34047.yaml"
},
"CVE-2022-34048": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wavlink WN-533A8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34048.yaml"
},
"CVE-2022-34049": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-552",
"name": "WAVLINK WN530HG4 - Improper Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34049.yaml"
},
"CVE-2022-34093": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34093.yaml"
},
"CVE-2022-34094": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34094.yaml"
},
"CVE-2022-34121": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-829",
"name": "CuppaCMS v1.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34121.yaml"
},
"CVE-2022-34265": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Django - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2022/CVE-2022-34265.yaml"
},
"CVE-2022-34267": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "RWS WorldServer - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34267.yaml"
},
"CVE-2022-34305": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Apache Tomcat Examples Web Application - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34305.yaml"
},
"CVE-2022-34328": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PMB 7.3.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34328.yaml"
},
"CVE-2022-34487": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-264",
"name": "ShortCode Addons - Unauthenticated Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34487.yaml"
},
"CVE-2022-34534": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34534.yaml"
},
"CVE-2022-34576": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WAVLINK WN535 G3 - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34576.yaml"
},
"CVE-2022-34590": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Hospital Management System 1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34590.yaml"
},
"CVE-2022-34753": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34753.yaml"
},
"CVE-2022-3477": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WordPress tagDiv Composer < 3.5 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3477.yaml"
},
"CVE-2022-3481": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cwe": "CWE-20",
"name": "NotificationX Dropshipping < 4.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3481.yaml"
},
"CVE-2022-3484": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WPB Show Core - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3484.yaml"
},
"CVE-2022-3506": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3506.yaml"
},
"CVE-2022-35151": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "kkFileView 4.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35151.yaml"
},
"CVE-2022-35405": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Zoho ManageEngine - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35405.yaml"
},
"CVE-2022-35413": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35413.yaml"
},
"CVE-2022-35416": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "H3C SSL VPN <=2022-07-10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35416.yaml"
},
"CVE-2022-35493": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "eShop 3.0.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35493.yaml"
},
"CVE-2022-35507": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"cwe": "CWE-74",
"name": "Proxmox - CRLF Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35507.yaml"
},
"CVE-2022-35653": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Moodle LTI module Reflected - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35653.yaml"
},
"CVE-2022-3578": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress ProfileGrid <5.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3578.yaml"
},
"CVE-2022-3590": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-367",
"name": "WordPress <= 6.2 - Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3590.yaml"
},
"CVE-2022-35914": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "GLPI <=10.0.2 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35914.yaml"
},
"CVE-2022-36446": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-116",
"name": "Webmin <1.997 - Authenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36446.yaml"
},
"CVE-2022-36537": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "ZK Framework - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36537.yaml"
},
"CVE-2022-36553": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Hytec Inter HWL-2511-SS - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36553.yaml"
},
"CVE-2022-36642": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Omnia MPX 1.5.0+r1 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36642.yaml"
},
"CVE-2022-36664": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Password Manager for IIS v2.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-36664.yaml"
},
"CVE-2022-36804": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Atlassian Bitbucket - Remote Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36804.yaml"
},
"CVE-2022-36883": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-862",
"name": "Jenkins Git <=4.11.3 - Missing Authorization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36883.yaml"
},
"CVE-2022-36923": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Zoho ManageEngine - getUserAPIKey Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36923.yaml"
},
"CVE-2022-37042": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml"
},
"CVE-2022-37061": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "FLIR AX8 1.46.16 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37061.yaml"
},
"CVE-2022-37122": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37122.yaml"
},
"CVE-2022-37153": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Artica Proxy 4.30.000000 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37153.yaml"
},
"CVE-2022-37190": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-732",
"name": "Cuppa CMS v1.0 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37190.yaml"
},
"CVE-2022-37191": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-829",
"name": "Cuppa CMS v1.0 - Authenticated Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37191.yaml"
},
"CVE-2022-37299": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Shirne CMS 1.2.0 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37299.yaml"
},
"CVE-2022-3766": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpMyFAQ < 3.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3766.yaml"
},
"CVE-2022-3768": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress WPSmartContracts <1.3.12 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3768.yaml"
},
"CVE-2022-37932": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "HP Switch - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37932.yaml"
},
"CVE-2022-3800": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "IBAX - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3800.yaml"
},
"CVE-2022-3805": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-79",
"name": "Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3805.yaml"
},
"CVE-2022-38130": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38130.yaml"
},
"CVE-2022-38131": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "RStudio Connect - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38131.yaml"
},
"CVE-2022-38295": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cuppa CMS v1.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38295.yaml"
},
"CVE-2022-38296": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Cuppa CMS v1.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38296.yaml"
},
"CVE-2022-38463": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ServiceNow - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38463.yaml"
},
"CVE-2022-38467": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CRM Perks Forms < 1.1.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38467.yaml"
},
"CVE-2022-38553": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Academy Learning Management System <5.9.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38553.yaml"
},
"CVE-2022-38627": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Nortek Linear eMerge E3-Series - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38627.yaml"
},
"CVE-2022-38637": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Hospital Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38637.yaml"
},
"CVE-2022-3869": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Froxlor < 0.10.38.2. - HTML Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3869.yaml"
},
"CVE-2022-38794": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Zaver - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38794.yaml"
},
"CVE-2022-38812": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "AeroCMS 0.1.1 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38812.yaml"
},
"CVE-2022-38817": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38817.yaml"
},
"CVE-2022-38840": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "G\u00fcralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38840.yaml"
},
"CVE-2022-38870": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Free5gc 3.2.1 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38870.yaml"
},
"CVE-2022-39048": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ServiceNow - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39048.yaml"
},
"CVE-2022-3908": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Helloprint <1.4.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3908.yaml"
},
"CVE-2022-39195": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LISTSERV 17 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39195.yaml"
},
"CVE-2022-39258": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Mailcow Dockerized Swagger UI - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39258.yaml"
},
"CVE-2022-3933": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3933.yaml"
},
"CVE-2022-3934": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress FlatPM <3.0.13 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3934.yaml"
},
"CVE-2022-3980": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-611",
"name": "Sophos Mobile managed on-premises - XML External Entity Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3980.yaml"
},
"CVE-2022-3982": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Booking Calendar <3.2.2 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3982.yaml"
},
"CVE-2022-39952": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Fortinet FortiNAC - Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39952.yaml"
},
"CVE-2022-39960": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Jira Netic Group Export <1.0.3 - Missing Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39960.yaml"
},
"CVE-2022-39986": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "RaspAP 2.8.7 - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39986.yaml"
},
"CVE-2022-40022": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Symmetricom SyncServer Unauthenticated - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40022.yaml"
},
"CVE-2022-40032": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Simple Task Managing System v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40032.yaml"
},
"CVE-2022-40047": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Flatpress < v1.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40047.yaml"
},
"CVE-2022-40083": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-601",
"name": "Labstack Echo 4.8.0 - Open Redirect",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40083.yaml"
},
"CVE-2022-40127": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "AirFlow < 2.4.0 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40127.yaml"
},
"CVE-2022-40359": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Kae's File Manager <=1.4.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40359.yaml"
},
"CVE-2022-40443": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "ZZCMS 2022 - Path Information Disclosure",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40443.yaml"
},
"CVE-2022-4049": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WP User <= 7.0 - Unauthenticated SQLi",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4049.yaml"
},
"CVE-2022-4050": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress JoomSport <5.2.8 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4050.yaml"
},
"CVE-2022-4057": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-425",
"name": "Autoptimize < 3.1.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4057.yaml"
},
"CVE-2022-4059": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cryptocurrency Widgets Pack < 2.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4059.yaml"
},
"CVE-2022-4060": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress User Post Gallery <=2.19 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4060.yaml"
},
"CVE-2022-40619": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "NETGEAR Routers FunJSQ - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2022-40619.yaml"
},
"CVE-2022-40624": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "pfSense pfBlockerNG - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40624.yaml"
},
"CVE-2022-4063": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress InPost Gallery <2.1.4.1 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4063.yaml"
},
"CVE-2022-40684": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Fortinet - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml"
},
"CVE-2022-40734": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Laravel Filemanager v2.5.1 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40734.yaml"
},
"CVE-2022-40843": {
"cvss": 4.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Tenda AC1200 V-W15Ev2 - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40843.yaml"
},
"CVE-2022-40879": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "kkFileView 4.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40879.yaml"
},
"CVE-2022-40881": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "SolarView 6.00 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40881.yaml"
},
"CVE-2022-41040": {
"name": "Microsoft Exchange Server-Side Request Forgery",
"severity": "unknown",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-41040.yaml"
},
"CVE-2022-4117": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress IWS Geo Form Fields <=1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4117.yaml"
},
"CVE-2022-41352": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Zimbra Collaboration - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41352.yaml"
},
"CVE-2022-4140": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4140.yaml"
},
"CVE-2022-41412": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41412.yaml"
},
"CVE-2022-41441": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ReQlogic v11.3 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41441.yaml"
},
"CVE-2022-41473": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "RPCMS 3.0.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41473.yaml"
},
"CVE-2022-41678": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41678.yaml"
},
"CVE-2022-41697": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-204",
"name": "Ghost CMS - User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41697.yaml"
},
"CVE-2022-41800": {
"cvss": 8.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-77",
"name": "F5 BIG-IP Appliance Mode - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41800.yaml"
},
"CVE-2022-41840": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Welcart eCommerce <=2.7.7 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41840.yaml"
},
"CVE-2022-42094": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Backdrop CMS version 1.23.0 - Stored Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42094.yaml"
},
"CVE-2022-42095": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42095.yaml"
},
"CVE-2022-42096": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42096.yaml"
},
"CVE-2022-42118": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Liferay Portal - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42118.yaml"
},
"CVE-2022-42149": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "kkFileView 4.0 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42149.yaml"
},
"CVE-2022-4223": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "pgAdmin < 6.17 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4223.yaml"
},
"CVE-2022-42233": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Tenda 11N - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42233.yaml"
},
"CVE-2022-42475": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Fortinet SSL-VPN - Heap-Based Buffer Overflow",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2022/CVE-2022-42475.yaml"
},
"CVE-2022-4260": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4260.yaml"
},
"CVE-2022-42746": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CandidATS 3.0.0 - Cross-Site Scripting.",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42746.yaml"
},
"CVE-2022-42747": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CandidATS 3.0.0 - Cross-Site Scripting.",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42747.yaml"
},
"CVE-2022-42748": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CandidATS 3.0.0 - Cross-Site Scripting.",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42748.yaml"
},
"CVE-2022-42749": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CandidATS 3.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42749.yaml"
},
"CVE-2022-42889": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Text4Shell - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2022/CVE-2022-42889.yaml"
},
"CVE-2022-4295": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Show all comments < 7.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4295.yaml"
},
"CVE-2022-4298": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2022-4298.yaml"
},
"CVE-2022-4301": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4301.yaml"
},
"CVE-2022-43014": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43014.yaml"
},
"CVE-2022-43015": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43015.yaml"
},
"CVE-2022-43016": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43016.yaml"
},
"CVE-2022-43017": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43017.yaml"
},
"CVE-2022-43018": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43018.yaml"
},
"CVE-2022-4305": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Login as User or Customer < 3.3 - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4305.yaml"
},
"CVE-2022-4306": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4306.yaml"
},
"CVE-2022-43140": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-918",
"name": "kkFileView 4.1.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43140.yaml"
},
"CVE-2022-43164": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43164.yaml"
},
"CVE-2022-43165": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43165.yaml"
},
"CVE-2022-43166": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43166.yaml"
},
"CVE-2022-43167": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43167.yaml"
},
"CVE-2022-43169": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43169.yaml"
},
"CVE-2022-43170": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43170.yaml"
},
"CVE-2022-43185": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43185.yaml"
},
"CVE-2022-4320": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Events Calendar <1.4.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4320.yaml"
},
"CVE-2022-4321": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PDF Generator for WordPress < 1.1.2 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4321.yaml"
},
"CVE-2022-4325": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4325.yaml"
},
"CVE-2022-4328": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4328.yaml"
},
"CVE-2022-4375": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Mingsoft MCMS - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4375.yaml"
},
"CVE-2022-43769": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"name": "Hitachi Pentaho Business Analytics Server - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43769.yaml"
},
"CVE-2022-43939": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"cwe": "CWE-647",
"name": "Hitachi Pentaho Business Analytics Server - Bypass Authorization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43939.yaml"
},
"CVE-2022-44290": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WebTareas 2.4p5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44290.yaml"
},
"CVE-2022-44291": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WebTareas 2.4p5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44291.yaml"
},
"CVE-2022-44356": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44356.yaml"
},
"CVE-2022-4447": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Fontsy <=1.8.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4447.yaml"
},
"CVE-2022-44588": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44588.yaml"
},
"CVE-2022-44727": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop lgcookieslaw - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44727.yaml"
},
"CVE-2022-44877": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44877.yaml"
},
"CVE-2022-44944": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44944.yaml"
},
"CVE-2022-44946": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44946.yaml"
},
"CVE-2022-44947": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44947.yaml"
},
"CVE-2022-44948": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44948.yaml"
},
"CVE-2022-44949": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44949.yaml"
},
"CVE-2022-44950": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44950.yaml"
},
"CVE-2022-44951": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44951.yaml"
},
"CVE-2022-44952": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44952.yaml"
},
"CVE-2022-44957": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WebTareas 2.4p5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44957.yaml"
},
"CVE-2022-45037": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WBCE CMS v1.5.4 - Cross Site Scripting (Stored)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45037.yaml"
},
"CVE-2022-45038": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WBCE CMS v1.5.4 - Cross Site Scripting (Stored)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45038.yaml"
},
"CVE-2022-45269": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Linx Sphere - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45269.yaml"
},
"CVE-2022-45354": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Download Monitor <= 4.7.60 - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45354.yaml"
},
"CVE-2022-45362": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45362.yaml"
},
"CVE-2022-45365": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Stock Ticker <= 3.23.2 - Cross-Site-Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45365.yaml"
},
"CVE-2022-45699": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "APsystems ECU-R Firmware - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45699.yaml"
},
"CVE-2022-45805": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45805.yaml"
},
"CVE-2022-45808": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"cwe": "CWE-89",
"name": "LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45808.yaml"
},
"CVE-2022-45835": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45835.yaml"
},
"CVE-2022-45836": {
"name": "WordPress Download Manager <= 3.2.59 - Reflected XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45836.yaml"
},
"CVE-2022-45917": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "ILIAS eLearning <7.16 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45917.yaml"
},
"CVE-2022-45933": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "KubeView <=0.1.31 - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45933.yaml"
},
"CVE-2022-46020": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WBCE CMS v1.5.4 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46020.yaml"
},
"CVE-2022-46071": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Helmet Store Showroom v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46071.yaml"
},
"CVE-2022-46073": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Helmet Store Showroom - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46073.yaml"
},
"CVE-2022-46169": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Cacti <=1.2.22 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46169.yaml"
},
"CVE-2022-46381": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Linear eMerge E3-Series - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46381.yaml"
},
"CVE-2022-46443": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Bangresto - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46443.yaml"
},
"CVE-2022-46463": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Harbor <=2.5.3 - Unauthorized Access",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2022-46463.yaml"
},
"CVE-2022-46888": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NexusPHP <1.7.33 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46888.yaml"
},
"CVE-2022-46934": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "kkFileView 4.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46934.yaml"
},
"CVE-2022-47002": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Masa CMS - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47002.yaml"
},
"CVE-2022-47003": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Mura CMS <10.0.580 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47003.yaml"
},
"CVE-2022-47075": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Smart Office Web 20.28 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47075.yaml"
},
"CVE-2022-47501": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Apache OFBiz < 18.12.07 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47501.yaml"
},
"CVE-2022-47615": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "LearnPress Plugin < 4.2.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47615.yaml"
},
"CVE-2022-47945": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Thinkphp Lang - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47945.yaml"
},
"CVE-2022-47966": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "ManageEngine - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47966.yaml"
},
"CVE-2022-47986": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47986.yaml"
},
"CVE-2022-48012": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCATS 0.9.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48012.yaml"
},
"CVE-2022-48164": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48164.yaml"
},
"CVE-2022-48165": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "Wavlink - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48165.yaml"
},
"CVE-2022-48166": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48166.yaml"
},
"CVE-2022-48197": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48197.yaml"
},
"CVE-2022-48253": {
"name": "Nostromo nhttpd path traversal",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-48253.yaml"
},
"CVE-2022-48323": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48323.yaml"
},
"CVE-2022-4897": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress BackupBuddy <8.8.3 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4897.yaml"
},
"CVE-2022-4940": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-862",
"name": "WCFM Membership <= 2.10.0 - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4940.yaml"
},
"CVE-2022-4971": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sassy Social Share <= 3.3.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4971.yaml"
},
"CVE-2023-0037": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0037.yaml"
},
"CVE-2023-0099": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Simple URLs < 115 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0099.yaml"
},
"CVE-2023-0126": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SonicWall SMA1000 LFI",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0126.yaml"
},
"CVE-2023-0159": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0159.yaml"
},
"CVE-2023-0236": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Tutor LMS <2.0.10 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0236.yaml"
},
"CVE-2023-0261": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0261.yaml"
},
"CVE-2023-0297": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0297.yaml"
},
"CVE-2023-0334": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0334.yaml"
},
"CVE-2023-0448": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Helper Lite < 4.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0448.yaml"
},
"CVE-2023-0514": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Membership Database <= 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0514.yaml"
},
"CVE-2023-0527": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Online Security Guards Hiring System - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0527.yaml"
},
"CVE-2023-0552": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Pie Register <3.8.2.3 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0552.yaml"
},
"CVE-2023-0562": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Bank Locker Management System v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0562.yaml"
},
"CVE-2023-0563": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Bank Locker Management System - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0563.yaml"
},
"CVE-2023-0600": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0600.yaml"
},
"CVE-2023-0602": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0602.yaml"
},
"CVE-2023-0630": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0630.yaml"
},
"CVE-2023-0669": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Fortra GoAnywhere MFT - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0669.yaml"
},
"CVE-2023-0676": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpIPAM 1.5.1 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0676.yaml"
},
"CVE-2023-0678": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "PHPIPAM <v1.5.1 - Missing Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0678.yaml"
},
"CVE-2023-0777": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "modoboa  2.0.4 - Admin TakeOver",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0777.yaml"
},
"CVE-2023-0876": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Meta SEO <= 4.5.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0876.yaml"
},
"CVE-2023-0900": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "AP Pricing Tables Lite <= 1.1.6 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0900.yaml"
},
"CVE-2023-0942": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0942.yaml"
},
"CVE-2023-0947": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Flatpress < 1.3 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0947.yaml"
},
"CVE-2023-0948": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0948.yaml"
},
"CVE-2023-0968": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0968.yaml"
},
"CVE-2023-1020": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1020.yaml"
},
"CVE-2023-1080": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress GN Publisher <1.5.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1080.yaml"
},
"CVE-2023-1119": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1119.yaml"
},
"CVE-2023-1177": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Mlflow <2.2.1 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1177.yaml"
},
"CVE-2023-1263": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1263.yaml"
},
"CVE-2023-1315": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < v1.16.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1315.yaml"
},
"CVE-2023-1317": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < v1.16.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1317.yaml"
},
"CVE-2023-1318": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "osTicket < v1.16.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1318.yaml"
},
"CVE-2023-1362": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-1021",
"name": "unilogies/bumsys < v2.0.2 - Clickjacking",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1362.yaml"
},
"CVE-2023-1389": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1389.yaml"
},
"CVE-2023-1408": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Video List Manager <= 1.7 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1408.yaml"
},
"CVE-2023-1434": {
"name": "Odoo - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2023-1434.yaml"
},
"CVE-2023-1454": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Jeecg-boot 3.5.0 qurestSql - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1454.yaml"
},
"CVE-2023-1496": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Imgproxy < 3.14.0 - Cross-site Scripting (XSS)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1496.yaml"
},
"CVE-2023-1546": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MyCryptoCheckout < 2.124 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1546.yaml"
},
"CVE-2023-1671": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Sophos Web Appliance - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1671.yaml"
},
"CVE-2023-1698": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "WAGO - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1698.yaml"
},
"CVE-2023-1719": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-665",
"name": "Bitrix Component - Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1719.yaml"
},
"CVE-2023-1730": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SupportCandy < 3.1.5 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1730.yaml"
},
"CVE-2023-1780": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1780.yaml"
},
"CVE-2023-1835": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ninja Forms < 3.6.22 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1835.yaml"
},
"CVE-2023-1880": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Phpmyfaq v3.1.11 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1880.yaml"
},
"CVE-2023-1890": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Tablesome < 1.0.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1890.yaml"
},
"CVE-2023-1892": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "Sidekiq < 7.0.8 - Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1892.yaml"
},
"CVE-2023-1893": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Login Configurator <=2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1893.yaml"
},
"CVE-2023-20073": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Cisco VPN Routers - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20073.yaml"
},
"CVE-2023-2009": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Pretty Url <= 1.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2009.yaml"
},
"CVE-2023-20198": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Cisco IOS XE Web UI - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20198.yaml"
},
"CVE-2023-2023": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Custom 404 Pro < 3.7.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2023.yaml"
},
"CVE-2023-2059": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-28",
"name": "DedeCMS 5.7.87 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2059.yaml"
},
"CVE-2023-20864": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "VMware Aria Operations for Logs - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20864.yaml"
},
"CVE-2023-20887": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "VMware VRealize Network Insight - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20887.yaml"
},
"CVE-2023-20888": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "VMware Aria Operations for Networks - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20888.yaml"
},
"CVE-2023-20889": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-77",
"name": "VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20889.yaml"
},
"CVE-2023-2122": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2122.yaml"
},
"CVE-2023-2130": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Purchase Order Management v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2130.yaml"
},
"CVE-2023-2178": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Aajoda Testimonials < 2.2.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2178.yaml"
},
"CVE-2023-21839": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Oracle WebLogic Server - Unauthorized Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-21839.yaml"
},
"CVE-2023-22047": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Oracle Peoplesoft - Unauthenticated File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22047.yaml"
},
"CVE-2023-22232": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": "Adobe Connect < 12.1.5 - Local File Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22232.yaml"
},
"CVE-2023-2224": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Seo By 10Web < 1.2.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2224.yaml"
},
"CVE-2023-2227": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-285",
"name": "Modoboa < 2.1.0 - Improper Authorization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2227.yaml"
},
"CVE-2023-22432": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Web2py URL - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22432.yaml"
},
"CVE-2023-22463": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "KubePi JwtSigKey - Admin Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22463.yaml"
},
"CVE-2023-22478": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22478.yaml"
},
"CVE-2023-22480": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "KubeOperator Foreground `kubeconfig` - File Download",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22480.yaml"
},
"CVE-2023-22515": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Atlassian Confluence - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml"
},
"CVE-2023-22518": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Atlassian Confluence Server - Improper Authorization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22518.yaml"
},
"CVE-2023-2252": {
"cvss": 2.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Directorist < 7.5.4 - Local File Inclusion",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2252.yaml"
},
"CVE-2023-22527": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Atlassian Confluence - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22527.yaml"
},
"CVE-2023-2256": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2256.yaml"
},
"CVE-2023-22620": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "SecurePoint UTM 12.x Session ID Leak",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22620.yaml"
},
"CVE-2023-22621": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Strapi Versions <=4.5.5 - SSTI to Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22621.yaml"
},
"CVE-2023-22629": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "TitanFTP move-file Function \u2264 1.94.1205 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-22629.yaml"
},
"CVE-2023-2272": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Tiempo.com <= 0.1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2272.yaml"
},
"CVE-2023-22893": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Strapi Versions <=4.5.6 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22893.yaml"
},
"CVE-2023-22897": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-908",
"name": "Securepoint UTM - Leaking Remote Memory Contents",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22897.yaml"
},
"CVE-2023-22952": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "SugarCRM Unauthenticated - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22952.yaml"
},
"CVE-2023-23063": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Cellinx NVT Web Server - Local File Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23063.yaml"
},
"CVE-2023-2309": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "wpForo Forum <= 2.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2309.yaml"
},
"CVE-2023-23161": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Art Gallery Management System Project v1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23161.yaml"
},
"CVE-2023-23333": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "SolarView Compact 6.00 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23333.yaml"
},
"CVE-2023-23488": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23488.yaml"
},
"CVE-2023-23489": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23489.yaml"
},
"CVE-2023-23491": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Quick Event Manager < 9.7.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23491.yaml"
},
"CVE-2023-23492": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Login with Phone Number - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23492.yaml"
},
"CVE-2023-2356": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-23",
"name": "Mlflow <2.3.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2356.yaml"
},
"CVE-2023-23752": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Joomla! Webservice - Password Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23752.yaml"
},
"CVE-2023-23897": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-352",
"name": "Ozette Plugins - Cross-Site Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23897.yaml"
},
"CVE-2023-24000": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress GamiPress <= 2.5.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24000.yaml"
},
"CVE-2023-24044": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Plesk Obsidian - Host Header Injection",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2023-24044.yaml"
},
"CVE-2023-24243": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "CData RSB Connect v22.0.8336 - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24243.yaml"
},
"CVE-2023-24278": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Squidex <7.4.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24278.yaml"
},
"CVE-2023-24322": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mojoPortal 2.7.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24322.yaml"
},
"CVE-2023-24367": {
"name": "Temenos T24 R20 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2023-24367.yaml"
},
"CVE-2023-2437": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "UserPro <= 5.1.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2437.yaml"
},
"CVE-2023-24488": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Citrix Gateway and Citrix ADC - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24488.yaml"
},
"CVE-2023-24489": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24489.yaml"
},
"CVE-2023-24657": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpIPAM - 1.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24657.yaml"
},
"CVE-2023-24733": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PMB 7.4.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24733.yaml"
},
"CVE-2023-24735": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "PMB 7.4.6 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24735.yaml"
},
"CVE-2023-24737": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PMB v7.4.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24737.yaml"
},
"CVE-2023-2479": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Appium Desktop Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2479.yaml"
},
"CVE-2023-25135": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25135.yaml"
},
"CVE-2023-25157": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "GeoServer OGC Filter - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25157.yaml"
},
"CVE-2023-2518": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2518.yaml"
},
"CVE-2023-25194": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Druid Kafka Connect - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25194.yaml"
},
"CVE-2023-25280": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25280.yaml"
},
"CVE-2023-25346": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ChurchCRM 4.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25346.yaml"
},
"CVE-2023-25573": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Metersphere - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25573.yaml"
},
"CVE-2023-25717": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Ruckus Wireless Admin - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25717.yaml"
},
"CVE-2023-25727": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-661",
"name": "phpMyAdmin <4.9.11 and <5.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2023-25727.yaml"
},
"CVE-2023-25826": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25826.yaml"
},
"CVE-2023-26035": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "ZoneMinder Snapshots - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26035.yaml"
},
"CVE-2023-26067": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Lexmark Printers - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26067.yaml"
},
"CVE-2023-2624": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "KiviCare WordPress Plugin - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2624.yaml"
},
"CVE-2023-26255": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26255.yaml"
},
"CVE-2023-26256": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26256.yaml"
},
"CVE-2023-26258": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Arcserve UDP <= 9.0.6034 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26258.yaml"
},
"CVE-2023-26347": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "Adobe Coldfusion - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26347.yaml"
},
"CVE-2023-26360": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "Adobe ColdFusion - Local File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml"
},
"CVE-2023-2640": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-2640.yaml"
},
"CVE-2023-26469": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Jorani 1.0.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26469.yaml"
},
"CVE-2023-2648": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Weaver E-Office 9.5 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2648.yaml"
},
"CVE-2023-26802": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "DCBI-Netlog-LAB v1.0 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26802.yaml"
},
"CVE-2023-26842": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ChurchCRM 4.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26842.yaml"
},
"CVE-2023-26843": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ChurchCRM 4.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26843.yaml"
},
"CVE-2023-27008": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ATutor < 2.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27008.yaml"
},
"CVE-2023-27032": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop AdvancedPopupCreator - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27032.yaml"
},
"CVE-2023-27034": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Jms Blog - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27034.yaml"
},
"CVE-2023-27159": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Appwrite <=1.2.1 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27159.yaml"
},
"CVE-2023-27163": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "Request-Baskets <= 1.2.1 - Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27163.yaml"
},
"CVE-2023-27179": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-434",
"name": "GDidees CMS v3.9.1 - Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27179.yaml"
},
"CVE-2023-27292": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "OpenCATS - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27292.yaml"
},
"CVE-2023-2732": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "MStore API <= 3.9.2 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2732.yaml"
},
"CVE-2023-2734": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "MStore API <= 3.9.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2734.yaml"
},
"CVE-2023-27350": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "PaperCut - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27350.yaml"
},
"CVE-2023-27351": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-287",
"name": "PaperCut NG - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27351.yaml"
},
"CVE-2023-27372": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SPIP - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27372.yaml"
},
"CVE-2023-2745": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-22",
"name": "WordPress Core <=6.2 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2745.yaml"
},
"CVE-2023-27482": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Home Assistant Supervisor - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27482.yaml"
},
"CVE-2023-27524": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1188",
"name": "Apache Superset - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27524.yaml"
},
"CVE-2023-27584": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-321",
"name": "Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27584.yaml"
},
"CVE-2023-27587": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-209",
"name": "ReadToMyShoe - Generation of Error Message Containing Sensitive Information",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27587.yaml"
},
"CVE-2023-27624": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27624.yaml"
},
"CVE-2023-27637": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop `tshirtecommerce` Module - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27637.yaml"
},
"CVE-2023-27638": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "tshirtecommerce PrestaShop Module - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27638.yaml"
},
"CVE-2023-27639": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "PrestaShop TshirteCommerce - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27639.yaml"
},
"CVE-2023-27640": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "PrestaShop tshirtecommerce - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27640.yaml"
},
"CVE-2023-27641": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "L-Soft LISTSERV 16.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27641.yaml"
},
"CVE-2023-2766": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Weaver OA 9.5 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2766.yaml"
},
"CVE-2023-2779": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Super Socializer < 7.13.52 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2779.yaml"
},
"CVE-2023-2780": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-29",
"name": "Mlflow <2.3.1 - Local File Inclusion Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2780.yaml"
},
"CVE-2023-27847": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop xipblog - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27847.yaml"
},
"CVE-2023-27922": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Newsletter < 7.6.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27922.yaml"
},
"CVE-2023-2796": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "EventON <= 2.1 - Missing Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2796.yaml"
},
"CVE-2023-28121": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WooCommerce Payments - Unauthorized Admin Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28121.yaml"
},
"CVE-2023-2813": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Wordpress Multiple Themes - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2813.yaml"
},
"CVE-2023-2822": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ellucian Ethos Identity CAS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2822.yaml"
},
"CVE-2023-2825": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "GitLab 16.0.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2825.yaml"
},
"CVE-2023-28343": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Altenergy Power Control Software C1.2.5 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28343.yaml"
},
"CVE-2023-28375": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-598",
"name": "Osprey Pump Controller 1.0.1 Unauthenticated File Disclosure",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2023-28375.yaml"
},
"CVE-2023-28432": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "MinIO Cluster Deployment - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28432.yaml"
},
"CVE-2023-28461": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Array Networks AG/vxAG SSL VPN - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-2023-28461.yaml"
},
"CVE-2023-28648": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Osprey Pump Controller 1.0.1 - Unauthenticated Reflected XSS",
"severity": "medium",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2023-28648.yaml"
},
"CVE-2023-28662": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Wordpress Gift Cards <= 4.3.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28662.yaml"
},
"CVE-2023-28665": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Woo Bulk Price Update <2.2.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28665.yaml"
},
"CVE-2023-28777": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-28777-sfwd_lms-40a57493-b99b-4e71-8603-e668c6283a5a.yaml"
},
"CVE-2023-28787": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Quiz and Survey Master <= 8.1.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28787.yaml"
},
"CVE-2023-29084": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "ManageEngine ADManager Plus - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29084.yaml"
},
"CVE-2023-29204": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "XWiki - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29204.yaml"
},
"CVE-2023-29298": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Adobe ColdFusion - Access Control Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29298.yaml"
},
"CVE-2023-29300": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Adobe ColdFusion - Pre-Auth Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml"
},
"CVE-2023-29357": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Microsoft SharePoint - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29357.yaml"
},
"CVE-2023-29439": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FooGallery plugin <= 2.2.35 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29439.yaml"
},
"CVE-2023-2948": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenEMR < 7.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2948.yaml"
},
"CVE-2023-29489": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "cPanel < 11.109.9999.116 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29489.yaml"
},
"CVE-2023-2949": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenEMR < 7.0.1 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2949.yaml"
},
"CVE-2023-29506": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki >= 13.10.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29506.yaml"
},
"CVE-2023-29622": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Purchase Order Management v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2023-29622.yaml"
},
"CVE-2023-29623": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Purchase Order Management v1.0 - Cross Site Scripting (Reflected)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29623.yaml"
},
"CVE-2023-29629": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Prestashop jmsthemelayout 2.5.5 SQL Injection",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2023-29629.yaml"
},
"CVE-2023-29630": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2023-29630.yaml"
},
"CVE-2023-29632": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2023-29632.yaml"
},
"CVE-2023-2982": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2982.yaml"
},
"CVE-2023-29827": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Embedded JavaScript(EJS) 3.1.6 - Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29827.yaml"
},
"CVE-2023-2986": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Abandoned Cart Lite for WooCommerce - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-2986.yaml"
},
"CVE-2023-29887": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29887.yaml"
},
"CVE-2023-29919": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-276",
"name": "SolarView Compact <= 6.00 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29919.yaml"
},
"CVE-2023-29922": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-1188",
"name": "PowerJob V4.3.1 - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29922.yaml"
},
"CVE-2023-29923": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-276",
"name": "PowerJob <=4.3.2 - Unauthenticated Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29923.yaml"
},
"CVE-2023-30013": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TOTOLink - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30013.yaml"
},
"CVE-2023-30019": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30019.yaml"
},
"CVE-2023-30150": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30150.yaml"
},
"CVE-2023-30192": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop 'possearchproducts' <= 1.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30192.yaml"
},
"CVE-2023-30194": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Prestashop posstaticfooter <= 1.0.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30194.yaml"
},
"CVE-2023-30210": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OURPHP <= 7.2.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30210.yaml"
},
"CVE-2023-30212": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OURPHP <= 7.2.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30212.yaml"
},
"CVE-2023-30256": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Webkul QloApps 1.5.2 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30256.yaml"
},
"CVE-2023-30258": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "MagnusBilling - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30258.yaml"
},
"CVE-2023-30534": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-502",
"name": "Cacti < 1.2.25 Insecure Deserialization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30534.yaml"
},
"CVE-2023-30625": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Rudder Server < 1.3.0-rc.1 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30625.yaml"
},
"CVE-2023-3077": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "MStore API < 3.9.8 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3077.yaml"
},
"CVE-2023-30777": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advanced Custom Fields < 6.1.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30777.yaml"
},
"CVE-2023-30868": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Tree Page View Plugin < 1.6.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30868.yaml"
},
"CVE-2023-30869": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Easy Digital Downloads - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30869.yaml"
},
"CVE-2023-30943": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": "Moodle - Cross-Site Scripting/Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30943.yaml"
},
"CVE-2023-3105": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-3105-sfwd_lms-2318b3e1-268d-45fa-83bf-c6e88f1b9013.yaml"
},
"CVE-2023-31059": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Repetier Server - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31059.yaml"
},
"CVE-2023-3128": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-290",
"name": "Grafana Account Takeover / Authentication Bypass",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2023-3128.yaml"
},
"CVE-2023-3139": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Protect WP Admin < 4.0 - Unauthenticated Protection Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3139.yaml"
},
"CVE-2023-31446": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Cassia Gateway Firmware - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31446.yaml"
},
"CVE-2023-31465": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "TimeKeeper by FSMLabs - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31465.yaml"
},
"CVE-2023-31478": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "GL.iNET SSID Key Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31478.yaml"
},
"CVE-2023-31548": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ChurchCRM v4.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31548.yaml"
},
"CVE-2023-3169": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "tagDiv Composer < 4.2 - Stored Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3169.yaml"
},
"CVE-2023-3188": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Owncast - Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3188.yaml"
},
"CVE-2023-3197": {
"name": "WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3197.yaml"
},
"CVE-2023-32068": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "XWiki - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32068.yaml"
},
"CVE-2023-32077": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Netmaker - Hardcoded DNS Secret Key",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32077.yaml"
},
"CVE-2023-32117": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"name": "Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32117.yaml"
},
"CVE-2023-3219": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-639",
"name": "EventON Lite < 2.1.2 - Arbitrary File Download",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3219.yaml"
},
"CVE-2023-32235": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Ghost CMS < 5.42.1 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32235.yaml"
},
"CVE-2023-32243": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32243.yaml"
},
"CVE-2023-32315": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Openfire Administration Console - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32315.yaml"
},
"CVE-2023-32563": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Ivanti Avalanche - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32563.yaml"
},
"CVE-2023-32590": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-89",
"name": "Subscribe to Category <= 2.7.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32590.yaml"
},
"CVE-2023-3277": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3277.yaml"
},
"CVE-2023-33193": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-444",
"name": "Emby Server - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33193.yaml"
},
"CVE-2023-33246": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "RocketMQ <= 5.1.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-33246.yaml"
},
"CVE-2023-33338": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Old Age Home Management System v1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33338.yaml"
},
"CVE-2023-33405": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "BlogEngine CMS - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33405.yaml"
},
"CVE-2023-33439": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Faculty Evaluation System v1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33439.yaml"
},
"CVE-2023-33440": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Faculty Evaluation System v1.0 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33440.yaml"
},
"CVE-2023-3345": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "LMS by Masteriyo < 1.6.8 - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3345.yaml"
},
"CVE-2023-33510": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "Jeecg P3 Biz Chat - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33510.yaml"
},
"CVE-2023-33568": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Dolibarr Unauthenticated Contacts Database Theft",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33568.yaml"
},
"CVE-2023-33584": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Enrollment System Project v1.0 - SQL Injection Authentication Bypass",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder5/CVE-2023-33584.yaml"
},
"CVE-2023-33629": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-787",
"name": "H3C Magic R300-2100M - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33629.yaml"
},
"CVE-2023-3368": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Chamilo LMS <= v1.11.20 Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3368.yaml"
},
"CVE-2023-3380": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "WAVLINK WN579X3 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3380.yaml"
},
"CVE-2023-33831": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "FUXA - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33831.yaml"
},
"CVE-2023-3388": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3388.yaml"
},
"CVE-2023-33960": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "OpenProject < 12.5.4 - Project Identifiers Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33960.yaml"
},
"CVE-2023-34020": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"cwe": "CWE-601",
"name": "Uncanny Toolkit for LearnDash - Open Redirection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34020.yaml"
},
"CVE-2023-34039": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-327",
"name": "VMWare Aria Operations - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-34039.yaml"
},
"CVE-2023-34048": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-787",
"name": "VMware vCenter Server - Out-of-Bounds Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34048.yaml"
},
"CVE-2023-34092": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-50",
"name": "Vite Dev Server - Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34092.yaml"
},
"CVE-2023-34096": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"name": "Thruk Monitoring Web Interface - Path Traversal",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2023-34096.yaml"
},
"CVE-2023-34105": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"name": "SRS - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34105.yaml"
},
"CVE-2023-34124": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SonicWall GMS and Analytics Web Services - Shell Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34124.yaml"
},
"CVE-2023-34133": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "SonicWall GMS and Analytics - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34133.yaml"
},
"CVE-2023-34192": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34192.yaml"
},
"CVE-2023-34259": {
"cvss": 4.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Kyocera TASKalfa printer - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34259.yaml"
},
"CVE-2023-34362": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "MOVEit Transfer - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34362.yaml"
},
"CVE-2023-3452": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WordPress Canto Plugin <= 3.0.4 - File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3452.yaml"
},
"CVE-2023-34537": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Hoteldruid 3.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34537.yaml"
},
"CVE-2023-34598": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Gibbon v25.0.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34598.yaml"
},
"CVE-2023-34599": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Gibbon v25.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34599.yaml"
},
"CVE-2023-3460": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3460.yaml"
},
"CVE-2023-34659": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "JeecgBoot 3.5.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34659.yaml"
},
"CVE-2023-34751": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34751.yaml"
},
"CVE-2023-34752": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34752.yaml"
},
"CVE-2023-34753": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34753.yaml"
},
"CVE-2023-34754": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Bloofox v0.5.2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34754.yaml"
},
"CVE-2023-34755": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34755.yaml"
},
"CVE-2023-34756": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Bloofox v0.5.2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34756.yaml"
},
"CVE-2023-3479": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Hestiacp <= 1.7.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3479.yaml"
},
"CVE-2023-34843": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Traggo Server - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34843.yaml"
},
"CVE-2023-34960": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Chamilo Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34960.yaml"
},
"CVE-2023-34990": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "FortiWLM - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34990.yaml"
},
"CVE-2023-34992": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Fortinet FortiSIEM - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-34992.yaml"
},
"CVE-2023-34993": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Fortinet FortiWLM Unauthenticated Command Injection Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34993.yaml"
},
"CVE-2023-35078": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35078.yaml"
},
"CVE-2023-35082": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "MobileIron Core - Remote Unauthenticated API Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35082.yaml"
},
"CVE-2023-35086": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-134",
"name": "ASUS RT-AX56U V2 & RT-AC86U - Unauthenticated Remote Command Injection",
"severity": "critical",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2023-35086.yaml"
},
"CVE-2023-35155": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35155.yaml"
},
"CVE-2023-35156": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki >= 6.0-rc-1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35156.yaml"
},
"CVE-2023-35158": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-87",
"name": "XWiki - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35158.yaml"
},
"CVE-2023-35159": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki >= 3.4-milestone-1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35159.yaml"
},
"CVE-2023-35160": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki >= 2.5-milestone-2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35160.yaml"
},
"CVE-2023-35161": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki >= 6.2-milestone-1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35161.yaml"
},
"CVE-2023-35162": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki < 14.10.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35162.yaml"
},
"CVE-2023-3519": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3519.yaml"
},
"CVE-2023-3521": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "FOSSBilling < 0.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3521.yaml"
},
"CVE-2023-35708": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "MOVEit Transfer - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35708.yaml"
},
"CVE-2023-3578": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "DedeCMS 5.7.109 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3578.yaml"
},
"CVE-2023-35813": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Sitecore - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35813.yaml"
},
"CVE-2023-35843": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "NocoDB version <= 0.106.1 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35843.yaml"
},
"CVE-2023-35844": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Lightdash version <= 0.510.3 Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35844.yaml"
},
"CVE-2023-35885": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-565",
"name": "Cloudpanel 2 < 2.3.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35885.yaml"
},
"CVE-2023-36144": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Intelbras Switch - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36144.yaml"
},
"CVE-2023-36284": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "QloApps 1.6.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36284.yaml"
},
"CVE-2023-36287": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Webkul QloApps 1.6.0 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36287.yaml"
},
"CVE-2023-36289": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Webkul QloApps 1.6.0 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36289.yaml"
},
"CVE-2023-36306": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36306.yaml"
},
"CVE-2023-36346": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "POS Codekop v2.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36346.yaml"
},
"CVE-2023-36347": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "POS Codekop v2.0 - Broken Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36347.yaml"
},
"CVE-2023-3643": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "CAREL Boss Mini <= 1.4.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3643.yaml"
},
"CVE-2023-36844": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-473",
"name": "Juniper Devices - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml"
},
"CVE-2023-36845": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-473",
"name": "Juniper J-Web - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36845.yaml"
},
"CVE-2023-36934": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "MOVEit Transfer - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36934.yaml"
},
"CVE-2023-3710": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Honeywell PM43 Printers - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3710.yaml"
},
"CVE-2023-3722": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"cwe": "CWE-434",
"name": "Avaya Aura Device Services - OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3722.yaml"
},
"CVE-2023-37265": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "CasaOS  < 0.4.4 - Authentication Bypass via Internal IP",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37265.yaml"
},
"CVE-2023-37266": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "CasaOS  < 0.4.4 - Authentication Bypass via Random JWT Token",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37266.yaml"
},
"CVE-2023-37270": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Piwigo 13.7.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37270.yaml"
},
"CVE-2023-37462": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "XWiki Platform - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37462.yaml"
},
"CVE-2023-37474": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Copyparty <= 1.8.2 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37474.yaml"
},
"CVE-2023-37580": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37580.yaml"
},
"CVE-2023-37582": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Apache RocketMQ - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-37582.yaml"
},
"CVE-2023-37599": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-668",
"name": "Issabel PBX 4.0.0-6 - Directory Listing",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37599.yaml"
},
"CVE-2023-37629": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Online Piggery Management System v1.0 - Unauthenticated File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37629.yaml"
},
"CVE-2023-37645": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-668",
"name": "EyouCms v1.6.3 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37645.yaml"
},
"CVE-2023-3765": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-36",
"name": "MLflow Absolute Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3765.yaml"
},
"CVE-2023-37679": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "NextGen Mirth Connect - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37679.yaml"
},
"CVE-2023-37728": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp Webmail Server v10.2.1 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37728.yaml"
},
"CVE-2023-37979": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ninja Forms < 3.6.26 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37979.yaml"
},
"CVE-2023-37988": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contact Form Generator <= 2.5.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37988.yaml"
},
"CVE-2023-37999": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "HT Mega \u2013 Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37999.yaml"
},
"CVE-2023-38035": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Ivanti Sentry - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38035.yaml"
},
"CVE-2023-38040": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Revive Adserver 5.4.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38040.yaml"
},
"CVE-2023-38192": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SuperWebMailer 9.00.0.01710 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38192.yaml"
},
"CVE-2023-38194": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SuperWebMailer - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38194.yaml"
},
"CVE-2023-38203": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Adobe ColdFusion - Deserialization of Untrusted Data",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38203.yaml"
},
"CVE-2023-38205": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Adobe ColdFusion - Access Control Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38205.yaml"
},
"CVE-2023-3836": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Dahua Smart Park Management - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3836.yaml"
},
"CVE-2023-3843": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mooDating 1.2 - Cross-site scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3843.yaml"
},
"CVE-2023-38433": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-798",
"name": "Fujitsu IP Series - Hardcoded Credentials",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38433.yaml"
},
"CVE-2023-3844": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooDating 1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3844.yaml"
},
"CVE-2023-3845": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooDating 1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3845.yaml"
},
"CVE-2023-3846": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooDating 1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3846.yaml"
},
"CVE-2023-3847": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooDating 1.2 - Cross-Site scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3847.yaml"
},
"CVE-2023-3848": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooDating 1.2 - Cross-site scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3848.yaml"
},
"CVE-2023-3849": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mooDating 1.2 - Cross-site scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3849.yaml"
},
"CVE-2023-38501": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CopyParty v1.8.6 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38501.yaml"
},
"CVE-2023-38646": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Metabase < 0.46.6.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38646.yaml"
},
"CVE-2023-38875": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHP Login System 2.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38875.yaml"
},
"CVE-2023-38879": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "openSIS v9.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38879.yaml"
},
"CVE-2023-38950": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ZKTeco BioTime v8.5.5 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38950.yaml"
},
"CVE-2023-38952": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "ZKTeco BioTime <= 9.0.1 - Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38952.yaml"
},
"CVE-2023-38964": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Academy LMS 6.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38964.yaml"
},
"CVE-2023-38992": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Jeecg-Boot v3.5.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38992.yaml"
},
"CVE-2023-39002": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OPNsense - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39002.yaml"
},
"CVE-2023-39007": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "OPNsense - Cross-Site Scripting to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39007.yaml"
},
"CVE-2023-39026": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "FileMage Gateway - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39026.yaml"
},
"CVE-2023-39108": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "rConfig 3.9.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39108.yaml"
},
"CVE-2023-39109": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "rConfig 3.9.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39109.yaml"
},
"CVE-2023-39110": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "rConfig 3.9.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39110.yaml"
},
"CVE-2023-39120": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Nodogsplash - Directory Traversal",
"severity": "high",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2023-39120.yaml"
},
"CVE-2023-39121": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Emlog 2.1.9 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39121.yaml"
},
"CVE-2023-39141": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Aria2 WebUI - Path traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39141.yaml"
},
"CVE-2023-39143": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "PaperCut < 22.1.3 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39143.yaml"
},
"CVE-2023-39306": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "medium",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-39306-fusion_builder-b173523a-e79d-4d2d-af67-5372576df220.yaml"
},
"CVE-2023-39309": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-39309-fusion_builder-7c734aa9-ee9e-4605-a4b8-5075ce4b941f.yaml"
},
"CVE-2023-39310": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-39310-fusion_builder-35b3a82a-4391-41b0-b434-691743c5ff4d.yaml"
},
"CVE-2023-39311": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"name": ">",
"severity": "medium",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-39311-fusion_builder-05220967-dd42-4cb9-9c2f-9c7ac3c0926b.yaml"
},
"CVE-2023-3936": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Blog2Social < 7.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3936.yaml"
},
"CVE-2023-39361": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cacti 1.2.24 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39361.yaml"
},
"CVE-2023-39560": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ECTouch v2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39560.yaml"
},
"CVE-2023-39598": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp Email Client - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39598.yaml"
},
"CVE-2023-39600": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp 11.4.6.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39600.yaml"
},
"CVE-2023-39650": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop Theme Volty CMS Blog - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39650.yaml"
},
"CVE-2023-39676": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PrestaShop fieldpopupnewsletter Module - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39676.yaml"
},
"CVE-2023-39677": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "PrestaShop MyPrestaModules - PhpInfo Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39677.yaml"
},
"CVE-2023-39700": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp Mail Server v10.4.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39700.yaml"
},
"CVE-2023-39796": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WBCE 1.6.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39796.yaml"
},
"CVE-2023-3990": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Mingsoft MCMS < 5.3.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3990.yaml"
},
"CVE-2023-40000": {
"cvss": 8.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40000.yaml"
},
"CVE-2023-40044": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "WS_FTP Server - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40044.yaml"
},
"CVE-2023-40068": {
"name": "XSS in Wordpress plugin, Advanced Custom Fields",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2023-40068.yaml"
},
"CVE-2023-40208": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Stock Ticker <= 3.23.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40208.yaml"
},
"CVE-2023-40211": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Post Grid <= 2.2.50 - Information Exposure via REST API",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40211.yaml"
},
"CVE-2023-40355": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Axigen WebMail - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40355.yaml"
},
"CVE-2023-40504": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "LG Simple Editor <= v3.21.0 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40504.yaml"
},
"CVE-2023-40600": {
"name": "EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40600.yaml"
},
"CVE-2023-40748": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PHPJabbers Food Delivery Script - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40748.yaml"
},
"CVE-2023-40749": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PHPJabbers Food Delivery Script v3.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40749.yaml"
},
"CVE-2023-40750": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40750.yaml"
},
"CVE-2023-40751": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40751.yaml"
},
"CVE-2023-40752": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40752.yaml"
},
"CVE-2023-40753": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40753.yaml"
},
"CVE-2023-40755": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Callback Widget v1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40755.yaml"
},
"CVE-2023-40779": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "IceWarp Mail Server Deep Castle 2 v.13.0.1.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40779.yaml"
},
"CVE-2023-40924": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SolarView Compact < 6.00 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40924.yaml"
},
"CVE-2023-40931": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Nagios XI v5.11.0 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40931.yaml"
},
"CVE-2023-4110": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4110.yaml"
},
"CVE-2023-41109": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41109.yaml"
},
"CVE-2023-4111": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4111.yaml"
},
"CVE-2023-4112": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4112.yaml"
},
"CVE-2023-4113": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Service Booking Script 1.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4113.yaml"
},
"CVE-2023-4114": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4114.yaml"
},
"CVE-2023-4115": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4115.yaml"
},
"CVE-2023-4116": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers Taxi Booking 2.0 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4116.yaml"
},
"CVE-2023-41265": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-444",
"name": "Qlik Sense Enterprise - HTTP Request Smuggling",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41265.yaml"
},
"CVE-2023-41266": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-20",
"name": "Qlik Sense Enterprise - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41266.yaml"
},
"CVE-2023-4136": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CrafterCMS Engine - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4136.yaml"
},
"CVE-2023-4148": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ditty < 3.1.25 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4148.yaml"
},
"CVE-2023-4151": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Store Locator WordPress < 1.4.13 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4151.yaml"
},
"CVE-2023-41538": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41538.yaml"
},
"CVE-2023-41597": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "EyouCms v1.6.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41597.yaml"
},
"CVE-2023-41599": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "JFinalCMS v5.0.0 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41599.yaml"
},
"CVE-2023-41621": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Emlog Pro v2.1.14 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41621.yaml"
},
"CVE-2023-41642": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "RealGimm by GruppoSCAI v1.1.37p38 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41642.yaml"
},
"CVE-2023-4165": {
"name": "Template Name",
"severity": "info",
"url": "https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2023-4165.yaml"
},
"CVE-2023-4168": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Adlisting Classified Ads 2.14.0 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4168.yaml"
},
"CVE-2023-4169": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Ruijie RG-EW1200G Router - Password Reset",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4169.yaml"
},
"CVE-2023-4173": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mooSocial 3.1.8 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4173.yaml"
},
"CVE-2023-4174": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mooSocial 3.1.6 - Reflected Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4174.yaml"
},
"CVE-2023-41763": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Skype for Business 2019 (SfB) - Blind Server-side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41763.yaml"
},
"CVE-2023-41892": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41892.yaml"
},
"CVE-2023-41954": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-269",
"name": "ProfilePress <= 4.13.1 \u2014 Unauthenticated Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41954.yaml"
},
"CVE-2023-4220": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-434",
"name": "Chamilo LMS <= 1.11.24 - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4220.yaml"
},
"CVE-2023-42343": {
"name": "OpenCMS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42343.yaml"
},
"CVE-2023-42344": {
"name": "OpenCMS - XML external entity (XXE)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42344.yaml"
},
"CVE-2023-42442": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-287",
"name": "JumpServer > 3.6.4 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42442.yaml"
},
"CVE-2023-42793": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "JetBrains TeamCity < 2023.05.4 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42793.yaml"
},
"CVE-2023-4284": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4284.yaml"
},
"CVE-2023-43177": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-913",
"name": "CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43177.yaml"
},
"CVE-2023-43187": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-91",
"name": "NodeBB XML-RPC Request xmlrpc.php - XML Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43187.yaml"
},
"CVE-2023-43208": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "NextGen Healthcare Mirth Connect - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43208.yaml"
},
"CVE-2023-43261": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-532",
"name": "Milesight Routers - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43261.yaml"
},
"CVE-2023-43323": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"name": "mooSocial 3.1.8 - External Service Interaction",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43323.yaml"
},
"CVE-2023-43325": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooSocial 3.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43325.yaml"
},
"CVE-2023-43326": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooSocial 3.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43326.yaml"
},
"CVE-2023-43373": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Hoteldruid v3.0.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43373.yaml"
},
"CVE-2023-43374": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Hoteldruid v3.0.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43374.yaml"
},
"CVE-2023-43472": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "MLFlow < 2.8.1 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43472.yaml"
},
"CVE-2023-43654": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "PyTorch TorchServe SSRF",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43654.yaml"
},
"CVE-2023-43662": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ShokoServer System - Local File Inclusion (LFI)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43662.yaml"
},
"CVE-2023-43795": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "GeoServer WPS - Server Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43795.yaml"
},
"CVE-2023-44012": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mojoPortal v.2.7.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44012.yaml"
},
"CVE-2023-4415": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Ruijie RG-EW1200G Router Background - Login Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4415.yaml"
},
"CVE-2023-44352": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Adobe Coldfusion - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44352.yaml"
},
"CVE-2023-44353": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Adobe ColdFusion WDDX Deserialization Gadgets",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44353.yaml"
},
"CVE-2023-44393": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Piwigo - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44393.yaml"
},
"CVE-2023-4450": {
"name": "JeecgBoot JimuReport - Template injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4450.yaml"
},
"CVE-2023-4451": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Cockpit - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4451.yaml"
},
"CVE-2023-44812": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mooSocial v.3.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44812.yaml"
},
"CVE-2023-44813": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "mooSocial v.3.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44813.yaml"
},
"CVE-2023-4490": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "WordPress Job Portal < 2.0.6 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4490.yaml"
},
"CVE-2023-44982": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44982.yaml"
},
"CVE-2023-45038": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cwe": "CWE-287",
"name": "QNAP Music Station < 5.4.0 - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45038.yaml"
},
"CVE-2023-45136": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki < 14.10.14 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45136.yaml"
},
"CVE-2023-4521": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4521.yaml"
},
"CVE-2023-45249": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Acronis Cyber Infrastructure - Default Password",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-45249.yaml"
},
"CVE-2023-45375": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop PireosPay - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45375.yaml"
},
"CVE-2023-4542": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "D-Link DAR-8000-10 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4542.yaml"
},
"CVE-2023-4547": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4547.yaml"
},
"CVE-2023-45542": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MooSocial 3.1.8 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45542.yaml"
},
"CVE-2023-45648": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-444",
"name": "Apache Tomcat - HTTP Request Smuggling",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45648.yaml"
},
"CVE-2023-45671": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Frigate < 0.13.0 Beta 3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45671.yaml"
},
"CVE-2023-4568": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-287",
"name": "PaperCut NG Unauthenticated XMLRPC Functionality",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4568.yaml"
},
"CVE-2023-45826": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Leantime < 2.4 - Authenticated SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45826.yaml"
},
"CVE-2023-45852": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Viessmann Vitogate 300 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45852.yaml"
},
"CVE-2023-45855": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "qdPM 9.2 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45855.yaml"
},
"CVE-2023-45878": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Gibbon LMS <= v25.0.01 - File Upload to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45878.yaml"
},
"CVE-2023-4596": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4596.yaml"
},
"CVE-2023-4634": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-73",
"name": "Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4634.yaml"
},
"CVE-2023-46347": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop Step by Step products Pack - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46347.yaml"
},
"CVE-2023-46359": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "cPH2 Charging Station v1.87.0 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46359.yaml"
},
"CVE-2023-46455": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-22",
"name": "GL.iNet <= 4.3.7 - Arbitrary File Write",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46455.yaml"
},
"CVE-2023-46574": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "TOTOLINK A3700R - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46574.yaml"
},
"CVE-2023-46604": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache ActiveMQ - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml"
},
"CVE-2023-46732": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki < 14.10.14 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46732.yaml"
},
"CVE-2023-46747": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "F5 BIG-IP - Unauthenticated RCE via AJP Smuggling",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46747.yaml"
},
"CVE-2023-46805": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-287",
"name": "Ivanti ICS - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46805.yaml"
},
"CVE-2023-46818": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "ISPConfig - PHP Code Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46818.yaml"
},
"CVE-2023-47105": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-78",
"name": "Chaosblade < 1.7.4 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47105.yaml"
},
"CVE-2023-47115": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Label Studio - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47115.yaml"
},
"CVE-2023-47117": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Label Studio - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47117.yaml"
},
"CVE-2023-4714": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "PlayTube 3.0.1 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4714.yaml"
},
"CVE-2023-47211": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"cwe": "CWE-22",
"name": "ManageEngine OpManager - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47211.yaml"
},
"CVE-2023-47218": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"cwe": "CWE-77",
"name": "QNAP QTS and QuTS Hero - OS Command Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47218.yaml"
},
"CVE-2023-47246": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "SysAid Server - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47246.yaml"
},
"CVE-2023-47248": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "PyArrow Flight RPC - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47248.yaml"
},
"CVE-2023-47253": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Qualitor <= 8.20 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47253.yaml"
},
"CVE-2023-47643": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "SuiteCRM Unauthenticated Graphql Introspection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47643.yaml"
},
"CVE-2023-47684": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Essential Grid <= 3.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47684.yaml"
},
"CVE-2023-47873": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47873.yaml"
},
"CVE-2023-48022": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Anyscale Ray - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48022.yaml"
},
"CVE-2023-48023": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"name": "Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48023.yaml"
},
"CVE-2023-48084": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Nagios XI < 5.11.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48084.yaml"
},
"CVE-2023-48241": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-285",
"name": "XWiki < 4.10.15 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48241.yaml"
},
"CVE-2023-48728": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48728.yaml"
},
"CVE-2023-48777": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Elementor 3.18.1 - File Upload/Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48777.yaml"
},
"CVE-2023-48788": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Fortinet Forticlient Endpoint Management Server - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-48788.yaml"
},
"CVE-2023-48795": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-354",
"name": "OpenSSH Terrapin Attack - Detection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-48795.yaml"
},
"CVE-2023-49070": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Apache OFBiz < 18.12.10 - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49070.yaml"
},
"CVE-2023-49103": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "OwnCloud - Phpinfo Configuration",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49103.yaml"
},
"CVE-2023-49105": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "OwnCloud - WebDAV API Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-49105.yaml"
},
"CVE-2023-4911": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Looney Tunables Linux - Local Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-4911.yaml"
},
"CVE-2023-49230": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49230.yaml"
},
"CVE-2023-49293": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-80",
"name": "Vite dev server - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49293.yaml"
},
"CVE-2023-49438": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Python Flask-Security-Too <=5.3.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49438.yaml"
},
"CVE-2023-49489": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49489.yaml"
},
"CVE-2023-49494": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DedeCMS v5.7.111 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49494.yaml"
},
"CVE-2023-4966": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Citrix Bleed - Leaking Session Tokens",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4966.yaml"
},
"CVE-2023-4973": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Academy LMS 6.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4973.yaml"
},
"CVE-2023-4974": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Academy LMS 6.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4974.yaml"
},
"CVE-2023-49785": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "ChatGPT-Next-Web - SSRF/XSS",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49785.yaml"
},
"CVE-2023-5003": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5003.yaml"
},
"CVE-2023-50094": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "reNgine 2.2.0 - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50094.yaml"
},
"CVE-2023-50290": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"name": "Apache Solr - Host Environment Variables Leak via Metrics API",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50290.yaml"
},
"CVE-2023-50578": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Mingsoft MCMS 5.2.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50578.yaml"
},
"CVE-2023-50719": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-359",
"name": "XWiki < 4.10.15 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50719.yaml"
},
"CVE-2023-50720": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "XWiki < 4.10.15 - Email Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50720.yaml"
},
"CVE-2023-5074": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "D-Link D-View 8 v2.0.1.28 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5074.yaml"
},
"CVE-2023-50839": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "JS Help Desk <= 2.8.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50839.yaml"
},
"CVE-2023-5089": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5089.yaml"
},
"CVE-2023-50917": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "MajorDoMo thumb.php - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50917.yaml"
},
"CVE-2023-50968": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Apache OFBiz < 18.12.11 - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50968.yaml"
},
"CVE-2023-51409": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Jordy Meow AI Engine - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51409.yaml"
},
"CVE-2023-51449": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Gradio Hugging Face - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51449.yaml"
},
"CVE-2023-51467": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Apache OFBiz < 18.12.11 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51467.yaml"
},
"CVE-2023-51713": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-125",
"name": "ProFTPD < 1.3.8a - DoS via Out-of-Bounds Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-51713.yaml"
},
"CVE-2023-5203": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5203.yaml"
},
"CVE-2023-5204": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5204.yaml"
},
"CVE-2023-52085": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-22",
"name": "Winter CMS Local File Inclusion - (LFI)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52085.yaml"
},
"CVE-2023-52163": {
"name": "Digiever DS-2105 Pro - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52163.yaml"
},
"CVE-2023-5222": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-259",
"name": "Viessmann Vitogate 300 - Hardcoded Password",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5222.yaml"
},
"CVE-2023-52251": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Kafka UI 0.7.1 Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52251.yaml"
},
"CVE-2023-5244": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Microweber < V.2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5244.yaml"
},
"CVE-2023-5360": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5360.yaml"
},
"CVE-2023-5375": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Mosparo < 1.0.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5375.yaml"
},
"CVE-2023-54391": {
"name": "Proxmox VE - Default Credentials with TFA Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-54391.yaml"
},
"CVE-2023-5556": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Structurizr on-premises - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5556.yaml"
},
"CVE-2023-5558": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LearnPress < 4.2.5.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5558.yaml"
},
"CVE-2023-5559": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"name": "10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5559.yaml"
},
"CVE-2023-5561": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Core - Post Author Email Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5561.yaml"
},
"CVE-2023-5652": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WP Hotel Booking <= 2.0.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5652.yaml"
},
"CVE-2023-5815": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "News & Blog Designer Pack \u2013 WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5815.yaml"
},
"CVE-2023-5830": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "ColumbiaSoft DocumentLocator - Improper Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5830.yaml"
},
"CVE-2023-5863": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "phpMyFAQ < 3.2.0 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5863.yaml"
},
"CVE-2023-5914": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Citrix StoreFront - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5914.yaml"
},
"CVE-2023-5974": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5974.yaml"
},
"CVE-2023-5991": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5991.yaml"
},
"CVE-2023-6000": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6000.yaml"
},
"CVE-2023-6018": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Mlflow - Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6018.yaml"
},
"CVE-2023-6020": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Ray Static File - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6020.yaml"
},
"CVE-2023-6021": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Ray API - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6021.yaml"
},
"CVE-2023-6023": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "VertaAI ModelDB - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6023.yaml"
},
"CVE-2023-6030": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "LogDash Activity Log <= 1.1.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6030.yaml"
},
"CVE-2023-6038": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "H2O ImportFiles - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6038.yaml"
},
"CVE-2023-6063": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WP Fastest Cache 1.2.2 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6063.yaml"
},
"CVE-2023-6065": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6065.yaml"
},
"CVE-2023-6114": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6114.yaml"
},
"CVE-2023-6246": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "glibc's syslog - Local Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-6246.yaml"
},
"CVE-2023-6266": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "WordPress Backup Migration <= 1.3.6 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6266.yaml"
},
"CVE-2023-6275": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "TOTVS Fluig Platform - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6275.yaml"
},
"CVE-2023-6329": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Control iD iDSecure - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6329.yaml"
},
"CVE-2023-6360": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress My Calendar <3.4.22 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6360.yaml"
},
"CVE-2023-6379": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "OpenCMS 14 & 15 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6379.yaml"
},
"CVE-2023-6380": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "OpenCms 14 & 15 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6380.yaml"
},
"CVE-2023-6389": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Toolbar <= 2.2.6 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6389.yaml"
},
"CVE-2023-6421": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Download Manager - File Password Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6421.yaml"
},
"CVE-2023-6444": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Seriously Simple Podcasting < 3.0.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6444.yaml"
},
"CVE-2023-6505": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Prime Mover < 1.9.3 - Sensitive Data Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6505.yaml"
},
"CVE-2023-6549": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-125",
"name": "Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6549.yaml"
},
"CVE-2023-6553": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6553.yaml"
},
"CVE-2023-6567": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "LearnPress <= 4.2.5.7 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6567.yaml"
},
"CVE-2023-6568": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Mlflow - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6568.yaml"
},
"CVE-2023-6592": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-548",
"name": "WordPress FastDup <= 2.1.9  Sensitive Information Exposure - Directory Listing",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6592.yaml"
},
"CVE-2023-6623": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Essential Blocks < 4.4.3 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6623.yaml"
},
"CVE-2023-6634": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "LearnPress < 4.2.5.8 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6634.yaml"
},
"CVE-2023-6655": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "Hongjing e-HR 2020 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6655.yaml"
},
"CVE-2023-6697": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6697.yaml"
},
"CVE-2023-6750": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "WordPress WP Clone <= 2.4.2 - Database Backup Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6750.yaml"
},
"CVE-2023-6786": {
"name": "Payment Gateway for Telcell < 2.0.4 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6786.yaml"
},
"CVE-2023-6825": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "WordPress File Manager <= 7.2.1 - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6825.yaml"
},
"CVE-2023-6831": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"name": "mlflow - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6831.yaml"
},
"CVE-2023-6875": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6875.yaml"
},
"CVE-2023-6895": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Hikvision IP ping.php - Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6895.yaml"
},
"CVE-2023-6909": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "Mlflow <2.9.2 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6909.yaml"
},
"CVE-2023-6970": {
"name": "WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6970.yaml"
},
"CVE-2023-6977": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "Mlflow <2.8.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6977.yaml"
},
"CVE-2023-6989": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Shield Security WP Plugin <= 18.5.9 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6989.yaml"
},
"CVE-2023-7028": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "GitLab - Account Takeover via Password Reset",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7028.yaml"
},
"CVE-2023-7116": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-78",
"name": "WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7116.yaml"
},
"CVE-2023-7164": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress BackWPup < 4.0.4 - Backup File Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7164.yaml"
},
"CVE-2023-7165": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-548",
"name": "JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7165.yaml"
},
"CVE-2023-7246": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "System Dashboard < 2.8.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7246.yaml"
},
"CVE-2023-7327": {
"name": "Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7327.yaml"
},
"CVE-2023-7337": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "JS Help Desk <= 2.8.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7337.yaml"
},
"CVE-2024-0012": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "PAN-OS Management Web Interface - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0012.yaml"
},
"CVE-2024-0195": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "SpiderFlow Crawler Platform - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0195.yaml"
},
"CVE-2024-0200": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-470",
"name": "Github Enterprise - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0200.yaml"
},
"CVE-2024-0204": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-425",
"name": "Fortra GoAnywhere MFT - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0204.yaml"
},
"CVE-2024-0235": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "EventON (Free < 2.2.8, Premium < 4.5.5) - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0235.yaml"
},
"CVE-2024-0250": {
"name": "Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0250.yaml"
},
"CVE-2024-0305": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Ncast busiFacade - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0305.yaml"
},
"CVE-2024-0337": {
"name": "Travelpayouts <= 1.1.16 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0337.yaml"
},
"CVE-2024-0352": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Likeshop < 2.5.7.20210311 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0352.yaml"
},
"CVE-2024-0593": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress Simple Job Board - Unauthorized Data Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0593.yaml"
},
"CVE-2024-0692": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "SolarWinds Security Event Manager - Unauthenticated RCE",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0692.yaml"
},
"CVE-2024-0705": {
"name": "Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0705.yaml"
},
"CVE-2024-0799": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Arcserve Unified Data Protection - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0799.yaml"
},
"CVE-2024-0801": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-75",
"name": "Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0801.yaml"
},
"CVE-2024-0881": {
"cwe": "CWE-284",
"name": "Combo Blocks < 2.2.76 - Improper Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0881.yaml"
},
"CVE-2024-0939": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Smart S210 Management Platform - Arbitary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0939.yaml"
},
"CVE-2024-0986": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-78",
"name": "Issabel Authenticated - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0986.yaml"
},
"CVE-2024-10081": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-288",
"name": "CodeChecker <= 6.24.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10081.yaml"
},
"CVE-2024-10146": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Simple File List < 6.1.13 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10146.yaml"
},
"CVE-2024-10152": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Simple Certain Time to Show Content - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10152.yaml"
},
"CVE-2024-1021": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Rebuild <= 3.5.5 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1021.yaml"
},
"CVE-2024-10400": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Tutor LMS <= 2.7.6 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10400.yaml"
},
"CVE-2024-10443": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Synology BeeStation BST150-4T - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-10443.yaml"
},
"CVE-2024-10486": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10486.yaml"
},
"CVE-2024-10516": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "Swift Performance Lite < 2.3.7.2 - Local PHP File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10516.yaml"
},
"CVE-2024-10571": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Chartify \u2013 WordPress Chart Plugin < 2.9.6 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10571.yaml"
},
"CVE-2024-1061": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress HTML5 Video Player - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1061.yaml"
},
"CVE-2024-10708": {
"cvss": 4.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "System Dashboard < 2.8.15 - Admin+ Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10708.yaml"
},
"CVE-2024-1071": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Ultimate Member 2.1.3 - 2.8.2 \u2013 SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1071.yaml"
},
"CVE-2024-10763": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10763.yaml"
},
"CVE-2024-10783": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "WordPress Plugin MainWP Child - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10783.yaml"
},
"CVE-2024-10812": {
"name": "GPT Academic v1.3.9 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10812.yaml"
},
"CVE-2024-10908": {
"name": "FastChat - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10908.yaml"
},
"CVE-2024-10914": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-707",
"name": "D-Link NAS - Command Injection via Name Parameter",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10914.yaml"
},
"CVE-2024-10915": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "D-Link NAS - Command Injection via Group Parameter",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10915.yaml"
},
"CVE-2024-10924": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Really Simple Security < 9.1.2 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10924.yaml"
},
"CVE-2024-11044": {
"name": "Stable Diffusion Webui 1.10.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11044.yaml"
},
"CVE-2024-11238": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"cwe": "CWE-22",
"name": "Landray EKP - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11238.yaml"
},
"CVE-2024-11303": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Korenix JetPort 5601v3 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11303.yaml"
},
"CVE-2024-11305": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-74",
"name": "Altenergy Power Control Software - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11305.yaml"
},
"CVE-2024-11320": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Pandora v7.0NG.777.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11320.yaml"
},
"CVE-2024-11396": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-359",
"name": "Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11396.yaml"
},
"CVE-2024-11587": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "idcCMS V1.60 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11587.yaml"
},
"CVE-2024-11667": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Zyxel ZLD Firewall - Directory Traversal",
"severity": "high",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-2024-11667.yaml"
},
"CVE-2024-11680": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "ProjectSend <= r1605 - Improper Authorization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11680.yaml"
},
"CVE-2024-11728": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11728.yaml"
},
"CVE-2024-11740": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-94",
"name": "Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11740.yaml"
},
"CVE-2024-1183": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-601",
"name": "Gradio - Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1183.yaml"
},
"CVE-2024-11868": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-284",
"name": "LearnPress < 4.2.7.4 - Course Material - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11868.yaml"
},
"CVE-2024-11921": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Give WP Plugin < 3.19.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11921.yaml"
},
"CVE-2024-11972": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11972.yaml"
},
"CVE-2024-12008": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-532",
"name": "W3 Total Cache < 2.8.2 - Log File Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12008.yaml"
},
"CVE-2024-12025": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress Collapsing Categories <= 3.0.8 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12025.yaml"
},
"CVE-2024-1208": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "LearnDash LMS < 4.10.3 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1208.yaml"
},
"CVE-2024-1209": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1209.yaml"
},
"CVE-2024-1210": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "LearnDash LMS < 4.10.2 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1210.yaml"
},
"CVE-2024-1212": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Progress Kemp LoadMaster - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1212.yaml"
},
"CVE-2024-12209": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12209.yaml"
},
"CVE-2024-12335": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2024/CVE-2024-12335-fusion_builder-4181dcad-b5bd-46db-b47c-3cdee427123c.yaml"
},
"CVE-2024-12356": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Privileged Remote Access & Remote Support - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-12356.yaml"
},
"CVE-2024-12477": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2024/CVE-2024-12477-fusion_builder-7c54588f-6436-406f-93cb-b08965586d11.yaml"
},
"CVE-2024-12585": {
"name": "PropertyHive < 2.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12585.yaml"
},
"CVE-2024-12638": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12638.yaml"
},
"CVE-2024-12724": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP DeskLite - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12724.yaml"
},
"CVE-2024-12732": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "AffiliateImporterEb <= 1.0.6 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12732.yaml"
},
"CVE-2024-12734": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Advance Post Prefix WordPress plugin - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12734.yaml"
},
"CVE-2024-12737": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP BASE Booking - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12737.yaml"
},
"CVE-2024-12749": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12749.yaml"
},
"CVE-2024-12824": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-620",
"name": "Nokri \u2013 Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12824.yaml"
},
"CVE-2024-12849": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12849.yaml"
},
"CVE-2024-12873": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Custom Field Manager WordPress - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12873.yaml"
},
"CVE-2024-12878": {
"name": "Lazy Blocks <= 3.8.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12878.yaml"
},
"CVE-2024-12987": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "DrayTek Vigor - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12987.yaml"
},
"CVE-2024-13055": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13055.yaml"
},
"CVE-2024-13094": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WP Triggers Lite - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13094.yaml"
},
"CVE-2024-13097": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Finance Plugin <= 1.3.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13097.yaml"
},
"CVE-2024-13098": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Email Newsletter - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13098.yaml"
},
"CVE-2024-13099": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Widget4Call WordPress - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13099.yaml"
},
"CVE-2024-13112": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP MediaTagger <= 4.1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13112.yaml"
},
"CVE-2024-13114": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Projects Portfolio <= 3.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13114.yaml"
},
"CVE-2024-13126": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-552",
"name": "WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13126.yaml"
},
"CVE-2024-13159": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-36",
"name": "Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13159.yaml"
},
"CVE-2024-13160": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-36",
"name": "Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13160.yaml"
},
"CVE-2024-13161": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-36",
"name": "Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13161.yaml"
},
"CVE-2024-13219": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Privacy Policy Genius - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13219.yaml"
},
"CVE-2024-13220": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Google Map Professional - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13220.yaml"
},
"CVE-2024-13221": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13221.yaml"
},
"CVE-2024-13222": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress User Messages <= 1.2.4 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13222.yaml"
},
"CVE-2024-13224": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SlideDeck 1 Lite Content Slider - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13224.yaml"
},
"CVE-2024-13225": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ECT Home Page Products - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13225.yaml"
},
"CVE-2024-13226": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "A5 Custom Login Page - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13226.yaml"
},
"CVE-2024-13322": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13322.yaml"
},
"CVE-2024-13325": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Glossy WordPress - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13325.yaml"
},
"CVE-2024-13326": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13326.yaml"
},
"CVE-2024-13327": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Musicbox WordPress - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13327.yaml"
},
"CVE-2024-13328": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Giga Messenger WordPress - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13328.yaml"
},
"CVE-2024-13330": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "JustRows WordPress - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13330.yaml"
},
"CVE-2024-13331": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Dream Carousel < 1.0.1b - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13331.yaml"
},
"CVE-2024-13345": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"name": ">",
"severity": "high",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2024/CVE-2024-13345-fusion_builder-94f6aab3-49a7-4837-a424-e40e483f3f68.yaml"
},
"CVE-2024-13352": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Legull WordPress - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13352.yaml"
},
"CVE-2024-13492": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Guten Free Options - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13492.yaml"
},
"CVE-2024-13496": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "GamiPress <= 2.8.9 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13496.yaml"
},
"CVE-2024-13543": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zarinpal Paid Download - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13543.yaml"
},
"CVE-2024-13569": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WordPress Front End Users - Reflected XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13569.yaml"
},
"CVE-2024-13570": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13570.yaml"
},
"CVE-2024-13609": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress 1 Click Migration Plugin < 2.3 - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13609.yaml"
},
"CVE-2024-13619": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LifterLMS < 8.0.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13619.yaml"
},
"CVE-2024-13624": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13624.yaml"
},
"CVE-2024-13625": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Tube Video Ads Lite - Reflected XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13625.yaml"
},
"CVE-2024-13627": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "OWL Carousel Slider - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13627.yaml"
},
"CVE-2024-13628": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Pricing Table - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13628.yaml"
},
"CVE-2024-13630": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NewsTicker <= 1.0 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13630.yaml"
},
"CVE-2024-13634": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Post Sync Plugin <= 1.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13634.yaml"
},
"CVE-2024-13726": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Themes Coder Ecommerce <= 1.3.4 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13726.yaml"
},
"CVE-2024-13727": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MemberSpace WordPress - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13727.yaml"
},
"CVE-2024-1380": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Relevanssi (A Better Search) <= 4.22.0 - Query Log Export",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1380.yaml"
},
"CVE-2024-13853": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13853.yaml"
},
"CVE-2024-13888": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WPMobile.App <= 11.56 - Open Redirect",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13888.yaml"
},
"CVE-2024-13979": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "St. Joe ERP system - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13979.yaml"
},
"CVE-2024-13985": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13985.yaml"
},
"CVE-2024-14015": {
"name": "Studiocart <= 2.9.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-14015.yaml"
},
"CVE-2024-1483": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "Mlflow < 2.9.2 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1483.yaml"
},
"CVE-2024-1512": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1512.yaml"
},
"CVE-2024-1561": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "Gradio 4.3-4.12 - Local File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1561.yaml"
},
"CVE-2024-1698": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "NotificationX <= 2.8.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1698.yaml"
},
"CVE-2024-1708": {
"cvss": 8.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "ConnectWise ScreenConnect <= 23.9.7 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1708.yaml"
},
"CVE-2024-1709": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "ConnectWise ScreenConnect 23.9.7 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1709.yaml"
},
"CVE-2024-1728": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Gradio > 4.19.1 UploadButton - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1728.yaml"
},
"CVE-2024-1751": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Tutor LMS <= 2.1.10 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1751.yaml"
},
"CVE-2024-20404": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Cisco Finesse - Server-Side Request Forgery (SSRF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20404.yaml"
},
"CVE-2024-20419": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-620",
"name": "Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20419.yaml"
},
"CVE-2024-20439": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-912",
"name": "Hardcoded Admin Credentials For Cisco Smart Licensing Utility API",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20439.yaml"
},
"CVE-2024-20440": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-532",
"name": "Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20440.yaml"
},
"CVE-2024-2053": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-23",
"name": "Artica Proxy - Unauthenticated LFI",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2053.yaml"
},
"CVE-2024-20720": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Adobe Commerce / Magento - OS Command Injection",
"severity": "critical",
"url": "https://github.com/geeknik/the-nuclei-templates/blob/main/CVE-2024-20720.yaml"
},
"CVE-2024-20767": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-284",
"name": "Adobe ColdFusion - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20767.yaml"
},
"CVE-2024-21136": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"name": "Oracle Retail Xstore Suite - Pre-authenticated Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21136.yaml"
},
"CVE-2024-21485": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Dash Framework - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21485.yaml"
},
"CVE-2024-21633": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "MobSF - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21633.yaml"
},
"CVE-2024-21641": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "Flarum < 1.8.5 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21641.yaml"
},
"CVE-2024-21644": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "pyLoad Flask Config - Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21644.yaml"
},
"CVE-2024-21645": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-74",
"name": "pyload - Log Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21645.yaml"
},
"CVE-2024-21650": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-95",
"name": "XWiki < 4.10.20 - Remote code execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21650.yaml"
},
"CVE-2024-21683": {
"cvss": 8.3,
"cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Atlassian Confluence Data Center and Server - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21683.yaml"
},
"CVE-2024-21887": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21887.yaml"
},
"CVE-2024-21893": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "Ivanti SAML - Server Side Request Forgery (SSRF)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21893.yaml"
},
"CVE-2024-22024": {
"name": "Ivanti Connect Secure - XXE",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22024.yaml"
},
"CVE-2024-22120": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Zabbix Server - Time-Based Blind SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-22120.yaml"
},
"CVE-2024-22207": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-1188",
"name": "Fastify Swagger-UI - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22207.yaml"
},
"CVE-2024-22319": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "IBM Operational Decision Manager - JNDI Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22319.yaml"
},
"CVE-2024-22320": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "IBM Operational Decision Manager - Java Deserialization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22320.yaml"
},
"CVE-2024-22476": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Intel Neural Compressor <2.5.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22476.yaml"
},
"CVE-2024-22729": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Netis MW5360 V1.0.1.3031 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22729.yaml"
},
"CVE-2024-22927": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "eyoucms v.1.6.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22927.yaml"
},
"CVE-2024-23055": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Plone Docker - Host Header Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23055.yaml"
},
"CVE-2024-23108": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Fortinet FortiSIEM - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-23108.yaml"
},
"CVE-2024-2330": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "NS-ASG Application Security Gateway 6.3 - Sql Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2330.yaml"
},
"CVE-2024-23334": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "aiohttp - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23334.yaml"
},
"CVE-2024-2340": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Avada < 7.11.7 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2340.yaml"
},
"CVE-2024-23692": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1336",
"name": "Rejetto HTTP File Server - Template injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23692.yaml"
},
"CVE-2024-2389": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Progress Kemp Flowmon - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2389.yaml"
},
"CVE-2024-23897": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Jenkins < 2.441 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-23897.yaml"
},
"CVE-2024-23917": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "JetBrains TeamCity > 2023.11.3 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23917.yaml"
},
"CVE-2024-24112": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Exrick XMall - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24112.yaml"
},
"CVE-2024-24116": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Ruijie RG-NBS2009G-P - Improper Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24116.yaml"
},
"CVE-2024-24131": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SuperWebMailer 9.31.0.01799 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24131.yaml"
},
"CVE-2024-24328": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TotoLink Router setMacFilterRules - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24328.yaml"
},
"CVE-2024-24329": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TotoLink Router setPortForwardRules - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24329.yaml"
},
"CVE-2024-24565": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "CrateDB Database - Arbitrary File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24565.yaml"
},
"CVE-2024-2473": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WPS Hide Login <= 1.9.15.2 - Login Page Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2473.yaml"
},
"CVE-2024-24759": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-918",
"name": "MindsDB -DNS Rebinding SSRF Protection Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24759.yaml"
},
"CVE-2024-24763": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"cwe": "CWE-601",
"name": "JumpServer < 3.10.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24763.yaml"
},
"CVE-2024-24809": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"cwe": "CWE-27",
"name": "Traccar - Unrestricted File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24809.yaml"
},
"CVE-2024-24882": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24882.yaml"
},
"CVE-2024-24919": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Check Point Quantum Gateway - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24919.yaml"
},
"CVE-2024-25600": {
"name": "Unauthenticated Remote Code Execution \u2013 Bricks <= 1.9.6",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25600.yaml"
},
"CVE-2024-25608": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Liferay Portal - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25608.yaml"
},
"CVE-2024-25723": {
"name": "ZenML ZenML Server - Improper Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25723.yaml"
},
"CVE-2024-25735": {
"name": "WyreStorm Apollo VX20 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25735.yaml"
},
"CVE-2024-25852": {
"name": "Linksys RE7000 - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25852.yaml"
},
"CVE-2024-2621": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "Fujian Kelixin Communication - Command Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2621.yaml"
},
"CVE-2024-26291": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-285",
"name": "Avid NEXIS Agent - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-26291.yaml"
},
"CVE-2024-26331": {
"name": "ReCrystallize Server - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-26331.yaml"
},
"CVE-2024-2667": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2667.yaml"
},
"CVE-2024-27115": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:I/V:C/RE:M/U:Red",
"cwe": "CWE-434",
"name": "SOPlanning - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27115.yaml"
},
"CVE-2024-27198": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "TeamCity < 2023.11.4 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27198.yaml"
},
"CVE-2024-27199": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-23",
"name": "TeamCity < 2023.11.4 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27199.yaml"
},
"CVE-2024-27292": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-706",
"name": "Docassemble - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27292.yaml"
},
"CVE-2024-27348": {
"cwe": "CWE-77",
"name": "Apache HugeGraph-Server - Remote Command Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27348.yaml"
},
"CVE-2024-27443": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zimbra Collaboration - Cross-Site Scripting (XSS)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27443.yaml"
},
"CVE-2024-27497": {
"name": "Linksys E2000 1.0.06 position.js Improper Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27497.yaml"
},
"CVE-2024-27564": {
"name": "ChatGPT\u4e2a\u4eba\u4e13\u7528\u7248 - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27564.yaml"
},
"CVE-2024-2771": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2771.yaml"
},
"CVE-2024-27718": {
"name": "Smart s200 Management Platform v.S200 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27718.yaml"
},
"CVE-2024-2782": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-862",
"name": "WordPress FluentForms <= 5.1.16 - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2782.yaml"
},
"CVE-2024-27954": {
"cvss": 9.8,
"cwe": "CWE-918",
"name": "WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27954.yaml"
},
"CVE-2024-27956": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"cwe": "CWE-89",
"name": "WordPress Automatic Plugin <= 3.92.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27956.yaml"
},
"CVE-2024-28000": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28000.yaml"
},
"CVE-2024-28200": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-287",
"name": "N-able N-central < 2024.2 - Authentication Bypass Detection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28200.yaml"
},
"CVE-2024-28253": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-94",
"name": "OpenMetaData - SpEL Injection in PUT /api/v1/policies",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28253.yaml"
},
"CVE-2024-28255": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "OpenMetadata - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28255.yaml"
},
"CVE-2024-28397": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-94",
"name": "pyload-ng js2py - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28397.yaml"
},
"CVE-2024-2862": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-640",
"name": "LG LED Assistant - Unauthenticated Password Reset",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2862.yaml"
},
"CVE-2024-28623": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "RiteCMS 3.0.0 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28623.yaml"
},
"CVE-2024-2863": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "LG LED Assistant - Thumbnail Path Traversal File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2863.yaml"
},
"CVE-2024-28734": {
"name": "Coda v.2024Q1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28734.yaml"
},
"CVE-2024-2876": {
"name": "Wordpress Email Subscribers by Icegram Express - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2876.yaml"
},
"CVE-2024-2879": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2879.yaml"
},
"CVE-2024-28986": {
"cvss": 9.8,
"cwe": "CWE-502",
"name": "SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28986.yaml"
},
"CVE-2024-28987": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-798",
"name": "SolarWinds Web Help Desk - Hardcoded Credential",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28987.yaml"
},
"CVE-2024-28995": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SolarWinds Serv-U - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28995.yaml"
},
"CVE-2024-29028": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Memos 0.13.2 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29028.yaml"
},
"CVE-2024-29029": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Memos 0.13.2 - Cross-Site Scripting & SSRF",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29029.yaml"
},
"CVE-2024-29030": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Memos 0.13.2 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29030.yaml"
},
"CVE-2024-29059": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-209",
"name": ".NET Framework - Leaking ObjRefs via HTTP .NET Remoting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29059.yaml"
},
"CVE-2024-29137": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29137.yaml"
},
"CVE-2024-29138": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Restrict User Access <= 2.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29138.yaml"
},
"CVE-2024-29198": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "GeoServer Demo Request Endpoint - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29198.yaml"
},
"CVE-2024-29269": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Telesquare TLR-2005KSH - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29269.yaml"
},
"CVE-2024-29272": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-434",
"name": "VvvebJs < 1.7.5 - Arbitrary File Upload",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29272.yaml"
},
"CVE-2024-2928": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "MLflow < 2.11.3 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2928.yaml"
},
"CVE-2024-2961": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"cwe": "CWE-787",
"name": "PHP - LFR to Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2024/CVE-2024-2961.yaml"
},
"CVE-2024-29792": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29792.yaml"
},
"CVE-2024-29824": {
"cvss": 9.6,
"cvss_vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Ivanti EPM - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29824.yaml"
},
"CVE-2024-29868": {
"cwe": "CWE-338",
"name": "Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29868.yaml"
},
"CVE-2024-29882": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "HTTP API DOM - XSS on JSONP callback",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2024/CVE-2024-29882.yaml"
},
"CVE-2024-29889": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-89",
"name": "GLPI 10.0.10-10.0.14 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29889.yaml"
},
"CVE-2024-29895": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Cacti cmd_realtime.php - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29895.yaml"
},
"CVE-2024-29931": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Go Maps <= 9.0.29 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29931.yaml"
},
"CVE-2024-29972": {
"cvss": 9.88,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29972.yaml"
},
"CVE-2024-29973": {
"cvss": 9.88,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29973.yaml"
},
"CVE-2024-30163": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "IPS Community Suite - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30163.yaml"
},
"CVE-2024-30188": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"name": "Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30188.yaml"
},
"CVE-2024-30194": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30194.yaml"
},
"CVE-2024-30269": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "DataEase <= 2.4.1 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30269.yaml"
},
"CVE-2024-3032": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WordPress Themify Builder < 7.5.8 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3032.yaml"
},
"CVE-2024-30464": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30464.yaml"
},
"CVE-2024-30490": {
"name": "ProfileGrid <= 5.7.8 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30490.yaml"
},
"CVE-2024-30498": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-89",
"name": "CRM Perks Forms <= 1.1.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30498.yaml"
},
"CVE-2024-30502": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WP Travel Engine <= 5.7.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30502.yaml"
},
"CVE-2024-30568": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Netgear R6850 V1.1.0.88 - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30568.yaml"
},
"CVE-2024-30569": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Netgear R6850 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30569.yaml"
},
"CVE-2024-30570": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Netgear R6850 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30570.yaml"
},
"CVE-2024-3080": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "ASUS DSL-AC88U - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3080.yaml"
},
"CVE-2024-3094": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-506",
"name": "XZ - Embedded Malicious Code",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-3094.yaml"
},
"CVE-2024-3097": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3097.yaml"
},
"CVE-2024-31223": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-497",
"name": "Fides Privacy Center \u2264 2.39.1 - Server-Side URL Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31223.yaml"
},
"CVE-2024-3136": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3136.yaml"
},
"CVE-2024-31621": {
"cvss": 7.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-94",
"name": "Flowise 1.6.5 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31621.yaml"
},
"CVE-2024-31750": {
"name": "F-logic DataCube3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31750.yaml"
},
"CVE-2024-31839": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31839.yaml"
},
"CVE-2024-31848": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "CData API Server < 23.4.8844 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31848.yaml"
},
"CVE-2024-31849": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "CData Connect < 23.4.8846 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31849.yaml"
},
"CVE-2024-31850": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-22",
"name": "CData Arc < 23.4.8839 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31850.yaml"
},
"CVE-2024-31851": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-22",
"name": "CData Sync < 23.4.8843 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31851.yaml"
},
"CVE-2024-31982": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-95",
"name": "XWiki < 4.10.20 - Remote code execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31982.yaml"
},
"CVE-2024-32113": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Apache OFBiz Directory Traversal - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32113.yaml"
},
"CVE-2024-32114": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-1188",
"name": "Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32114.yaml"
},
"CVE-2024-32128": {
"name": "WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32128.yaml"
},
"CVE-2024-32231": {
"name": "Stash < 0.26.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32231.yaml"
},
"CVE-2024-32238": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-522",
"name": "H3C ER8300G2-X - Password Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32238.yaml"
},
"CVE-2024-3231": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3231.yaml"
},
"CVE-2024-3234": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Chuanhu Chat - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3234.yaml"
},
"CVE-2024-32399": {
"cvss": 7.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
"cwe": "CWE-22",
"name": "RaidenMAILD Mail Server v.4.9.4 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32399.yaml"
},
"CVE-2024-32640": {
"name": "Mura/Masa CMS - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32640.yaml"
},
"CVE-2024-32651": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-1336",
"name": "Change Detection - Server Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32651.yaml"
},
"CVE-2024-32709": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-89",
"name": "WP-Recall <= 16.26.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32709.yaml"
},
"CVE-2024-3272": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "D-Link Network Attached Storage - Backdoor Account",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3272.yaml"
},
"CVE-2024-3273": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "D-Link Network Attached Storage - Command Injection and Backdoor Account",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3273.yaml"
},
"CVE-2024-32735": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "CyberPower - Missing Authentication",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32735.yaml"
},
"CVE-2024-32736": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "CyberPower < v2.8.3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32736.yaml"
},
"CVE-2024-32737": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "CyberPower - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32737.yaml"
},
"CVE-2024-32738": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "CyberPower - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32738.yaml"
},
"CVE-2024-32739": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "CyberPower < v2.8.3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32739.yaml"
},
"CVE-2024-3274": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3274.yaml"
},
"CVE-2024-32825": {
"name": "Simply Static - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32825.yaml"
},
"CVE-2024-32870": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "iTop Hub Connector - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32870.yaml"
},
"CVE-2024-32964": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H",
"cwe": "CWE-918",
"name": "Lobe Chat <= v0.150.5 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32964.yaml"
},
"CVE-2024-3300": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3300.yaml"
},
"CVE-2024-33113": {
"name": "D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33113.yaml"
},
"CVE-2024-33288": {
"name": "Prison Management System - SQL Injection Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33288.yaml"
},
"CVE-2024-33326": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LumisXP - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33326.yaml"
},
"CVE-2024-33575": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "User Meta WP Plugin < 3.1 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33575.yaml"
},
"CVE-2024-33605": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Sharp Multifunction Printers - Directory Listing",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33605.yaml"
},
"CVE-2024-33610": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-284",
"name": "Sharp Multifunction Printers - Cookie Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33610.yaml"
},
"CVE-2024-33724": {
"name": "SOPlanning 1.52.00 Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33724.yaml"
},
"CVE-2024-3378": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-79",
"name": "iboss Secure Web Gateway - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3378.yaml"
},
"CVE-2024-33832": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-918",
"name": "OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33832.yaml"
},
"CVE-2024-33939": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-288",
"name": "Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33939.yaml"
},
"CVE-2024-3400": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "GlobalProtect - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3400.yaml"
},
"CVE-2024-34061": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-79",
"name": "Changedetection.io <=v0.45.21 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34061.yaml"
},
"CVE-2024-3408": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3408.yaml"
},
"CVE-2024-34102": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-611",
"name": "Adobe Commerce & Magento - CosmicSting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34102.yaml"
},
"CVE-2024-34257": {
"name": "TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34257.yaml"
},
"CVE-2024-34351": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Next.js - Server Side Request Forgery (SSRF)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34351.yaml"
},
"CVE-2024-34470": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34470.yaml"
},
"CVE-2024-3469": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "GP Premium <= 2.4.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3469.yaml"
},
"CVE-2024-3495": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Wordpress Country State City Dropdown <=2.7.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3495.yaml"
},
"CVE-2024-34982": {
"name": "LyLme-Spage - Arbitary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34982.yaml"
},
"CVE-2024-35219": {
"cvss": 8.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"cwe": "CWE-22",
"name": "OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35219.yaml"
},
"CVE-2024-35286": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Mitel MiCollab <= 9.8.0.33 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35286.yaml"
},
"CVE-2024-3552": {
"name": "Web Directory Free < 1.7.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3552.yaml"
},
"CVE-2024-35584": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "openSIS < 9.1 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35584.yaml"
},
"CVE-2024-35627": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "TileServer API - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35627.yaml"
},
"CVE-2024-35693": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35693.yaml"
},
"CVE-2024-35694": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35694.yaml"
},
"CVE-2024-3605": {
"name": "WP Hotel Booking <= 2.1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3605.yaml"
},
"CVE-2024-36104": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "Apache OFBiz - Directory Traversal & Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36104.yaml"
},
"CVE-2024-36117": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-22",
"name": "Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36117.yaml"
},
"CVE-2024-36401": {
"name": "GeoServer RCE in Evaluating Property Name Expressions",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36401.yaml"
},
"CVE-2024-36404": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-95",
"name": "GeoServer and GeoTools - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36404.yaml"
},
"CVE-2024-36412": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SuiteCRM - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36412.yaml"
},
"CVE-2024-36420": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Flowise 1.4.3 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36420.yaml"
},
"CVE-2024-36527": {
"name": "Puppeteer Renderer - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36527.yaml"
},
"CVE-2024-3656": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-200",
"name": "Keycloak < 24.0.5 - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3656.yaml"
},
"CVE-2024-36675": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "LyLme spage v1.9.5 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36675.yaml"
},
"CVE-2024-36683": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PrestaShop productsalert - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36683.yaml"
},
"CVE-2024-3673": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"name": "Web Directory Free < 1.7.3 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3673.yaml"
},
"CVE-2024-36837": {
"name": "CRMEB v.5.2.2 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36837.yaml"
},
"CVE-2024-36857": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Jan v0.4.12 'readFileSync' - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36857.yaml"
},
"CVE-2024-36858": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Jan v0.4.12 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36858.yaml"
},
"CVE-2024-36991": {
"name": "Splunk Enterprise - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36991.yaml"
},
"CVE-2024-37014": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Langflow <= 1.0.12 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37014.yaml"
},
"CVE-2024-37032": {
"name": "Ollama - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37032.yaml"
},
"CVE-2024-37152": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Argo CD Unauthenticated Access to sensitive setting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37152.yaml"
},
"CVE-2024-37259": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Extended < 3.0.0 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37259.yaml"
},
"CVE-2024-37261": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37261.yaml"
},
"CVE-2024-37393": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SecurEnvoy Two Factor Authentication - LDAP Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37393.yaml"
},
"CVE-2024-3742": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-312",
"name": "Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3742.yaml"
},
"CVE-2024-3753": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Hostel < 1.1.5.3 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3753.yaml"
},
"CVE-2024-37656": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"cwe": "CWE-601",
"name": "GnuBoard5 5.5.16 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37656.yaml"
},
"CVE-2024-37728": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "OfficeWeb365 Indexs Interface - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37728.yaml"
},
"CVE-2024-37843": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Craft CMS <=v3.7.31 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37843.yaml"
},
"CVE-2024-37881": {
"name": "SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37881.yaml"
},
"CVE-2024-3822": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3822.yaml"
},
"CVE-2024-38288": {
"name": "TurboMeeting - Post-Authentication Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38288.yaml"
},
"CVE-2024-38289": {
"name": "TurboMeeting - Boolean-based SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38289.yaml"
},
"CVE-2024-38353": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-338",
"name": "CodiMD <2.5.4 - Insecure Filename Randomization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38353.yaml"
},
"CVE-2024-38472": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Apache HTTPd Windows UNC - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38472.yaml"
},
"CVE-2024-38473": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-116",
"name": "Apache HTTP Server - ACL Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38473.yaml"
},
"CVE-2024-38475": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-116",
"name": "Sonicwall - Pre-Authentication Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38475.yaml"
},
"CVE-2024-3848": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "Mlflow < 2.11.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3848.yaml"
},
"CVE-2024-3850": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Uniview NVR301-04S2-P4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3850.yaml"
},
"CVE-2024-38514": {
"cvss": 7.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "NextChat - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38514.yaml"
},
"CVE-2024-38526": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
"name": "Polyfill Supply Chain Attack Malicious Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2024/CVE-2024-38526.yaml"
},
"CVE-2024-38653": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Ivanti Avalanche SmartDeviceServer - XML External Entity",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38653.yaml"
},
"CVE-2024-38773": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38773.yaml"
},
"CVE-2024-38816": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WebMvc.fn/WebFlux.fn - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38816.yaml"
},
"CVE-2024-38819": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Spring Framework Path Traversal in Functional Web Frameworks",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml"
},
"CVE-2024-38856": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Apache OFBiz - Improper Authorization & Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38856.yaml"
},
"CVE-2024-3922": {
"name": "Dokan Pro <= 3.10.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3922.yaml"
},
"CVE-2024-39250": {
"name": "EfroTech Timetrax v8.3 - Sql Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39250.yaml"
},
"CVE-2024-39646": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39646.yaml"
},
"CVE-2024-39713": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Rocket.Chat - Server-Side Request Forgery (SSRF)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39713.yaml"
},
"CVE-2024-39887": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-89",
"name": "Apache Superset < 4.0.2 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39887.yaml"
},
"CVE-2024-39903": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-22",
"name": "Solara <1.35.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39903.yaml"
},
"CVE-2024-39907": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "1Panel SQL Injection - Authenticated",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39907.yaml"
},
"CVE-2024-39914": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "FOG Project < 1.5.10.34 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39914.yaml"
},
"CVE-2024-40348": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"cwe": "CWE-22",
"name": "Bazarr < 1.4.3 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40348.yaml"
},
"CVE-2024-4040": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "CrushFTP VFS - Sandbox Escape LFR",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4040.yaml"
},
"CVE-2024-40422": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "Devika v1 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40422.yaml"
},
"CVE-2024-40711": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Veeam Backup & Replication - Unauthenticated",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40711.yaml"
},
"CVE-2024-41107": {
"name": "Apache CloudStack - SAML Signature Exclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41107.yaml"
},
"CVE-2024-41628": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Cluster Control CMON API - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41628.yaml"
},
"CVE-2024-41667": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "OpenAM<=15.0.3 FreeMarker - Template Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41667.yaml"
},
"CVE-2024-41713": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Mitel MiCollab - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41713.yaml"
},
"CVE-2024-4180": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "The Events Calendar < 6.4.0.1 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4180.yaml"
},
"CVE-2024-41810": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "Twisted - Open Redirect & XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41810.yaml"
},
"CVE-2024-41955": {
"cvss": 5.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N",
"cwe": "CWE-601",
"name": "Open Redirect in Login Redirect - MobSF",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41955.yaml"
},
"CVE-2024-42009": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "Roundcube Webmail - Cross-Site Scripting",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42009.yaml"
},
"CVE-2024-42323": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42323.yaml"
},
"CVE-2024-4257": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4257.yaml"
},
"CVE-2024-42640": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-94",
"name": "Angular-Base64-Upload - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42640.yaml"
},
"CVE-2024-42852": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42852.yaml"
},
"CVE-2024-4295": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4295.yaml"
},
"CVE-2024-43144": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Cost Calculator Builder <= 3.2.15 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43144.yaml"
},
"CVE-2024-43160": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "BerqWP <= 1.7.6 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43160.yaml"
},
"CVE-2024-4322": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-29",
"name": "LoLLMS WebUI < 9.8 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4322.yaml"
},
"CVE-2024-4325": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Gradio - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4325.yaml"
},
"CVE-2024-43283": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Contest Gallery - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43283.yaml"
},
"CVE-2024-43360": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ZoneMinder - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43360.yaml"
},
"CVE-2024-4340": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"name": "sqlparse - Denial of Service",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-4340.yaml"
},
"CVE-2024-43425": {
"cvss": 9.8,
"name": "Moodle - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43425.yaml"
},
"CVE-2024-43441": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-302",
"name": "Apache HugeGraph-Server <1.5.0 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43441.yaml"
},
"CVE-2024-4348": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-79",
"name": "osCommerce v4.0 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4348.yaml"
},
"CVE-2024-4358": {
"name": "Progress Telerik Report Server - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4358.yaml"
},
"CVE-2024-43917": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43917.yaml"
},
"CVE-2024-43919": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "YARPP <= 5.30.10 - Missing Authorization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43919.yaml"
},
"CVE-2024-43965": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "SendGrid for WordPress <= 1.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43965.yaml"
},
"CVE-2024-43971": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43971.yaml"
},
"CVE-2024-4399": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-918",
"name": "WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4399.yaml"
},
"CVE-2024-44000": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-532",
"name": "LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44000.yaml"
},
"CVE-2024-4434": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "LearnPress WordPress LMS Plugin <= 4.2.6.5 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4434.yaml"
},
"CVE-2024-44349": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "AnteeoWMS < v4.7.34 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44349.yaml"
},
"CVE-2024-4439": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-80",
"name": "WordPress Core <6.5.2 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4439.yaml"
},
"CVE-2024-4443": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Business Directory Plugin <= 6.4.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4443.yaml"
},
"CVE-2024-4455": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4455.yaml"
},
"CVE-2024-44762": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-209",
"name": "Usermin 2.100 - Username Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44762.yaml"
},
"CVE-2024-44849": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Qualitor <= 8.24 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44849.yaml"
},
"CVE-2024-45195": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-425",
"name": "Apache OFBiz - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45195.yaml"
},
"CVE-2024-45216": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Solr - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45216.yaml"
},
"CVE-2024-45241": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "CentralSquare CryWolf - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45241.yaml"
},
"CVE-2024-45293": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-611",
"name": "TablePress < 2.4.3 - XXE Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45293.yaml"
},
"CVE-2024-45309": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "OneDev.io < 11.0.9 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45309.yaml"
},
"CVE-2024-45388": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-20",
"name": "Hoverfly < 1.10.3 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45388.yaml"
},
"CVE-2024-45409": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-347",
"name": "GitLab - SAML Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-45409.yaml"
},
"CVE-2024-45440": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-209",
"name": "Drupal 11.x-dev - Full Path Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45440.yaml"
},
"CVE-2024-45488": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SafeGuard for Privileged Passwords < 7.5.2 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45488.yaml"
},
"CVE-2024-45507": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Apache OFBiz - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45507.yaml"
},
"CVE-2024-45519": {
"name": "Zimbra Collaboration Suite < 9.0.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-45519.yaml"
},
"CVE-2024-45591": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "XWiki Platform - Unauthorized Document History Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45591.yaml"
},
"CVE-2024-45622": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ASIS - SQL Injection Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45622.yaml"
},
"CVE-2024-4577": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "PHP CGI - Argument Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml"
},
"CVE-2024-4620": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "ArForms < 6.6 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4620.yaml"
},
"CVE-2024-46310": {
"name": "FXServer < v9601 - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46310.yaml"
},
"CVE-2024-46506": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "NetAlertX 23.01.14\u201324.x < 24.10.12 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46506.yaml"
},
"CVE-2024-46507": {
"name": "Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46507.yaml"
},
"CVE-2024-46627": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-284",
"name": "DATAGERRY - REST API Auth Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46627.yaml"
},
"CVE-2024-46938": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Sitecore Experience Platform <= 10.4 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46938.yaml"
},
"CVE-2024-46986": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"name": "Camaleon CMS < 2.8.1 Arbitrary File Write to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46986.yaml"
},
"CVE-2024-47062": {
"name": "Navidrome < 0.53.0 - Authenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47062.yaml"
},
"CVE-2024-47073": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-347",
"name": "DataEase v2.10.2 - JWT Signature Verification Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47073.yaml"
},
"CVE-2024-47176": {
"cvss": 8.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-1327",
"name": "CUPS - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-47176.yaml"
},
"CVE-2024-47308": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"cwe": "CWE-862",
"name": "Templately <= 3.1.2 - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47308.yaml"
},
"CVE-2024-47374": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "LiteSpeed Cache <= 6.5.0.2 - Stored XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47374.yaml"
},
"CVE-2024-47533": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Cobbler 'XML-RPC' - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47533.yaml"
},
"CVE-2024-47575": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "FortiManager Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-47575.yaml"
},
"CVE-2024-48208": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"cwe": "CWE-125",
"name": "Pure-FTPd < 1.0.52 - Buffer Overflow",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-48208.yaml"
},
"CVE-2024-48248": {
"name": "NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48248.yaml"
},
"CVE-2024-48259": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "Cloudlog - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48259.yaml"
},
"CVE-2024-48307": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "JeecgBoot v3.7.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48307.yaml"
},
"CVE-2024-4836": {
"name": "Edito CMS - Sensitive Data Leak",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4836.yaml"
},
"CVE-2024-48360": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Qualitor <= v8.24 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48360.yaml"
},
"CVE-2024-4841": {
"cvss": 4.0,
"cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-29",
"name": "LoLLMS WebUI - Subfolder Prediction via Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4841.yaml"
},
"CVE-2024-48455": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Netis Wifi Router - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48455.yaml"
},
"CVE-2024-48651": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "ProFTPD \u2264 1.3.8b - Privilege Escalation via mod_sql",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-48651.yaml"
},
"CVE-2024-48766": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "NetAlert X - Arbitary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48766.yaml"
},
"CVE-2024-4879": {
"name": "ServiceNow UI Macros - Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4879.yaml"
},
"CVE-2024-4885": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4885.yaml"
},
"CVE-2024-48914": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-20",
"name": "Vendure - Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48914.yaml"
},
"CVE-2024-4898": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4898.yaml"
},
"CVE-2024-49357": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "ZimaOS <= v1.2.4 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-49357.yaml"
},
"CVE-2024-49380": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Plenti < v0.7.2 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-49380.yaml"
},
"CVE-2024-4940": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Gradio - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4940.yaml"
},
"CVE-2024-4956": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Sonatype Nexus Repository Manager 3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4956.yaml"
},
"CVE-2024-49757": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Zitadel - User Registration Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-49757.yaml"
},
"CVE-2024-50334": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-288",
"name": "Scoold < 1.64.0 - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50334.yaml"
},
"CVE-2024-50340": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-74",
"name": "Symfony Profiler - Remote Access via Injected Arguments",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50340.yaml"
},
"CVE-2024-50477": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50477.yaml"
},
"CVE-2024-50498": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WP Query Console <= 1.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50498.yaml"
},
"CVE-2024-5057": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5057.yaml"
},
"CVE-2024-50603": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Aviatrix Controller - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50603.yaml"
},
"CVE-2024-50623": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Cleo Harmony < 5.8.0.21 - Arbitary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50623.yaml"
},
"CVE-2024-5082": {
"name": "Nexus Repository 2 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5082.yaml"
},
"CVE-2024-5084": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Hash Form <= 1.1.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5084.yaml"
},
"CVE-2024-50857": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "GestioIP - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50857.yaml"
},
"CVE-2024-50967": {
"cwe": "CWE-200",
"name": "DATAGERRY - Improper Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50967.yaml"
},
"CVE-2024-51211": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "openSIS Classic v9.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51211.yaml"
},
"CVE-2024-51228": {
"cvss": 6.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "TOTOLINK CX-A3002RU - Remote Code Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51228.yaml"
},
"CVE-2024-51378": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "CyberPanel - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51378.yaml"
},
"CVE-2024-51482": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ZoneMinder v1.37.* <= 1.37.64 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51482.yaml"
},
"CVE-2024-51483": {
"cwe": "CWE-22",
"name": "Changedetection.io <= 0.47.4 - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51483.yaml"
},
"CVE-2024-51567": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "CyberPanel v2.3.6 Pre-Auth Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51567.yaml"
},
"CVE-2024-51568": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "CyberPanel - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51568.yaml"
},
"CVE-2024-51739": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "iTop - User Enumeration via REST Endpoint",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51739.yaml"
},
"CVE-2024-51977": {
"name": "Brother MFC-L9570CDW - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51977.yaml"
},
"CVE-2024-51978": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1391",
"name": "Brother Printers \u2013 Authentication Bypass via Default Admin Password",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml"
},
"CVE-2024-5217": {
"name": "ServiceNow - Incomplete Input Validation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5217.yaml"
},
"CVE-2024-5230": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "FleetCart 4.1.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5230.yaml"
},
"CVE-2024-52433": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "My Geo Posts Free <= 1.2 - PHP Object Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52433.yaml"
},
"CVE-2024-5276": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5276.yaml"
},
"CVE-2024-52762": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52762.yaml"
},
"CVE-2024-52763": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52763.yaml"
},
"CVE-2024-52875": {
"cwe": "CWE-74",
"name": "Kerio Control v9.2.5 - CRLF Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52875.yaml"
},
"CVE-2024-5315": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "Dolibarr ERP CMS `list.php` - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5315.yaml"
},
"CVE-2024-5333": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-639",
"name": "WordPress Events Calendar 6.8.2.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5333.yaml"
},
"CVE-2024-5334": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-73",
"name": "Devika - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5334.yaml"
},
"CVE-2024-53704": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "SSL VPN Session Hijacking",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53704.yaml"
},
"CVE-2024-53900": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "Mongoose < 8.8.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53900.yaml"
},
"CVE-2024-53991": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Discourse Backup File Disclosure Via Default Nginx Configuration",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53991.yaml"
},
"CVE-2024-53995": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "SickChill - Open Redirect",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53995.yaml"
},
"CVE-2024-5420": {
"cvss": 8.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L",
"cwe": "CWE-79",
"name": "SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5420.yaml"
},
"CVE-2024-5421": {
"cvss": 8.7,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L",
"cwe": "CWE-78",
"name": "SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5421.yaml"
},
"CVE-2024-54330": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Hurrakify <= 2.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54330.yaml"
},
"CVE-2024-54385": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Radio Player <= 2.0.82 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54385.yaml"
},
"CVE-2024-54763": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-284",
"name": "ipTIME A2004 - Unauthorized Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54763.yaml"
},
"CVE-2024-54764": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-284",
"name": "ipTIME A2004 - Unauthorized Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54764.yaml"
},
"CVE-2024-54767": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-203",
"name": "AVM FRITZ!Box 7530 AX - Unauthorized Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54767.yaml"
},
"CVE-2024-5483": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "LearnPress < 4.2.6.8.1 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5483.yaml"
},
"CVE-2024-5488": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SEOPress < 7.9 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5488.yaml"
},
"CVE-2024-55218": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "IceWarp Server 10.2.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55218.yaml"
},
"CVE-2024-5522": {
"cvss": 9.8,
"cwe": "CWE-89",
"name": "WordPress HTML5 Video Player < 2.5.27 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5522.yaml"
},
"CVE-2024-55415": {
"name": "DevDojo Voyager <=1.8.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55415.yaml"
},
"CVE-2024-55416": {
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
"name": "DevDojo Voyager <=1.8.0 - Cross-Site Scripting",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55416.yaml"
},
"CVE-2024-55417": {
"name": "DevDojo Voyager <= 1.8.0 - Arbitrary File Write vulnerability",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55417.yaml"
},
"CVE-2024-55457": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-22",
"name": "MasterSAM Star Gate v11 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55457.yaml"
},
"CVE-2024-55550": {
"cvss": 4.4,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Mitel MiCollab - Arbitary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55550.yaml"
},
"CVE-2024-55556": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "InvoiceShelf <= 1.3.0 - PHP Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-55556.yaml"
},
"CVE-2024-55591": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Fortinet - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55591.yaml"
},
"CVE-2024-55890": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-95",
"name": "D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55890.yaml"
},
"CVE-2024-55956": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-276",
"name": "Cleo Harmony < 5.8.0.24 - File Upload Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55956.yaml"
},
"CVE-2024-56064": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56064.yaml"
},
"CVE-2024-56145": {
"cvss": 9.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-94",
"name": "Craft CMS - Remote Code Execution via Template Path Manipulation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56145.yaml"
},
"CVE-2024-56159": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-219",
"name": "Astro - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56159.yaml"
},
"CVE-2024-5628": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2024/CVE-2024-5628-fusion_builder-7c23bd29-ba02-4c90-a631-5ce6294d7760.yaml"
},
"CVE-2024-56325": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "Apache Pinot < 1.3.0 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56325.yaml"
},
"CVE-2024-56331": {
"cvss": 6.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Uptime-Kuma - Local File Inclusion (LFI)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-56331.yaml"
},
"CVE-2024-56511": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-289",
"name": "DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56511.yaml"
},
"CVE-2024-56512": {
"name": "Apache NiFi - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56512.yaml"
},
"CVE-2024-57045": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "D-Link DIR-859 - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57045.yaml"
},
"CVE-2024-57046": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Netgear DGN2200 - Improper Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57046.yaml"
},
"CVE-2024-57049": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "TP-Link Archer C20 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57049.yaml"
},
"CVE-2024-57241": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "DedeCMS - Open Redirect via download.php",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57241.yaml"
},
"CVE-2024-57514": {
"cvss": 4.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "TP-Link Archer A20 v3 Router - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57514.yaml"
},
"CVE-2024-5765": {
"cwe": "CWE-89",
"name": "WpStickyBar <= 2.1.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5765.yaml"
},
"CVE-2024-57726": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "SimpleHelp <= 5.5.7 - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57726.yaml"
},
"CVE-2024-57727": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57727.yaml"
},
"CVE-2024-57728": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-59",
"name": "SimpleHelp <= 5.5.7 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57728.yaml"
},
"CVE-2024-58136": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Yii2 PHP Framework < 2.0.52 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-58136.yaml"
},
"CVE-2024-5827": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Vanna - SQL injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5827.yaml"
},
"CVE-2024-5910": {
"cvss": 9.3,
"cwe": "CWE-306",
"name": "Palo Alto Expedition - Admin Account Takeover",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5910.yaml"
},
"CVE-2024-5932": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "GiveWP - PHP Object Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5932.yaml"
},
"CVE-2024-5936": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "PrivateGPT < 0.5.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5936.yaml"
},
"CVE-2024-5947": {
"name": "Deep Sea Electronics DSE855 - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5947.yaml"
},
"CVE-2024-5975": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"name": "CZ Loan Management <= 1.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5975.yaml"
},
"CVE-2024-6028": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Quiz Maker <= 6.5.8.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6028.yaml"
},
"CVE-2024-6049": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-32",
"name": "Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6049.yaml"
},
"CVE-2024-6095": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "LocalAI - Partial Local File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6095.yaml"
},
"CVE-2024-6159": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Push Notification for Post and BuddyPress <= 1.93 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6159.yaml"
},
"CVE-2024-6188": {
"name": "TrakSYS 11.x.x - Sensitive Data Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6188.yaml"
},
"CVE-2024-6205": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "PayPlus Payment Gateway < 6.6.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6205.yaml"
},
"CVE-2024-6220": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Keydatas \u2264 2.5.2 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6220.yaml"
},
"CVE-2024-6235": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "NetScaler Console - Sensitive Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6235.yaml"
},
"CVE-2024-6250": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-36",
"name": "LOLLMS WebUI - Absolute Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6250.yaml"
},
"CVE-2024-6265": {
"name": "UsersWP <= 1.2.10 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6265.yaml"
},
"CVE-2024-6289": {
"name": "WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6289.yaml"
},
"CVE-2024-6366": {
"name": "User Profile Builder < 3.11.8 - File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6366.yaml"
},
"CVE-2024-6396": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-29",
"name": "Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6396.yaml"
},
"CVE-2024-6420": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"name": "Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6420.yaml"
},
"CVE-2024-6460": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6460.yaml"
},
"CVE-2024-6517": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6517.yaml"
},
"CVE-2024-6555": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "WP Popups - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6555.yaml"
},
"CVE-2024-6569": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Campaign Monitor for WordPress - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6569.yaml"
},
"CVE-2024-6586": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"cwe": "CWE-201",
"name": "Lightdash v0.1024.6 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6586.yaml"
},
"CVE-2024-6587": {
"name": "LiteLLM - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6587.yaml"
},
"CVE-2024-6646": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Netgear-WN604 downloadFile.php - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6646.yaml"
},
"CVE-2024-6651": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6651.yaml"
},
"CVE-2024-6670": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WhatsUp Gold HasErrors SQL Injection - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6670.yaml"
},
"CVE-2024-6671": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6671.yaml"
},
"CVE-2024-6690": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "WP Content Copy Protection & No Right Click - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6690.yaml"
},
"CVE-2024-6746": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-24",
"name": "EasySpider 0.6.2 - Arbitrary File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6746.yaml"
},
"CVE-2024-6753": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6753.yaml"
},
"CVE-2024-6781": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Calibre <= 7.14.0 Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6781.yaml"
},
"CVE-2024-6782": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Calibre <= 7.14.0 Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6782.yaml"
},
"CVE-2024-6842": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "AnythingLLM - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6842.yaml"
},
"CVE-2024-6845": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "SmartSearchWP < 2.4.6 - OpenAI Key Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6845.yaml"
},
"CVE-2024-6846": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": "SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6846.yaml"
},
"CVE-2024-6886": {
"cvss": 6.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
"cwe": "CWE-79",
"name": "Gitea 1.22.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6886.yaml"
},
"CVE-2024-6892": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "Journyx 11.5.4 - Reflected Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6892.yaml"
},
"CVE-2024-6893": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Journyx - XML External Entities Injection (XXE)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6893.yaml"
},
"CVE-2024-6911": {
"cvss": 8.7,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"cwe": "CWE-552",
"name": "PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6911.yaml"
},
"CVE-2024-6922": {
"name": "Automation Anywhere Automation 360 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6922.yaml"
},
"CVE-2024-6924": {
"name": "TrueBooker <= 1.0.2 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6924.yaml"
},
"CVE-2024-6926": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Viral Signup <= 2.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6926.yaml"
},
"CVE-2024-6928": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Opti Marketing <= 2.0.9 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6928.yaml"
},
"CVE-2024-7008": {
"name": "Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7008.yaml"
},
"CVE-2024-7029": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "AVTECH IP Camera - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7029.yaml"
},
"CVE-2024-7097": {
"name": "WSO2 User Registration - Arbitrary Account Creation",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7097.yaml"
},
"CVE-2024-7120": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-78",
"name": "Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7120.yaml"
},
"CVE-2024-7188": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "Bylancer Quicklancer 2.4 G - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7188.yaml"
},
"CVE-2024-7313": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Shield Security Plugin < 20.0.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7313.yaml"
},
"CVE-2024-7314": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-280",
"name": "AJ-Report < 1.4.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7314.yaml"
},
"CVE-2024-7332": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-259",
"name": "TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7332.yaml"
},
"CVE-2024-7339": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "TVT DVR Sensitive Device - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7339.yaml"
},
"CVE-2024-7340": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "W&B Weave Server - Remote Arbitrary File Leak",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7340.yaml"
},
"CVE-2024-7354": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7354.yaml"
},
"CVE-2024-7399": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7399.yaml"
},
"CVE-2024-7591": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Kemp LoadMaster Load Balancer - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7591.yaml"
},
"CVE-2024-7593": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Ivanti vTM - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7593.yaml"
},
"CVE-2024-7714": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-284",
"name": "AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7714.yaml"
},
"CVE-2024-7786": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Sensei LMS < 4.24.2 - Email Template Leak",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7786.yaml"
},
"CVE-2024-7854": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Woo Inquiry <= 0.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7854.yaml"
},
"CVE-2024-7928": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "FastAdmin < V1.3.4.20220530 - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7928.yaml"
},
"CVE-2024-7954": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "SPIP Porte Plume Plugin - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7954.yaml"
},
"CVE-2024-8021": {
"name": "Gradio - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8021.yaml"
},
"CVE-2024-8181": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"name": "Flowise <= 1.8.2 Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8181.yaml"
},
"CVE-2024-8252": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8252.yaml"
},
"CVE-2024-8353": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8353.yaml"
},
"CVE-2024-8425": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WooCommerce Ultimate Gift Card \u2264 2.6.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8425.yaml"
},
"CVE-2024-8484": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "REST API TO MiniProgram <= 4.7.1 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8484.yaml"
},
"CVE-2024-8503": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "VICIdial - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8503.yaml"
},
"CVE-2024-8517": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-646",
"name": "SPIP BigUp Plugin - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8517.yaml"
},
"CVE-2024-8522": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "LearnPress < 4.2.7.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8522.yaml"
},
"CVE-2024-8529": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "LearnPress < 4.2.7.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8529.yaml"
},
"CVE-2024-8625": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress TS Poll < 2.4.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8625.yaml"
},
"CVE-2024-8673": {
"cvss": 3.5,
"cwe": "CWE-79",
"name": "Z-Downloads < 1.11.7 - Cross-Site Scripting",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8673.yaml"
},
"CVE-2024-8698": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
"cwe": "CWE-347",
"name": "Keycloak - SAML Core Package Signature Validation Flaw",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8698.yaml"
},
"CVE-2024-8752": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WebIQ 2.15.9 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8752.yaml"
},
"CVE-2024-8852": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-532",
"name": "All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8852.yaml"
},
"CVE-2024-8856": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WP Time Capsule Plugin - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8856.yaml"
},
"CVE-2024-8859": {
"name": "Mlflow < 2.17.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8859.yaml"
},
"CVE-2024-8877": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Riello Netman 204 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8877.yaml"
},
"CVE-2024-8883": {
"cvss": 6.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cwe": "CWE-601",
"name": "Keycloak - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8883.yaml"
},
"CVE-2024-8911": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "LatePoint <= 5.0.11 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8911.yaml"
},
"CVE-2024-8943": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "LatePoint <= 5.0.12 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8943.yaml"
},
"CVE-2024-8963": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "Ivanti Cloud Services Appliance - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8963.yaml"
},
"CVE-2024-9007": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "123Solar 1.8.4.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9007.yaml"
},
"CVE-2024-9014": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-522",
"name": "pgAdmin 4 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9014.yaml"
},
"CVE-2024-9047": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress File Upload <= 4.24.11 - Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9047.yaml"
},
"CVE-2024-9061": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-94",
"name": "WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9061.yaml"
},
"CVE-2024-9161": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"cwe": "CWE-862",
"name": "Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9161.yaml"
},
"CVE-2024-9166": {
"cwe": "CWE-78",
"name": "TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9166.yaml"
},
"CVE-2024-9186": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Automation By Autonami < 3.3.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9186.yaml"
},
"CVE-2024-9193": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9193.yaml"
},
"CVE-2024-9234": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "GutenKit <= 2.1.0 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9234.yaml"
},
"CVE-2024-9264": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Grafana Post-Auth DuckDB - SQL Injection To File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9264.yaml"
},
"CVE-2024-9362": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Polyaxon - Unauthenticated Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9362.yaml"
},
"CVE-2024-9463": {
"cvss": 9.9,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/S",
"cwe": "CWE-78",
"name": "PaloAlto Networks Expedition - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9463.yaml"
},
"CVE-2024-9465": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-89",
"name": "Palo Alto Expedition - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9465.yaml"
},
"CVE-2024-9474": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "PAN-OS Management Web Interface - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9474.yaml"
},
"CVE-2024-9487": {
"name": "GitHub Enterprise - SAML Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-9487.yaml"
},
"CVE-2024-9593": {
"cvss": 8.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"cwe": "CWE-94",
"name": "Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9593.yaml"
},
"CVE-2024-9617": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "Danswer - Insecure Direct Object Reference",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9617.yaml"
},
"CVE-2024-9643": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Four-Faith F3x36 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9643.yaml"
},
"CVE-2024-9707": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9707.yaml"
},
"CVE-2024-9765": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"name": "EKC Tournament Manager WordPress plugin - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9765.yaml"
},
"CVE-2024-9772": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-94",
"name": "WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9772.yaml"
},
"CVE-2024-9796": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9796.yaml"
},
"CVE-2024-9916": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-78",
"name": "HuangDou UTCMS V9 - OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9916.yaml"
},
"CVE-2024-9935": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9935.yaml"
},
"CVE-2024-9989": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "Crypto <= 2.15 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9989.yaml"
},
"CVE-2025-0107": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Palo Alto Networks Expedition - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0107.yaml"
},
"CVE-2025-0108": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "PAN-OS Management Interface - Path Confusion to Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0108.yaml"
},
"CVE-2025-0133": {
"name": "PAN-OS - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0133.yaml"
},
"CVE-2025-0282": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Ivanti Connect Secure - Stack-based Buffer Overflow",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0282.yaml"
},
"CVE-2025-0520": {
"cvss": 9.4,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"cwe": "CWE-434",
"name": "ShowDoc - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0520.yaml"
},
"CVE-2025-0674": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "Elber ESE DVB-S/S2 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0674.yaml"
},
"CVE-2025-0868": {
"name": "DocsGPT - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0868.yaml"
},
"CVE-2025-10035": {
"name": "GoAnywhere - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10035.yaml"
},
"CVE-2025-10090": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"name": "Jinher OA - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10090.yaml"
},
"CVE-2025-10162": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress OrderConvo < 14 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10162.yaml"
},
"CVE-2025-10204": {
"cwe": "CWE-306",
"name": "AC Smart II - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10204.yaml"
},
"CVE-2025-10210": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-89",
"name": "ChanCMS <= 3.3.0 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10210.yaml"
},
"CVE-2025-10211": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-918",
"name": "ChanCMS <= 3.3.0 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10211.yaml"
},
"CVE-2025-1023": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ChurchCRM - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1023.yaml"
},
"CVE-2025-1025": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-434",
"name": "Cockpit < 2.4.1 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1025.yaml"
},
"CVE-2025-1035": {
"cvss": 5.7,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "KLog Server - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1035.yaml"
},
"CVE-2025-10353": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10353.yaml"
},
"CVE-2025-10897": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10897.yaml"
},
"CVE-2025-1097": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1097.yaml"
},
"CVE-2025-1098": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1098.yaml"
},
"CVE-2025-11307": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "WP Google Maps < 9.0.48 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11307.yaml"
},
"CVE-2025-11368": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11368.yaml"
},
"CVE-2025-11371": {
"cvss": 6.2,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-552",
"name": "Gladinet CentreStack & TrioFox - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11371.yaml"
},
"CVE-2025-11452": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Asgaros Forum < 3.2.0 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11452.yaml"
},
"CVE-2025-11580": {
"name": "PowerJob List - Authorization Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11580.yaml"
},
"CVE-2025-11693": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11693.yaml"
},
"CVE-2025-11700": {
"name": "N-central - XML External Entities Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11700.yaml"
},
"CVE-2025-11749": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "WordPress AI Engine Plugin - Token Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11749.yaml"
},
"CVE-2025-11750": {
"name": "Dify - User Enumeration via \"Account not found\" Message",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11750.yaml"
},
"CVE-2025-11833": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Post SMTP <= 3.6.0 - Email Log Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11833.yaml"
},
"CVE-2025-11953": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "React Native Community CLI - Unauthenticated OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11953.yaml"
},
"CVE-2025-12055": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12055.yaml"
},
"CVE-2025-12101": {
"name": "Citrix NetScaler ADC & Gateway - Reflected XSS / Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-12101.yaml"
},
"CVE-2025-12139": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Integrate Google Drive <= 1.5.3 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12139.yaml"
},
"CVE-2025-1232": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "Site Reviews < 7.2.5 - Unauthenticated Stored XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1232.yaml"
},
"CVE-2025-12480": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Triofox - Improper Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12480.yaml"
},
"CVE-2025-12536": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "SureForms <= 1.13.1 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12536.yaml"
},
"CVE-2025-12841": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"cwe": "CWE-862",
"name": "WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12841.yaml"
},
"CVE-2025-1302": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "JSONPath Plus < 10.3.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1302.yaml"
},
"CVE-2025-1303": {
"name": "Plugin Oficial \u2013 Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1303.yaml"
},
"CVE-2025-13138": {
"name": "WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13138.yaml"
},
"CVE-2025-1323": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WP-Recall \u2013 Plugin <= 16.26.10 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1323.yaml"
},
"CVE-2025-13315": {
"name": "Twonky Server 8.5.2 on Linux and Windows - Log File Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13315.yaml"
},
"CVE-2025-13339": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13339.yaml"
},
"CVE-2025-13342": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13342.yaml"
},
"CVE-2025-1338": {
"cwe": "CWE-78",
"name": "NUUO Camera <=20250203 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1338.yaml"
},
"CVE-2025-13390": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WP Directory Kit <= 1.4.4 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13390.yaml"
},
"CVE-2025-13418": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13418.yaml"
},
"CVE-2025-13486": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13486.yaml"
},
"CVE-2025-13528": {
"cwe": "CWE-862",
"name": "Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13528.yaml"
},
"CVE-2025-1361": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1361.yaml"
},
"CVE-2025-13652": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13652.yaml"
},
"CVE-2025-13773": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13773.yaml"
},
"CVE-2025-13801": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Yoco Payments <= 3.8.8 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13801.yaml"
},
"CVE-2025-13920": {
"cvss": 6.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13920.yaml"
},
"CVE-2025-13956": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "LearnPress < 4.3.2 - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13956.yaml"
},
"CVE-2025-14047": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14047.yaml"
},
"CVE-2025-14124": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-89",
"name": "Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14124.yaml"
},
"CVE-2025-14155": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Premium Addons for Elementor - Unauthenticated Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14155.yaml"
},
"CVE-2025-14340": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "Payara Server - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14340.yaml"
},
"CVE-2025-14437": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-532",
"name": "WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14437.yaml"
},
"CVE-2025-14528": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "D-Link DIR-803 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14528.yaml"
},
"CVE-2025-14611": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-321",
"name": "Gladinet CentreStack & Triofox - Hardcoded Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14611.yaml"
},
"CVE-2025-14726": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"name": "WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14726.yaml"
},
"CVE-2025-14847": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-908",
"name": "MongoDB Server - Information Disclosure (MongoBleed)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-14847.yaml"
},
"CVE-2025-14998": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-639",
"name": "Branda WordPress plugin - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14998.yaml"
},
"CVE-2025-15403": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "RegistrationMagic <= 6.0.7.1 - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-15403.yaml"
},
"CVE-2025-1550": {
"name": "Keras Model.load_model - Arbitrary Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-1550.yaml"
},
"CVE-2025-15503": {
"cwe": "CWE-434",
"name": "Sangfor OSM - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-15503.yaml"
},
"CVE-2025-1562": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1562.yaml"
},
"CVE-2025-1595": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "EasyCVR <=2.1.2 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1595.yaml"
},
"CVE-2025-1661": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1661.yaml"
},
"CVE-2025-1665": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2025/CVE-2025-1665-fusion_builder-94e373fb-b3f5-4c1b-9eaa-89747af4dc30.yaml"
},
"CVE-2025-1743": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Pichome 2.1.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1743.yaml"
},
"CVE-2025-1974": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-653",
"name": "Ingress-Nginx Controller - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1974.yaml"
},
"CVE-2025-2010": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress JobWP Plugin <= 2.3.9 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2010.yaml"
},
"CVE-2025-2011": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2011.yaml"
},
"CVE-2025-20188": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Cisco IOS XE WLC - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20188.yaml"
},
"CVE-2025-20281": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Cisco ISE - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20281.yaml"
},
"CVE-2025-20282": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20282.yaml"
},
"CVE-2025-20362": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-862",
"name": "Cisco Secure Firewall ASA & FTD - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20362.yaml"
},
"CVE-2025-2075": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2075.yaml"
},
"CVE-2025-2127": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-79",
"name": "JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2127.yaml"
},
"CVE-2025-2129": {
"cvss": 5.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-1188",
"name": "Mage AI - Insecure Default Authentication Setup",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2129.yaml"
},
"CVE-2025-2221": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress WPCOM Member <= 1.7.6 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2221.yaml"
},
"CVE-2025-22214": {
"name": "Landray EIS SQL\u6ce8\u5165\u6f0f\u6d1e",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-22214.yaml"
},
"CVE-2025-22457": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Ivanti Connect Secure - Stack-based Buffer Overflow",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-22457.yaml"
},
"CVE-2025-2264": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Sante PACS Server.exe - Path Traversal Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2264.yaml"
},
"CVE-2025-22785": {
"name": "Course Booking System <= 6.0.6 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-22785.yaml"
},
"CVE-2025-2294": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Kubio AI Page Builder <= 2.5.1 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2294.yaml"
},
"CVE-2025-22952": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Elestio Memos <= v0.24.0 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-22952.yaml"
},
"CVE-2025-23061": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Mongoose - NoSQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-23061.yaml"
},
"CVE-2025-23211": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"name": "Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-23211.yaml"
},
"CVE-2025-24016": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Wazuh - Unsafe Deserialization Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24016.yaml"
},
"CVE-2025-24354": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24354.yaml"
},
"CVE-2025-24514": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24514.yaml"
},
"CVE-2025-24582": {
"name": "12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24582.yaml"
},
"CVE-2025-24662": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": ">",
"severity": "high",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2025/CVE-2025-24662-sfwd_lms-8cd7bbfb-57e7-4bee-ad99-b8e9710da81d.yaml"
},
"CVE-2025-2473": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Company Visitor Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2473.yaml"
},
"CVE-2025-24752": {
"name": "Essential Addons for Elementor < 6.0.15 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-24752.yaml"
},
"CVE-2025-24786": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WhoDB < 0.45.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24786.yaml"
},
"CVE-2025-24799": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "GLPI < 10.0.17 - Pre-Auth SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24799.yaml"
},
"CVE-2025-24813": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache Tomcat Path Equivalence - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24813.yaml"
},
"CVE-2025-24893": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-95",
"name": "XWiki Platform - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24893.yaml"
},
"CVE-2025-24963": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Vitest Browser Mode - Local File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24963.yaml"
},
"CVE-2025-25034": {
"cvss": 9.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-502",
"name": "SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25034.yaml"
},
"CVE-2025-25037": {
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"cwe": "CWE-200",
"name": "Aquatronica Controller System <= 5.1.6 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25037.yaml"
},
"CVE-2025-2505": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2505.yaml"
},
"CVE-2025-25062": {
"cvss": 4.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Backdrop CMS - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-25062.yaml"
},
"CVE-2025-25231": {
"name": "Omnissa Workspace ONE UEM - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25231.yaml"
},
"CVE-2025-25256": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Fortinet FortiSIEM - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-25256.yaml"
},
"CVE-2025-25257": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Fortinet FortiWeb - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25257.yaml"
},
"CVE-2025-25291": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-347",
"name": "GitLab - SAML Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-25291.yaml"
},
"CVE-2025-25296": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Label Studio < 1.16.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25296.yaml"
},
"CVE-2025-2539": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-327",
"name": "File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2539.yaml"
},
"CVE-2025-25570": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Vue Vben Admin - Default Credentials",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25570.yaml"
},
"CVE-2025-2558": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-98",
"name": "WordPress The Wound Theme <= 0.0.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2558.yaml"
},
"CVE-2025-2563": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2563.yaml"
},
"CVE-2025-2609": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"cwe": "CWE-79",
"name": "MagnusBilling Login Logs - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2609.yaml"
},
"CVE-2025-2610": {
"cvss": 7.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"cwe": "CWE-79",
"name": "MagnusBilling Alarm Module - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2610.yaml"
},
"CVE-2025-2611": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "ICTBroadcast - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2611.yaml"
},
"CVE-2025-26319": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-26319.yaml"
},
"CVE-2025-2636": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2636.yaml"
},
"CVE-2025-26399": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-26399.yaml"
},
"CVE-2025-26793": {
"name": "FREEDOM Administration - Default Login",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-26793.yaml"
},
"CVE-2025-27007": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-266",
"name": "OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27007.yaml"
},
"CVE-2025-2709": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2709.yaml"
},
"CVE-2025-2710": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2710.yaml"
},
"CVE-2025-2711": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2711.yaml"
},
"CVE-2025-27112": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-287",
"name": "Navidrome <=0.54.5 - Authentication Bypass in Subsonic API",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27112.yaml"
},
"CVE-2025-2712": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2712.yaml"
},
"CVE-2025-27134": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "Joplin 3.3.3 Server - Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27134.yaml"
},
"CVE-2025-27218": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-94",
"name": "Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27218.yaml"
},
"CVE-2025-27222": {
"name": "TRUfusion Enterprise <= 7.10.4.0 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27222.yaml"
},
"CVE-2025-27223": {
"name": "TRUfusion Enterprise <= 7.10.4.0 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27223.yaml"
},
"CVE-2025-27225": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-288",
"name": "TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27225.yaml"
},
"CVE-2025-2746": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2746.yaml"
},
"CVE-2025-2747": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2747.yaml"
},
"CVE-2025-2748": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-79",
"name": "Kentico Xperience CMS - Unauthenticated Stored XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2748.yaml"
},
"CVE-2025-27505": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "GeoServer - Missing Authorization on REST API Index",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27505.yaml"
},
"CVE-2025-27506": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "NocoDB < 0.258.0 - Reflected XSS in Password Reset",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27506.yaml"
},
"CVE-2025-2775": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-611",
"name": "SysAid On-Prem <= 23.3.40 - XML External Entity",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2775.yaml"
},
"CVE-2025-2776": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-611",
"name": "SysAid On-Prem <= 23.3.40 - XML External Entity",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2776.yaml"
},
"CVE-2025-2777": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-611",
"name": "SysAid On-Prem <= 23.3.40 - XML External Entity",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2777.yaml"
},
"CVE-2025-27817": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Apache Kafka Client - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27817.yaml"
},
"CVE-2025-27888": {
"name": "Apache Druid - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27888.yaml"
},
"CVE-2025-27892": {
"cvss": 6.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
"cwe": "CWE-89",
"name": "Shopware < 6.5.8.13 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27892.yaml"
},
"CVE-2025-27915": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Zimbra - Cross-Site Scripting via ICS Files",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml"
},
"CVE-2025-28228": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-522",
"name": "Electrolink FM/DAB/TV Transmitter - Credentials Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28228.yaml"
},
"CVE-2025-28242": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-384",
"name": "DAEnetIP4 METO v1.25 - Session Hijacking",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28242.yaml"
},
"CVE-2025-28367": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-284",
"name": "mojoPortal <=2.9.0.1 - Directory Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28367.yaml"
},
"CVE-2025-28906": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28906.yaml"
},
"CVE-2025-2907": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2907.yaml"
},
"CVE-2025-29085": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29085.yaml"
},
"CVE-2025-29306": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "FoxCMS v.1.2.5 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29306.yaml"
},
"CVE-2025-29635": {
"cvss": 7.2,
"cwe": "CWE-78",
"name": "D-Link DIR-823X set_prohibiting - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29635.yaml"
},
"CVE-2025-29925": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-285",
"name": "XWiki REST API - Private Pages Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29925.yaml"
},
"CVE-2025-29927": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-287",
"name": "Next.js Middleware Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29927.yaml"
},
"CVE-2025-30208": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "Vite - Arbitrary File Read",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30208.yaml"
},
"CVE-2025-30220": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"cwe": "CWE-611",
"name": "GeoServer WFS - XXE Processing Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30220.yaml"
},
"CVE-2025-30406": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30406.yaml"
},
"CVE-2025-30567": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WordPress WP01 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30567.yaml"
},
"CVE-2025-3102": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-697",
"name": "SureTriggers \u2013 All-in-One Automation Platform \u2264 1.0.78 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3102.yaml"
},
"CVE-2025-31125": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Vite Development Server - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31125.yaml"
},
"CVE-2025-31131": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Yeswiki < 4.5.2 - Unauthenticated Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31131.yaml"
},
"CVE-2025-31161": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "CrushFTP - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31161.yaml"
},
"CVE-2025-31324": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "SAP NetWeaver Visual Composer Metadata Uploader - Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31324.yaml"
},
"CVE-2025-31486": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Vite server.fs.deny Bypass - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31486.yaml"
},
"CVE-2025-31489": {
"name": "MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31489.yaml"
},
"CVE-2025-32257": {
"name": "1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32257.yaml"
},
"CVE-2025-32355": {
"name": "Rocket TRUfusion Enterprise - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32355.yaml"
},
"CVE-2025-32395": {
"cvss": 6.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"cwe": "CWE-200",
"name": "Vite - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32395.yaml"
},
"CVE-2025-32429": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "XWiki Platform - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32429.yaml"
},
"CVE-2025-32430": {
"cvss": 6.5,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"cwe": "CWE-79",
"name": "XWiki Platform - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32430.yaml"
},
"CVE-2025-32432": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"cwe": "CWE-94",
"name": "CraftCMS - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32432.yaml"
},
"CVE-2025-32433": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Erlang/OTP SSH - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-32433.yaml"
},
"CVE-2025-32463": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-426",
"name": "Sudo - Local Privilege Escalation via chroot",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-32463.yaml"
},
"CVE-2025-3248": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Langflow AI - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3248.yaml"
},
"CVE-2025-32614": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "EventON Lite <= 2.4 - Authenticated Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32614.yaml"
},
"CVE-2025-32778": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Web-Check < 2.0.1 Screenshot API - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32778.yaml"
},
"CVE-2025-32813": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32813.yaml"
},
"CVE-2025-32814": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NetMRI Unauthenticated SQL Injection via skipjackUsername",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32814.yaml"
},
"CVE-2025-32815": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-287",
"name": "NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32815.yaml"
},
"CVE-2025-32966": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "DataEase 2.10.4-2.10.7 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32966.yaml"
},
"CVE-2025-32969": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "XWiki REST API Query - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32969.yaml"
},
"CVE-2025-32970": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "XWiki WYSIWYG API - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32970.yaml"
},
"CVE-2025-34023": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Karel IP Phone IP1211 Web Management Panel - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34023.yaml"
},
"CVE-2025-34026": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-288",
"name": "Versa Concerto Actuator Endpoint - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34026.yaml"
},
"CVE-2025-34027": {
"cwe": "CWE-367",
"name": "Versa Concerto API Path Based - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34027.yaml"
},
"CVE-2025-34028": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
"cwe": "CWE-22",
"name": "Commvault - SSRF via /commandcenter/deployWebpackage.do",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34028.yaml"
},
"CVE-2025-34030": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-78",
"name": "sar2html <=3.2.2 Plot Parameter - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34030.yaml"
},
"CVE-2025-34031": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N",
"cwe": "CWE-22",
"name": "Moodle Jmol Filter 6.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34031.yaml"
},
"CVE-2025-34032": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-80",
"name": "Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34032.yaml"
},
"CVE-2025-34033": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Blue Angel Software Suite (5V Technologies) - OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34033.yaml"
},
"CVE-2025-34035": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-78",
"name": "EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34035.yaml"
},
"CVE-2025-34038": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Fanwei e-cology - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34038.yaml"
},
"CVE-2025-34040": {
"name": "Zhiyuan OA Platform - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34040.yaml"
},
"CVE-2025-34045": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WeiPHP 5.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34045.yaml"
},
"CVE-2025-34073": {
"name": "Maltrail <=0.54 Username Parameter - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34073.yaml"
},
"CVE-2025-34077": {
"name": "WordPress Pie Register <= 3.7.1.4 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34077.yaml"
},
"CVE-2025-34141": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ETQ Reliance - Reflected XSS via SQLConverterServlet",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34141.yaml"
},
"CVE-2025-34143": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "ETQ Reliance - Authentication Bypass via Trailing Space",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34143.yaml"
},
"CVE-2025-3415": {
"name": "Grafana - Exposes DingDing API Keys",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3415.yaml"
},
"CVE-2025-34152": {
"name": "Shenzhen Aitemi M300 Wi-Fi Repeater \u2013 Unauthenticated Remote Command Execution via `time` Parameter",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34152.yaml"
},
"CVE-2025-34291": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-942",
"name": "Langflow AI <= 1.6.9 - CORS Misconfiguration",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34291.yaml"
},
"CVE-2025-34299": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34299.yaml"
},
"CVE-2025-34300": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34300.yaml"
},
"CVE-2025-34509": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-798",
"name": "Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34509.yaml"
},
"CVE-2025-3472": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-94",
"name": "Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3472.yaml"
},
"CVE-2025-3515": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3515.yaml"
},
"CVE-2025-3605": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-639",
"name": "WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3605.yaml"
},
"CVE-2025-36604": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Dell UnityVSA < 5.5 - Remote Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-36604.yaml"
},
"CVE-2025-36845": {
"name": "Eveo URVE Web Manager - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-36845.yaml"
},
"CVE-2025-37164": {
"name": "HPE OneView - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-37164.yaml"
},
"CVE-2025-4008": {
"cvss": 7.5,
"cwe": "CWE-77",
"name": "MeteoBridge <= 6.1 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4008.yaml"
},
"CVE-2025-4009": {
"cvss": 9.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/V:C",
"name": "Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4009.yaml"
},
"CVE-2025-40536": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-693",
"name": "SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40536.yaml"
},
"CVE-2025-40551": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40551.yaml"
},
"CVE-2025-40552": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1390",
"name": "SolarWinds Web Help Desk - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40552.yaml"
},
"CVE-2025-40554": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-1390",
"name": "SolarWinds Web Help Desk - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40554.yaml"
},
"CVE-2025-40630": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "IceWarp Mail Server \u226411.4.0 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40630.yaml"
},
"CVE-2025-4078": {
"name": "Wangshen SecGate 3600 Path Traversal Vulnerability",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4078.yaml"
},
"CVE-2025-4123": {
"cvss": 7.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"name": "Grafana - XSS / Open Redirect / SSRF via Client Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4123.yaml"
},
"CVE-2025-41242": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Spring Framework - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41242.yaml"
},
"CVE-2025-41243": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Spring Cloud Gateway Server Webflux - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41243.yaml"
},
"CVE-2025-41393": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Ricoh Web Image Monitor - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41393.yaml"
},
"CVE-2025-41646": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-704",
"name": "RevPi Webstatus <= v2.4.5 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41646.yaml"
},
"CVE-2025-4210": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-285",
"name": "Casdoor - Authorization Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4210.yaml"
},
"CVE-2025-4302": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "Stop User Enumeration WordPress plugin - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4302.yaml"
},
"CVE-2025-4322": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-620",
"name": "Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4322.yaml"
},
"CVE-2025-4334": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4334.yaml"
},
"CVE-2025-4380": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "Ads Pro Plugin <= 4.89 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4380.yaml"
},
"CVE-2025-4388": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Liferay Portal - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4388.yaml"
},
"CVE-2025-4396": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4396.yaml"
},
"CVE-2025-44136": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MapTiler Tileserver-php v2.0 - Unauthenticated XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44136.yaml"
},
"CVE-2025-44137": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "MapTiler Tileserver-php v2.0 - Unauthenticated File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44137.yaml"
},
"CVE-2025-44148": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MailEnable Mail Service < v10 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44148.yaml"
},
"CVE-2025-44177": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"cwe": "CWE-22",
"name": "White Star Software ProTop - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44177.yaml"
},
"CVE-2025-4427": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-288",
"name": "Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4427.yaml"
},
"CVE-2025-4524": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WordPress Madara Theme < 2.2.2.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4524.yaml"
},
"CVE-2025-4576": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Liferay Portal & DXP - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4576.yaml"
},
"CVE-2025-45854": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "JEHC-BPM - Remote Code Execute",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-45854.yaml"
},
"CVE-2025-45985": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Blink Router - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-45985.yaml"
},
"CVE-2025-4632": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Samsung MagicINFO 9 Server - File Upload & Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4632.yaml"
},
"CVE-2025-46349": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "YesWiki Reflected XSS via File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46349.yaml"
},
"CVE-2025-4652": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Broadstreet WordPress plugin - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4652.yaml"
},
"CVE-2025-46549": {
"name": "YesWiki <= 4.5.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46549.yaml"
},
"CVE-2025-46550": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-79",
"name": "YesWiki < 4.5.4 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46550.yaml"
},
"CVE-2025-46554": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-285",
"name": "XWiki REST API - Attachments Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46554.yaml"
},
"CVE-2025-46565": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Vite Dev Server - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46565.yaml"
},
"CVE-2025-46817": {
"name": "Redis < 8.2.1 lua script - Integer Overflow",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-46817.yaml"
},
"CVE-2025-46818": {
"name": "Redis Lua Sandbox < 8.2.2 - Cross-User Escape",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-46818.yaml"
},
"CVE-2025-46819": {
"name": "Redis  < 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-46819.yaml"
},
"CVE-2025-46822": {
"name": "Java-springboot-codebase 1.1 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46822.yaml"
},
"CVE-2025-47188": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"name": "Mitel 6000 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47188.yaml"
},
"CVE-2025-47204": {
"name": "Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47204.yaml"
},
"CVE-2025-47423": {
"cvss": 5.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"cwe": "CWE-24",
"name": "Personal Weather Station Dashboard 12 - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47423.yaml"
},
"CVE-2025-47445": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-23",
"name": "WordPress Eventin (Themewinter) \u2264 4.0.26 - Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47445.yaml"
},
"CVE-2025-47539": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Eventin <= 4.0.26 - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47539.yaml"
},
"CVE-2025-47577": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47577.yaml"
},
"CVE-2025-47646": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-640",
"name": "PSW Front-end Login & Registration 1.13 - Weak Password Recovery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47646.yaml"
},
"CVE-2025-47783": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Label Studio < 1.18.0 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47783.yaml"
},
"CVE-2025-47812": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Wing FTP Server <= 7.4.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47812.yaml"
},
"CVE-2025-47813": {
"cvss": 5.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NH",
"cwe": "CWE-209",
"name": "Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47813.yaml"
},
"CVE-2025-47916": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-1336",
"name": "Invision Community <=5.0.6 Unauthenticated RCE via Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47916.yaml"
},
"CVE-2025-48157": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "WordPress Formality Plugin <= 1.5.9 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48157.yaml"
},
"CVE-2025-48281": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "MyStyle Custom Product Designer <= 3.21.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48281.yaml"
},
"CVE-2025-48703": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48703.yaml"
},
"CVE-2025-48827": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-424",
"name": "vBulletin 5.0.0-6.0.3 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48827.yaml"
},
"CVE-2025-48828": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-424",
"name": "vBulletin replaceAdTemplate - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48828.yaml"
},
"CVE-2025-48954": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "Discourse OAuth Social Login - Cross-site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48954.yaml"
},
"CVE-2025-49001": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "DataEase < 2.10.10 - JWT Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49001.yaml"
},
"CVE-2025-49002": {
"cwe": "CWE-290",
"name": "DataEase - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49002.yaml"
},
"CVE-2025-49029": {
"name": "WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49029.yaml"
},
"CVE-2025-49113": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Roundcube Webmail - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49113.yaml"
},
"CVE-2025-49132": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Pterodactyl Panel - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49132.yaml"
},
"CVE-2025-49493": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-611",
"name": "Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49493.yaml"
},
"CVE-2025-49533": {
"name": "Adobe Experience Manager Forms - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49533.yaml"
},
"CVE-2025-49596": {
"cwe": "CWE-306",
"name": "MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49596.yaml"
},
"CVE-2025-49706": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-287",
"name": "Microsoft SharePoint Server - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49706.yaml"
},
"CVE-2025-49825": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "Teleport - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49825.yaml"
},
"CVE-2025-49844": {
"name": "Redis Lua Parser < 8.2.2 - Use After Free",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml"
},
"CVE-2025-49940": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2025/CVE-2025-49940-fusion_builder-9fe3d648-d6b3-4363-b449-bfc0f5b9c1ea.yaml"
},
"CVE-2025-50578": {
"name": "Heimdall - Host Header Injection & Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-50578.yaml"
},
"CVE-2025-50738": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-200",
"name": "Memos < 0.25.0 - Stored Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-50738.yaml"
},
"CVE-2025-5086": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Dassault Syst\u00e8mes DELMIA Apriso (up to 2025) - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5086.yaml"
},
"CVE-2025-51482": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Letta Letta 0.7.12 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51482.yaml"
},
"CVE-2025-51501": {
"name": "Microweber CMS2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51501.yaml"
},
"CVE-2025-51502": {
"name": "Microweber CMS 2.0 - Reflected XSS in Admin Page Creation",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51502.yaml"
},
"CVE-2025-51586": {
"cwe": "CWE-359",
"name": "PrestaShop - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51586.yaml"
},
"CVE-2025-51683": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51683.yaml"
},
"CVE-2025-51990": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki \u2013 Stored Cross-Site Scripting (XSS)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51990.yaml"
},
"CVE-2025-51991": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51991.yaml"
},
"CVE-2025-52207": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"cwe": "CWE-23",
"name": "MikoPBX - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52207.yaml"
},
"CVE-2025-52472": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "XWiki - HQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52472.yaml"
},
"CVE-2025-52488": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52488.yaml"
},
"CVE-2025-52665": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "UniFi Access - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52665.yaml"
},
"CVE-2025-52691": {
"name": "SmarterMail - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52691.yaml"
},
"CVE-2025-52694": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Advantech WISE-IoTSuite/SaaS - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52694.yaml"
},
"CVE-2025-5287": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5287.yaml"
},
"CVE-2025-52970": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-223",
"name": "Fortinet FortiWeb - Authentication Bypass to Admin Privilege",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52970.yaml"
},
"CVE-2025-5301": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5301.yaml"
},
"CVE-2025-53118": {
"name": "Securden Unified PAM - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53118.yaml"
},
"CVE-2025-53364": {
"name": "Parse Server - GraphQL Schema Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53364.yaml"
},
"CVE-2025-5350": {
"cvss": 5.9,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WSO2 - Server Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5350.yaml"
},
"CVE-2025-53533": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Pi-hole Reflected XSS in 404-Error Page",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53533.yaml"
},
"CVE-2025-53558": {
"name": "ZTE ZXHN-F660T/F660A - Default Credentials",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53558.yaml"
},
"CVE-2025-53624": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-200",
"name": "Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53624.yaml"
},
"CVE-2025-53770": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Microsoft SharePoint Server - Remote Code Execution (ToolShell)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53770.yaml"
},
"CVE-2025-53771": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-287",
"name": "Microsoft SharePoint Server - Authentication Bypass (ToolShell)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53771.yaml"
},
"CVE-2025-53833": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-1336",
"name": "LaRecipe < 2.8.1 Remote Code Execution via SSTI",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53833.yaml"
},
"CVE-2025-53887": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Directus < 11.9.0 - Version Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53887.yaml"
},
"CVE-2025-5394": {
"name": "Unauthenticated Arbitrary Plugin Upload in Alone Theme",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5394.yaml"
},
"CVE-2025-54068": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-502",
"name": "Laravel Livewire v3 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54068.yaml"
},
"CVE-2025-54123": {
"name": "Hoverfly <= 1.11.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54123.yaml"
},
"CVE-2025-54125": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-359",
"name": "XWiki XML View - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54125.yaml"
},
"CVE-2025-54236": {
"name": "Adobe Commerce - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54236.yaml"
},
"CVE-2025-54249": {
"name": "Adobe Experience Manager \u2264 6.5.23.0 \u2013 SSRF",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54249.yaml"
},
"CVE-2025-54251": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-91",
"name": "Adobe Experience Manager \u2264 6.5.23.0 - XML Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54251.yaml"
},
"CVE-2025-54309": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "CrushFTP - Authentication Bypass Race Condition",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-54309.yaml"
},
"CVE-2025-54589": {
"cvss": 6.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "Copyparty <=1.18.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54589.yaml"
},
"CVE-2025-54597": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Heimdall Application Dashboard < 2.7.3 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54597.yaml"
},
"CVE-2025-54726": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress JS Archive List <= 6.1.5 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54726.yaml"
},
"CVE-2025-54782": {
"cvss": 9.4,
"cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"name": "NestJS DevTools Integration - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54782.yaml"
},
"CVE-2025-54793": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Astro SSR - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54793.yaml"
},
"CVE-2025-54988": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-611",
"name": "Apache Tika - XXE Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54988.yaml"
},
"CVE-2025-55150": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Stirling-PDF < 1.1.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55150.yaml"
},
"CVE-2025-55161": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-918",
"name": "Stirling-PDF SSRF via Markdown",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55161.yaml"
},
"CVE-2025-55169": {
"name": "WeGIA - Directory Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55169.yaml"
},
"CVE-2025-55182": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "React Server Components - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml"
},
"CVE-2025-55184": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-502",
"name": "React Server Components - Denial of Service",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55184.yaml"
},
"CVE-2025-55190": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "ArgoCD Project API Token Repository Credentials Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55190.yaml"
},
"CVE-2025-55303": {
"cvss": 6.4,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"cwe": "CWE-79",
"name": "Astro - Unauthorized Third-Party Image Access",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55303.yaml"
},
"CVE-2025-55523": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55523.yaml"
},
"CVE-2025-5569": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "IdeaCMS <= 1.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5569.yaml"
},
"CVE-2025-55746": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L",
"cwe": "CWE-73",
"name": "Directus - Unauthenticated File Modification",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55746.yaml"
},
"CVE-2025-55747": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-23",
"name": "XWiki Platform - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55747.yaml"
},
"CVE-2025-55748": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-23",
"name": "XWiki Platform - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55748.yaml"
},
"CVE-2025-55749": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "XWiki - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55749.yaml"
},
"CVE-2025-5605": {
"name": "WSO2 Management Console - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5605.yaml"
},
"CVE-2025-56132": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-305",
"name": "LiquidFiles < 4.2 - User Enumeration via Password Reset",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56132.yaml"
},
"CVE-2025-56266": {
"name": "Avigilon ACM - Host Header Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56266.yaml"
},
"CVE-2025-56520": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "Dify v1.6.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56520.yaml"
},
"CVE-2025-56819": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Datart v1.0.0-rc.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56819.yaml"
},
"CVE-2025-5701": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "HyperComments <= 1.2.2 - Arbitrary Options Update",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5701.yaml"
},
"CVE-2025-57231": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Docmost 0.2.1-0.21.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57231.yaml"
},
"CVE-2025-5777": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-457",
"name": "Citrix NetScaler Memory Disclosure - CitrixBleed 2",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml"
},
"CVE-2025-57788": {
"name": "Commvault Unauthenticated Password Disclosure (WT-2025-0047)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57788.yaml"
},
"CVE-2025-57789": {
"name": "Commvault Initial Administrator Login Process Vulnerability",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57789.yaml"
},
"CVE-2025-57808": {
"name": "ESPHome - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57808.yaml"
},
"CVE-2025-57819": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "FreePBX - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57819.yaml"
},
"CVE-2025-57822": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "Next.js Middleware - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57822.yaml"
},
"CVE-2025-58044": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "JumpServer - Open Redirect via Referer Header",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58044.yaml"
},
"CVE-2025-58179": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Astro Cloudflare Adapter - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58179.yaml"
},
"CVE-2025-58226": {
"name": "WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58226.yaml"
},
"CVE-2025-58360": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"cwe": "CWE-611",
"name": "GeoServer - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58360.yaml"
},
"CVE-2025-58434": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Flowise <= 3.0.5 - Account Takeover",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58434.yaml"
},
"CVE-2025-58443": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-287",
"name": "FOGProject <= 1.5.10.1673 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58443.yaml"
},
"CVE-2025-58751": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Vite Dev Server - Path Traversal",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58751.yaml"
},
"CVE-2025-59049": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Mockoon < 9.2.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59049.yaml"
},
"CVE-2025-59136": {
"name": "WordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59136.yaml"
},
"CVE-2025-59287": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Windows Server Update Service - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59287.yaml"
},
"CVE-2025-59341": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-23",
"name": "esm.sh <= v136 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59341.yaml"
},
"CVE-2025-59342": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-24",
"name": "esm.sh <= v136 - Arbitrary File Write via Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59342.yaml"
},
"CVE-2025-5947": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-639",
"name": "Service Finder Bookings - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5947.yaml"
},
"CVE-2025-59474": {
"name": "Jenkins Sidepanel - Unauthorized Agent/Queue Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59474.yaml"
},
"CVE-2025-59528": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Flowise - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59528.yaml"
},
"CVE-2025-59582": {
"name": "Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59582.yaml"
},
"CVE-2025-5961": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5961.yaml"
},
"CVE-2025-59716": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-203",
"name": "ownCloud Guests - User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59716.yaml"
},
"CVE-2025-60188": {
"name": "Atarim < 4.2.2 - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-60188.yaml"
},
"CVE-2025-6058": {
"name": "WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6058.yaml"
},
"CVE-2025-61224": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61224.yaml"
},
"CVE-2025-61666": {
"name": "Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61666.yaml"
},
"CVE-2025-6174": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6174.yaml"
},
"CVE-2025-61757": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Oracle Identity Manager REST WebServices - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61757.yaml"
},
"CVE-2025-61882": {
"name": "Oracle E-Business Suite 12.2.3\u201312.2.14 \u2013 Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61882.yaml"
},
"CVE-2025-61884": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Oracle E-Business Suite - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61884.yaml"
},
"CVE-2025-6197": {
"name": "Open Redirect via Organization Switching",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6197.yaml"
},
"CVE-2025-62039": {
"name": "AI ChatBot with ChatGPT by AYS <= 2.6.6 - Unauthenticated API Key Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62039.yaml"
},
"CVE-2025-6204": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "DELMIA Apriso - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6204.yaml"
},
"CVE-2025-6205": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "DELMIA Apriso - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6205.yaml"
},
"CVE-2025-62126": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62126.yaml"
},
"CVE-2025-6216": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-640",
"name": "Allegra - Authentication Bypass via Predictable Password Reset Token",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-6216.yaml"
},
"CVE-2025-62168": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-209",
"name": "Squid Proxy - HTTP Authentication Credentials Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62168.yaml"
},
"CVE-2025-62512": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-204",
"name": "Piwigo - User Enumeration via Password Reset",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62512.yaml"
},
"CVE-2025-62522": {
"name": "Vite - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62522.yaml"
},
"CVE-2025-62593": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Ray < 2.52.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62593.yaml"
},
"CVE-2025-62613": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "VDO.Ninja - DOM-Based Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62613.yaml"
},
"CVE-2025-62780": {
"cvss": 6.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62780.yaml"
},
"CVE-2025-63387": {
"cwe": "CWE-287",
"name": "Dify v1.9.1 - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-63387.yaml"
},
"CVE-2025-6389": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6389.yaml"
},
"CVE-2025-6403": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Code-Projects School Fees Payment System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6403.yaml"
},
"CVE-2025-64095": {
"name": "DNN - Unrestricted Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64095.yaml"
},
"CVE-2025-64328": {
"cvss": 8.6,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"name": "FreePBX  >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64328.yaml"
},
"CVE-2025-64446": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-23",
"name": "FortiWeb - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64446.yaml"
},
"CVE-2025-64500": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-647",
"name": "Symfony HttpFoundation - Access Control Bypass via PATH_INFO",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64500.yaml"
},
"CVE-2025-64525": {
"name": "Astro - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64525.yaml"
},
"CVE-2025-64764": {
"name": "Astro - Reflected XSS via server islands feature",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64764.yaml"
},
"CVE-2025-66472": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-80",
"name": "XWiki DeleteApplication - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66472.yaml"
},
"CVE-2025-66516": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-611",
"name": "Apache Tika - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66516.yaml"
},
"CVE-2025-66744": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Yonyou YonBIP - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66744.yaml"
},
"CVE-2025-67303": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-420",
"name": "ComfyUI-Manager < 3.38 - Configuration Overwrite",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-67303.yaml"
},
"CVE-2025-6747": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2025/CVE-2025-6747-fusion_builder-f0a21eaa-4e2a-4d07-8635-f0a8a5db660f.yaml"
},
"CVE-2025-68043": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-862",
"name": "LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68043.yaml"
},
"CVE-2025-68273": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Signal K Server <= 2.18.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68273.yaml"
},
"CVE-2025-68493": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"cwe": "CWE-611",
"name": "Apache Struts XWork - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68493.yaml"
},
"CVE-2025-68509": {
"name": "User Submitted Posts <= 20251121 - Unauthenticated Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68509.yaml"
},
"CVE-2025-6851": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6851.yaml"
},
"CVE-2025-68602": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "Accept Donations with PayPal <= 1.5.2 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68602.yaml"
},
"CVE-2025-68613": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "n8n - Remote Code Execution via Expression Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68613.yaml"
},
"CVE-2025-68645": {
"name": "Zimbra Collaboration - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68645.yaml"
},
"CVE-2025-68926": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-68926.yaml"
},
"CVE-2025-69200": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-202",
"name": "phpMyFAQ - Configuration Backup Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69200.yaml"
},
"CVE-2025-6934": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "The Opal Estate Pro \u2013 Property Management <= 1.7.5 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6934.yaml"
},
"CVE-2025-69411": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "ionCube Tester Plus <= 1.3 - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69411.yaml"
},
"CVE-2025-6970": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "WordPress Events Manager <= 7.0.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6970.yaml"
},
"CVE-2025-6984": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "langchain-ai langchain - XML External Entity Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-6984.yaml"
},
"CVE-2025-69971": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-321",
"name": "FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69971.yaml"
},
"CVE-2025-71243": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "SPIP Saisies - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71243.yaml"
},
"CVE-2025-71257": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cwe": "CWE-287",
"name": "BMC FootPrints - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71257.yaml"
},
"CVE-2025-71258": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "BMC FootPrints 'searchWeb' - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71258.yaml"
},
"CVE-2025-71259": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "BMC FootPrints 'feedUrl' - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71259.yaml"
},
"CVE-2025-71260": {
"name": "BMC FootPrints - Deserialization of Untrusted Data (RCE)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-71260.yaml"
},
"CVE-2025-71324": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-73",
"name": "Flowise - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71324.yaml"
},
"CVE-2025-71334": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-73",
"name": "Flowise - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71334.yaml"
},
"CVE-2025-7160": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Zoo Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-7160.yaml"
},
"CVE-2025-7901": {
"name": "yangzongzhuan RuoYi - DOM Based XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-7901.yaml"
},
"CVE-2025-8085": {
"name": "Ditty < 3.1.58 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8085.yaml"
},
"CVE-2025-8110": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Gogs <= 0.13.3 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8110.yaml"
},
"CVE-2025-8191": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-8191.yaml"
},
"CVE-2025-8266": {
"name": "ChanCMS <= 3.1. - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8266.yaml"
},
"CVE-2025-8286": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "G\u00fcralp Systems FMUS Series - Unauthenticated Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-8286.yaml"
},
"CVE-2025-8848": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8848.yaml"
},
"CVE-2025-8868": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Chef Automate < 4.13.295 \u2014 SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8868.yaml"
},
"CVE-2025-8943": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Flowise < 3.0.1 - Remote Command Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8943.yaml"
},
"CVE-2025-9196": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Trinity Audio <= 5.21.0 - Information Exposure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9196.yaml"
},
"CVE-2025-9209": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "RestroPress 3.0.0-3.2.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9209.yaml"
},
"CVE-2025-9242": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "WatchGuard IKEv2 Out-of-Bounds Write Vulnerability",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-9242.yaml"
},
"CVE-2025-9316": {
"name": "N-central - Authentication Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9316.yaml"
},
"CVE-2025-9744": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Loan Management System 1.0 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9744.yaml"
},
"CVE-2025-9808": {
"name": "The Events Calendar <= 6.15.2 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9808.yaml"
},
"CVE-2025-9985": {
"name": "Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9985.yaml"
},
"CVE-2026-0257": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-565",
"name": "Palo Alto Networks PAN-OS - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-0257.yaml"
},
"CVE-2026-0545": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-306",
"name": "MLflow Job API - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0545.yaml"
},
"CVE-2026-0558": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "LolLMS <= 2.2.0 - Unauthenticated File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0558.yaml"
},
"CVE-2026-0560": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "LolLMS < 2.2.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0560.yaml"
},
"CVE-2026-0561": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Shield Security <= 21.0.8 - Unauthenticated Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0561.yaml"
},
"CVE-2026-0594": {
"name": "WordPress List Site Contributors < 1.1.8 - Reflected XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0594.yaml"
},
"CVE-2026-0650": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "OpenFlagr <= 1.1.18 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0650.yaml"
},
"CVE-2026-0692": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"name": "BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0692.yaml"
},
"CVE-2026-0702": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "VidShop for WooCommerce <= 1.1.4 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0702.yaml"
},
"CVE-2026-0717": {
"name": "LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0717.yaml"
},
"CVE-2026-0740": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0740.yaml"
},
"CVE-2026-0743": {
"cvss": 4.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Content Permission <= 1.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0743.yaml"
},
"CVE-2026-0768": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0768.yaml"
},
"CVE-2026-0770": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0770.yaml"
},
"CVE-2026-0829": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0829.yaml"
},
"CVE-2026-0926": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "Prodigy Commerce <= 3.3.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0926.yaml"
},
"CVE-2026-10520": {
"name": "Ivanti Sentry - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10520.yaml"
},
"CVE-2026-10580": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-285",
"name": "Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10580.yaml"
},
"CVE-2026-10768": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Drupal LocalGov Workflows < 1.6.0 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10768.yaml"
},
"CVE-2026-10795": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-347",
"name": "UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-10795.yaml"
},
"CVE-2026-10818": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10818.yaml"
},
"CVE-2026-10823": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "YMC Filter WordPress - Unauthenticated Post Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10823.yaml"
},
"CVE-2026-1115": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "parisneo/lollms < 2.2.0 - Authenticated Stored XSS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1115.yaml"
},
"CVE-2026-11387": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "SMS Alert \u2013 SMS & OTP for WooCommerce - Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-11387.yaml"
},
"CVE-2026-11801": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "WPAdverts <= 2.3.2 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-11801.yaml"
},
"CVE-2026-1207": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-89",
"name": "Django RasterField - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1207.yaml"
},
"CVE-2026-12227": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-98",
"name": "Visual Composer <= 45.16.0 - Unauthenticated LFI",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12227.yaml"
},
"CVE-2026-12394": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12394.yaml"
},
"CVE-2026-12483": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-12483-sfwd_lms-a539ba27-ad9b-4fe6-8df4-71e262c7b158.yaml"
},
"CVE-2026-12536": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-12536-fusion_builder-6199b852-3270-4456-934b-68c3ef11b9e5.yaml"
},
"CVE-2026-1277": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "URL Shortify <= 1.12.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1277.yaml"
},
"CVE-2026-1281": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1281.yaml"
},
"CVE-2026-12843": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"name": ">",
"severity": "medium",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-12843-sfwd_lms-48d29e8d-4084-401e-82ff-e4750d739c7c.yaml"
},
"CVE-2026-12898": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"cwe": "CWE-22",
"name": "All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12898.yaml"
},
"CVE-2026-1296": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1296.yaml"
},
"CVE-2026-13001": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-20",
"name": "Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13001.yaml"
},
"CVE-2026-1306": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1306.yaml"
},
"CVE-2026-1314": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WordPress 3D FlipBook <= 1.16.17 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1314.yaml"
},
"CVE-2026-13147": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "WordPress Kirki < 6.0.12 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13147.yaml"
},
"CVE-2026-13153": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Essential Blocks < 6.4.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13153.yaml"
},
"CVE-2026-1340": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Ivanti EPMM < 12.8.0.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1340.yaml"
},
"CVE-2026-1357": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1357.yaml"
},
"CVE-2026-1368": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1368.yaml"
},
"CVE-2026-13731": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WPBot <= 8.4.9 - Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13731.yaml"
},
"CVE-2026-1405": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1405.yaml"
},
"CVE-2026-14483": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14483.yaml"
},
"CVE-2026-14894": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Super Forms <= 6.3.313 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14894.yaml"
},
"CVE-2026-1492": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1492.yaml"
},
"CVE-2026-1509": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-1509-fusion_builder-fdc57b06-bae9-49a3-84dd-f593705330e9.yaml"
},
"CVE-2026-15094": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WP Hotel Booking <= 2.3.2 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-15094.yaml"
},
"CVE-2026-15409": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "SonicWall SMA1000 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-15409.yaml"
},
"CVE-2026-1541": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-1541-fusion_builder-f1f69f93-80e3-434d-98a6-fc8757b4e6d1.yaml"
},
"CVE-2026-1543": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-1543-fusion_builder-72a6b040-ed02-4561-82f2-4adb820bdf7d.yaml"
},
"CVE-2026-1557": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "WP Responsive Images <= 1.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1557.yaml"
},
"CVE-2026-15733": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-15733.yaml"
},
"CVE-2026-1581": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "wpForo Forum <= 2.4.14 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1581.yaml"
},
"CVE-2026-15826": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-704",
"name": "User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-15826.yaml"
},
"CVE-2026-1603": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-288",
"name": "Ivanti Endpoint Manager - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1603.yaml"
},
"CVE-2026-16232": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Check Point Security Management Server - SmartConsole Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-16232.yaml"
},
"CVE-2026-16268": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"cwe": "CWE-918",
"name": "Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-16268.yaml"
},
"CVE-2026-16654": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-16654-fusion_builder-8d3c29b8-7910-41f1-b203-6c89519f8806.yaml"
},
"CVE-2026-1731": {
"cwe": "CWE-78",
"name": "BeyondTrust Remote Support - Unauthenticated WebSocket RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml"
},
"CVE-2026-17505": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "WordPress TranslatePress < 3.2.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-17505.yaml"
},
"CVE-2026-17532": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-17532.yaml"
},
"CVE-2026-17594": {
"cvss": 8.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"cwe": "CWE-863",
"name": "Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-17594.yaml"
},
"CVE-2026-18072": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18072.yaml"
},
"CVE-2026-1830": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1830.yaml"
},
"CVE-2026-18431": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "critical",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-18431-fusion_builder-5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390.yaml"
},
"CVE-2026-18577": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "N-able N-central < 2026.3.1.10 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18577.yaml"
},
"CVE-2026-1890": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1890.yaml"
},
"CVE-2026-18963": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-640",
"name": "Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml"
},
"CVE-2026-19092": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-74",
"name": "Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19092.yaml"
},
"CVE-2026-19478": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"cwe": "CWE-94",
"name": "GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19478.yaml"
},
"CVE-2026-19598": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19598.yaml"
},
"CVE-2026-19632": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-640",
"name": "TranslatePress <= 3.3.1 - Unauthenticated Account Takeover",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19632.yaml"
},
"CVE-2026-1980": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1980.yaml"
},
"CVE-2026-19900": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "LB-LINK Routers - Unauthenticated Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19900.yaml"
},
"CVE-2026-20079": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "Cisco Secure Firewall Management Center - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml"
},
"CVE-2026-20182": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Cisco Catalyst SD-WAN Controller - vHub Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-20182.yaml"
},
"CVE-2026-2025": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Mail Mint < 1.19.5 - Unauthenticated Email Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2025.yaml"
},
"CVE-2026-20253": {
"name": "Splunk Enterprise & Cloud Platform - Unrestricted File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20253.yaml"
},
"CVE-2026-20896": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-290",
"name": "Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20896.yaml"
},
"CVE-2026-2113": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "tpadmin <= 1.3.12 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2113.yaml"
},
"CVE-2026-21445": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-306",
"name": "Langflow - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21445.yaml"
},
"CVE-2026-21484": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"name": "AnythingLLM - Username Enumeration via Password Recovery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21484.yaml"
},
"CVE-2026-21589": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml"
},
"CVE-2026-21643": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Fortinet FortiClientEMS 7.4.4 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21643.yaml"
},
"CVE-2026-21858": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-20",
"name": "n8n Webhooks - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21858.yaml"
},
"CVE-2026-21859": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Mailpit < 1.28.3 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21859.yaml"
},
"CVE-2026-21875": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21875.yaml"
},
"CVE-2026-21877": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21877.yaml"
},
"CVE-2026-21891": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-287",
"name": "ZimaOS - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21891.yaml"
},
"CVE-2026-22200": {
"cwe": "CWE-74",
"name": "osTicket - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22200.yaml"
},
"CVE-2026-22557": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "UniFi Network Application - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22557.yaml"
},
"CVE-2026-2262": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "Easy Appointments <= 3.12.21 - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2262.yaml"
},
"CVE-2026-22683": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-862",
"name": "Windmill < 1.603.3 - Operator Authorization Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22683.yaml"
},
"CVE-2026-22739": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cwe": "CWE-22",
"name": "Spring Cloud Config Server - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22739.yaml"
},
"CVE-2026-22778": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-209",
"name": "vLLM 0.8.3 - 0.14.0 - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22778.yaml"
},
"CVE-2026-22812": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "OpenCode < 1.0.216 - Unauthenticated Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22812.yaml"
},
"CVE-2026-23482": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Blinko < 1.8.4 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23482.yaml"
},
"CVE-2026-23483": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Blinko <= 1.8.3 - Path Traversal via /plugins",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23483.yaml"
},
"CVE-2026-23486": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Blinko <= 1.8.3 - User Information Leak",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23486.yaml"
},
"CVE-2026-23491": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "InvoicePlane <= 1.6.3 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23491.yaml"
},
"CVE-2026-23536": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Feast Feature Server <=0.58.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23536.yaml"
},
"CVE-2026-23550": {
"name": "Modular DS - Broken Access Control",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23550.yaml"
},
"CVE-2026-23693": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
"cwe": "CWE-306",
"name": "ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23693.yaml"
},
"CVE-2026-23696": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Windmill < 1.603.3 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23696.yaml"
},
"CVE-2026-23744": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "MCPJam Inspector - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23744.yaml"
},
"CVE-2026-23760": {
"name": "SmarterTools SmarterMail - Admin Password Reset",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23760.yaml"
},
"CVE-2026-23829": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-93",
"name": "Mailpit < 1.28.2 - SMTP CRLF Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-23829.yaml"
},
"CVE-2026-24061": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-88",
"name": "GNU Inetutils telnetd - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-24061.yaml"
},
"CVE-2026-24128": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki Platform Distribution Flavor Main - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24128.yaml"
},
"CVE-2026-2413": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "Ally \u2013 Web Accessibility & Usability <= 4.0.3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2413.yaml"
},
"CVE-2026-2416": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Geo Mashup <= 1.13.17 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2416.yaml"
},
"CVE-2026-24207": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-288",
"name": "NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24207.yaml"
},
"CVE-2026-24423": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "SmarterMail - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24423.yaml"
},
"CVE-2026-24477": {
"name": "AnythingLLM - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24477.yaml"
},
"CVE-2026-25231": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-284",
"name": "FileRise <= 3.3.0 - Unauthenticated File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25231.yaml"
},
"CVE-2026-25472": {
"cvss": 6.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-25472-fusion_builder-67f23705-ee04-40a7-a4d9-3bf654a2cb12.yaml"
},
"CVE-2026-25512": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Group-Office < 26.0.5 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25512.yaml"
},
"CVE-2026-25527": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "changedetection.io <= 0.52.9 - Unauthenticated Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25527.yaml"
},
"CVE-2026-25545": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Astro SSR - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25545.yaml"
},
"CVE-2026-25555": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "OpenBullet2 <= 0.3.2 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25555.yaml"
},
"CVE-2026-25616": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Blesta <= 5.13.1 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25616.yaml"
},
"CVE-2026-25703": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-202",
"name": "NeuVector - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25703.yaml"
},
"CVE-2026-25892": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-20",
"name": "Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25892.yaml"
},
"CVE-2026-25895": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25895.yaml"
},
"CVE-2026-2614": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "MLflow <= 3.9.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2614.yaml"
},
"CVE-2026-26190": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Milvus - Unauthenticated Metrics API Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26190.yaml"
},
"CVE-2026-26216": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26216.yaml"
},
"CVE-2026-26217": {
"name": "Crawl4AI < 0.8.0 - Local File Inclusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26217.yaml"
},
"CVE-2026-26265": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-639",
"name": "Discourse - Private User Field Disclosure via Directory Items IDOR",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26265.yaml"
},
"CVE-2026-26341": {
"cvss": 9.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-1392",
"name": "Tattile Camera < 1.181.5 - Default Login",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26341.yaml"
},
"CVE-2026-2652": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"cwe": "CWE-306",
"name": "MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2652.yaml"
},
"CVE-2026-26980": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-89",
"name": "Ghost CMS Content API - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26980.yaml"
},
"CVE-2026-2699": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "Progress ShareFile Storage Zones Controller - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2699.yaml"
},
"CVE-2026-27174": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-94",
"name": "MajorDoMo - Unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27174.yaml"
},
"CVE-2026-27176": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "MajorDoMo - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27176.yaml"
},
"CVE-2026-27454": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27454.yaml"
},
"CVE-2026-27483": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "MindsDB - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27483.yaml"
},
"CVE-2026-27542": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-266",
"name": "WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27542.yaml"
},
"CVE-2026-27645": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Changedetection.io RSS Single Watch - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27645.yaml"
},
"CVE-2026-27760": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "OpenCATS - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27760.yaml"
},
"CVE-2026-27771": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Gitea Container Registry - Unauthorized Private Image Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27771.yaml"
},
"CVE-2026-27796": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Homarr < 1.54.0 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27796.yaml"
},
"CVE-2026-27826": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "mcp-atlassian < 0.17.0 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27826.yaml"
},
"CVE-2026-27833": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27833.yaml"
},
"CVE-2026-27886": {
"cvss": 9.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"cwe": "CWE-200",
"name": "Strapi <=5.36.x - Admin Credential Enumeration",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-27886.yaml"
},
"CVE-2026-27944": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Nginx UI < 2.3.3 - Information Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27944.yaml"
},
"CVE-2026-27960": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27960.yaml"
},
"CVE-2026-27971": {
"cvss": 9.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-502",
"name": "Qwik - Unauthenticated RCE via server$ Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27971.yaml"
},
"CVE-2026-28141": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28141.yaml"
},
"CVE-2026-28288": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-204",
"name": "Dify User Enumeration via Observable Response Discrepancy",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28288.yaml"
},
"CVE-2026-28358": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-204",
"name": "NocoDB - User Enumeration",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28358.yaml"
},
"CVE-2026-28409": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "WeGIA <= 3.6.4 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28409.yaml"
},
"CVE-2026-28411": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28411.yaml"
},
"CVE-2026-28414": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-36",
"name": "Gradio - Absolute Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28414.yaml"
},
"CVE-2026-28496": {
"name": "FOSSBilling - Server-Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28496.yaml"
},
"CVE-2026-29014": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "MetInfo CMS <= 8.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29014.yaml"
},
"CVE-2026-29058": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29058.yaml"
},
"CVE-2026-29059": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-22",
"name": "Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29059.yaml"
},
"CVE-2026-29066": {
"cvss": 6.2,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "TinaCMS - Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29066.yaml"
},
"CVE-2026-29183": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SiYuan Note - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29183.yaml"
},
"CVE-2026-29962": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-73",
"name": "HSC MailInspector - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29962.yaml"
},
"CVE-2026-29963": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "HSC MailInspector - Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29963.yaml"
},
"CVE-2026-3001": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3001.yaml"
},
"CVE-2026-3018": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3018.yaml"
},
"CVE-2026-3055": {
"name": "Citrix NetScaler SAML IDP - Memory Overread",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3055.yaml"
},
"CVE-2026-30623": {
"cwe": "CWE-77",
"name": "LiteLLM 1.18.10 - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30623.yaml"
},
"CVE-2026-3079": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-3079-sfwd_lms-29a560fa-03bf-435c-85da-68397deab2a6.yaml"
},
"CVE-2026-30824": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Flowise - NVIDIA NIM Endpoints Missing Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30824.yaml"
},
"CVE-2026-30849": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-843",
"name": "MantisBT < 2.28.1 - SOAP API Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30849.yaml"
},
"CVE-2026-30928": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Glances - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30928.yaml"
},
"CVE-2026-30958": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-22",
"name": "OneUptime < 10.0.21 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30958.yaml"
},
"CVE-2026-30965": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-863",
"name": "Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30965.yaml"
},
"CVE-2026-31431": {
"cvss": 7.8,
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-787",
"name": "Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-31431.yaml"
},
"CVE-2026-31807": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "SiYuan <= v3.5.9 - SVG Animate Element XSS",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31807.yaml"
},
"CVE-2026-31809": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-79",
"name": "SiYuan <= v3.5.9 - Cross Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31809.yaml"
},
"CVE-2026-31816": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-74",
"name": "Budibase - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31816.yaml"
},
"CVE-2026-31831": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Tautulli <= 2.16.1 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31831.yaml"
},
"CVE-2026-32230": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Uptime-Kuma < v1.23.0 - Improper Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32230.yaml"
},
"CVE-2026-32255": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Kan <= 0.5.4 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32255.yaml"
},
"CVE-2026-32451": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-32451-fusion_builder-2f881298-23f3-471c-b6f1-ebaf72d7180e.yaml"
},
"CVE-2026-32452": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"name": ">",
"severity": "high",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-32452-fusion_builder-149ef56e-b9a6-4d28-9c90-0e2fa917ada6.yaml"
},
"CVE-2026-32475": {
"cvss": 9.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32475.yaml"
},
"CVE-2026-32542": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": ">",
"severity": "medium",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-32542-fusion_builder-f946c5b9-a227-47bd-bae2-decbb5748436.yaml"
},
"CVE-2026-32583": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "Webnus Inc. Modern Events Calendar - Broken Access Control",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32583.yaml"
},
"CVE-2026-32596": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Glances - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32596.yaml"
},
"CVE-2026-3296": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3296.yaml"
},
"CVE-2026-3300": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3300.yaml"
},
"CVE-2026-33017": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Langflow < 1.9.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33017.yaml"
},
"CVE-2026-33032": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Nginx UI - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33032.yaml"
},
"CVE-2026-33057": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Mesop AI Sandbox <= 1.2.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33057.yaml"
},
"CVE-2026-3326": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "XStore Theme < 9.7.3 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3326.yaml"
},
"CVE-2026-33340": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-306",
"name": "LoLLMs WEBUI - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33340.yaml"
},
"CVE-2026-3335": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-862",
"name": "Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3335.yaml"
},
"CVE-2026-33439": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33439.yaml"
},
"CVE-2026-33453": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-915",
"name": "Apache Camel camel-coap - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-33453.yaml"
},
"CVE-2026-33476": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SiYuan <= v3.6.1 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33476.yaml"
},
"CVE-2026-33478": {
"name": "AVideo <= 26.0 - WWBN AVideo - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33478.yaml"
},
"CVE-2026-33497": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Langflow < 1.7.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33497.yaml"
},
"CVE-2026-33534": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-918",
"name": "EspoCRM <= 9.3.3 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33534.yaml"
},
"CVE-2026-33626": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "LMDeploy - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33626.yaml"
},
"CVE-2026-33868": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "Mastodon - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33868.yaml"
},
"CVE-2026-3395": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-94",
"name": "MaxSite CMS <=109.1 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3395.yaml"
},
"CVE-2026-3396": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WCAPF WooCommerce Ajax Product Filter - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3396.yaml"
},
"CVE-2026-34036": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-98",
"name": "Dolibarr <=22.0.4 - Local File Inclusion",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34036.yaml"
},
"CVE-2026-34156": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-913",
"name": "NocoBase - VM Sandbox Escape to Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34156.yaml"
},
"CVE-2026-34197": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Apache ActiveMQ - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34197.yaml"
},
"CVE-2026-34234": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "CtrlPanel <= 1.1.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34234.yaml"
},
"CVE-2026-34413": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Xerte Online Toolkits <= 3.15 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34413.yaml"
},
"CVE-2026-34453": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "SiYuan <= v3.6.1 - Bookmark Data Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34453.yaml"
},
"CVE-2026-34486": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34486.yaml"
},
"CVE-2026-34605": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "SiYuan Note - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34605.yaml"
},
"CVE-2026-34847": {
"cvss": 4.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"cwe": "CWE-601",
"name": "Hoppscotch <= 2026.2.1 - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34847.yaml"
},
"CVE-2026-34885": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-89",
"name": "WordPress Media Library Assistant <= 3.34 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34885.yaml"
},
"CVE-2026-34908": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "UniFi OS - Authentication Bypass via Path Traversal (..%2f)",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34908.yaml"
},
"CVE-2026-34910": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "UniFi OS Server - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34910.yaml"
},
"CVE-2026-34976": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "Dgraph <=v25.3.0 - Admin Mutation Missing Authorization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34976.yaml"
},
"CVE-2026-35029": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-863",
"name": "LiteLLM - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35029.yaml"
},
"CVE-2026-35037": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Ech0 < 4.2.8 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35037.yaml"
},
"CVE-2026-35273": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35273.yaml"
},
"CVE-2026-35616": {
"cwe": "CWE-284",
"name": "FortiClient EMS - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35616.yaml"
},
"CVE-2026-3576": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-20",
"name": "Planyo Online Reservation System <= 3.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3576.yaml"
},
"CVE-2026-3584": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress Kali Forms <= 2.4.9 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3584.yaml"
},
"CVE-2026-38360": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-38360.yaml"
},
"CVE-2026-38361": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe": "CWE-400",
"name": "dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-38361.yaml"
},
"CVE-2026-3844": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Breeze <= 2.4.4 - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3844.yaml"
},
"CVE-2026-3891": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3891.yaml"
},
"CVE-2026-39339": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-284",
"name": "ChurchCRM - API Authentication Bypass via URL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39339.yaml"
},
"CVE-2026-39352": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39352.yaml"
},
"CVE-2026-39363": {
"cvss": 8.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"name": "Vite Dev Server - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39363.yaml"
},
"CVE-2026-39364": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Vite Dev Server - Directory Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39364.yaml"
},
"CVE-2026-39365": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-22",
"name": "Vite Dev Server - Path Traversal in Optimized Deps .map Handling",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39365.yaml"
},
"CVE-2026-39808": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Fortinet FortiSandbox - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39808.yaml"
},
"CVE-2026-39987": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-306",
"name": "Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39987.yaml"
},
"CVE-2026-40105": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "XWiki - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40105.yaml"
},
"CVE-2026-40151": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "PraisonAI AgentOS - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40151.yaml"
},
"CVE-2026-4020": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Gravity SMTP WordPress Plugin - Sensitive Information Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4020.yaml"
},
"CVE-2026-40217": {
"cvss": 8.7,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-94",
"name": "LiteLLM < 1.25.0 - Remote Code Execution",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40217.yaml"
},
"CVE-2026-40242": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "Arcane <= 1.17.2 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40242.yaml"
},
"CVE-2026-40280": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "Gotenberg <= 8.30.1 - Server Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40280.yaml"
},
"CVE-2026-40281": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-88",
"name": "Gotenberg <= 8.30.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40281.yaml"
},
"CVE-2026-40308": {
"cwe": "CWE-639",
"name": "My Calendar WordPress Plugin - Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40308.yaml"
},
"CVE-2026-40466": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": "Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40466.yaml"
},
"CVE-2026-4060": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "Geo Mashup <= 1.13.18 - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4060.yaml"
},
"CVE-2026-40878": {
"cvss": 3.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"name": "Mailcow < 2026-03b - Href Link Injection",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40878.yaml"
},
"CVE-2026-40887": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cwe": "CWE-89",
"name": "Vendure Core - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40887.yaml"
},
"CVE-2026-41042": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-20",
"name": "Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41042.yaml"
},
"CVE-2026-4106": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": "HT Mega < 3.0.7 - Sensitive Information Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4106.yaml"
},
"CVE-2026-41176": {
"cvss": 9.2,
"cwe": "CWE-306",
"name": "Rclone RC - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41176.yaml"
},
"CVE-2026-41179": {
"cvss": 9.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-78",
"name": "RClone RC - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41179.yaml"
},
"CVE-2026-41432": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"cwe": "CWE-345",
"name": "New API < v0.12.10 - Stripe Webhook Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41432.yaml"
},
"CVE-2026-41452": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Krayin CRM < 2.2.1 - Installer Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41452.yaml"
},
"CVE-2026-41456": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Bludit CMS <= 3.20.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41456.yaml"
},
"CVE-2026-41492": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-200",
"name": "Dgraph <= 25.3.2 - Admin Token Disclosure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41492.yaml"
},
"CVE-2026-41640": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NocoBase - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41640.yaml"
},
"CVE-2026-41641": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "NocoBase - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41641.yaml"
},
"CVE-2026-41679": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"name": "Paperclip - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41679.yaml"
},
"CVE-2026-41940": {
"name": "cPanel & WHM - Authentication Bypass via Session-File CRLF Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41940.yaml"
},
"CVE-2026-41948": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-23",
"name": "Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41948.yaml"
},
"CVE-2026-42018": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42018.yaml"
},
"CVE-2026-42031": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "CKAN DataStore SQL Search - SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42031.yaml"
},
"CVE-2026-42167": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "ProFTPD mod_sql - Preauth User Backdoor",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-42167.yaml"
},
"CVE-2026-42208": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "LiteLLM - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42208.yaml"
},
"CVE-2026-42221": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42221.yaml"
},
"CVE-2026-42271": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "LiteLLM - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42271.yaml"
},
"CVE-2026-42281": {
"cvss": 9.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"cwe": "CWE-918",
"name": "MagicMirror <= 2.35.0 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42281.yaml"
},
"CVE-2026-42461": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42461.yaml"
},
"CVE-2026-42569": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"name": "phpVMS < 7.0.6 - Legacy Importer Authorization Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42569.yaml"
},
"CVE-2026-4257": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "WordPress Contact Form by Supsystic - Server-Side Template Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4257.yaml"
},
"CVE-2026-42589": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Gotenberg - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42589.yaml"
},
"CVE-2026-42596": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "Gotenberg < 8.31.0 - Server-Side Request Forgery",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42596.yaml"
},
"CVE-2026-42647": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-89",
"name": "JoomSport <= 5.7.7 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42647.yaml"
},
"CVE-2026-42796": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Arelle < 2.39.10 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42796.yaml"
},
"CVE-2026-42878": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "FacturaScripts - Unauthenticated phpinfo Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42878.yaml"
},
"CVE-2026-44177": {
"cvss": 8.8,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"cwe": "CWE-22",
"name": "Kirby CMS 5.3.0-5.4.0 - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44177.yaml"
},
"CVE-2026-44262": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-94",
"name": "Scramble Laravel - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44262.yaml"
},
"CVE-2026-44338": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-306",
"name": "PraisonAI - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44338.yaml"
},
"CVE-2026-44343": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "WGDashboard < 4.3.2 - Unauthenticated File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44343.yaml"
},
"CVE-2026-44381": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-89",
"name": "MISP < 2.5.37 - SQL Injection",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44381.yaml"
},
"CVE-2026-44551": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-287",
"name": "Open WebUI 'LDAP Empty Password' - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44551.yaml"
},
"CVE-2026-44578": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Next.js WebSocket Upgrade Handler - SSRF",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-44578.yaml"
},
"CVE-2026-4480": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Samba Printing Subsystem - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-4480.yaml"
},
"CVE-2026-44825": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44825.yaml"
},
"CVE-2026-45298": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Dozzle - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45298.yaml"
},
"CVE-2026-45332": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45332.yaml"
},
"CVE-2026-45397": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Open WebUI < 0.9.5 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45397.yaml"
},
"CVE-2026-45695": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-88",
"name": "Kopia Server 0.23.0 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45695.yaml"
},
"CVE-2026-4631": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Cockpit Web Console < 360 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4631.yaml"
},
"CVE-2026-46339": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "9Router <= 0.4.36 - Unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46339.yaml"
},
"CVE-2026-46364": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "phpMyFAQ <= 4.1.1 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46364.yaml"
},
"CVE-2026-46372": {
"cvss": 8.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "SillyTavern - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46372.yaml"
},
"CVE-2026-46442": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Flowise < 3.1.2 - node-custom-function Unauthorized RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46442.yaml"
},
"CVE-2026-46670": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "YesWiki < 4.6.4 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46670.yaml"
},
"CVE-2026-46725": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "TYPO3 ceselector Extension - Insecure Deserialization",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46725.yaml"
},
"CVE-2026-47668": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "DbGate - Remote Code Execution via Anonymous JWT",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47668.yaml"
},
"CVE-2026-47670": {
"cvss": 9.4,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-77",
"name": "DbGate - Remote Code Execution via Dynamic Import Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47670.yaml"
},
"CVE-2026-47717": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-201",
"name": "FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47717.yaml"
},
"CVE-2026-4782": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-4782-fusion_builder-86346be9-7ca6-49b7-83b2-01a335d48c94.yaml"
},
"CVE-2026-4798": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"name": ">",
"severity": "critical",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-4798-fusion_builder-22b55747-8b46-4812-9345-0db03500105f.yaml"
},
"CVE-2026-48030": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Pheditor 2.0.1-2.0.3 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48030.yaml"
},
"CVE-2026-4810": {
"cvss": 9.3,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/U:Amber",
"name": "Google ADK-Python - Unauthenticated Builder Endpoint",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4810.yaml"
},
"CVE-2026-48282": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Adobe ColdFusion - RDS Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48282.yaml"
},
"CVE-2026-48313": {
"name": "ColdFusion - Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48313.yaml"
},
"CVE-2026-48558": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-347",
"name": "SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48558.yaml"
},
"CVE-2026-48611": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "phpBB < 3.3.17 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48611.yaml"
},
"CVE-2026-48710": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"cwe": "CWE-1289",
"name": "Starlette - Improper Validation of Unsafe Equivalence in Input",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml"
},
"CVE-2026-48907": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "Joomla! JCE extension < 2.9.99.5 unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48907.yaml"
},
"CVE-2026-48908": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-48908.yaml"
},
"CVE-2026-48909": {
"cvss": 9.5,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-502",
"name": "Joomla SP LMS <= 4.1.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-48909.yaml"
},
"CVE-2026-48939": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48939.yaml"
},
"CVE-2026-49049": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-284",
"name": "JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml"
},
"CVE-2026-49060": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-266",
"name": "Hippoo Mobile App for WooCommerce - Broken Access Control",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49060.yaml"
},
"CVE-2026-49069": {
"cvss": 7.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"cwe": "CWE-79",
"name": "WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49069.yaml"
},
"CVE-2026-49468": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:H/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-290",
"name": "LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49468.yaml"
},
"CVE-2026-49777": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-506",
"name": "WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49777.yaml"
},
"CVE-2026-4987": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-20",
"name": "SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4987.yaml"
},
"CVE-2026-49952": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-323",
"name": "Discuz! X5.0 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49952.yaml"
},
"CVE-2026-50160": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-915",
"name": "Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50160.yaml"
},
"CVE-2026-50229": {
"cwe": "CWE-80",
"name": "Apache Tomcat - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50229.yaml"
},
"CVE-2026-50230": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Lyrion Music Server <= 9.2.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50230.yaml"
},
"CVE-2026-5027": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Langflow <= 1.8.4 - Path Traversal to RCE via File Upload",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5027.yaml"
},
"CVE-2026-5032": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-200",
"name": "W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5032.yaml"
},
"CVE-2026-5073": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5073.yaml"
},
"CVE-2026-50751": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"name": "Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50751.yaml"
},
"CVE-2026-52773": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "YesWiki Archived Revision - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52773.yaml"
},
"CVE-2026-52774": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "YesWiki Bazar Widget - Reflected XSS via 'id' Parameter",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52774.yaml"
},
"CVE-2026-52806": {
"cvss": 9.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-77",
"name": "Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52806.yaml"
},
"CVE-2026-52815": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure",
"severity": "low",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52815.yaml"
},
"CVE-2026-52824": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-1188",
"name": "Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52824.yaml"
},
"CVE-2026-53519": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "Nezha Dashboard < 2.0.13 - Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53519.yaml"
},
"CVE-2026-53576": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Kestra <= 1.3.20 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53576.yaml"
},
"CVE-2026-53595": {
"cvss": 9.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"cwe": "CWE-289",
"name": "FreeScout < 1.8.224 - Invite Hash Authorization Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53595.yaml"
},
"CVE-2026-53629": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "GLPI - Blind SQL Injection in History Log Filter (LogBleed)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53629.yaml"
},
"CVE-2026-53753": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Crawl4AI <= 0.8.6 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53753.yaml"
},
"CVE-2026-53755": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "crawl4ai < 0.8.9 - Server Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53755.yaml"
},
"CVE-2026-53787": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53787.yaml"
},
"CVE-2026-53976": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53976.yaml"
},
"CVE-2026-54066": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "SiYuan <= 3.6.5 - Unauthenticated Path Traversal",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54066.yaml"
},
"CVE-2026-54069": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-346",
"name": "SiYuan Note <= 3.6.5 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54069.yaml"
},
"CVE-2026-54157": {
"cwe": "CWE-918",
"name": "LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54157.yaml"
},
"CVE-2026-54193": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-54193-fusion_builder-ea5533ab-068a-4a94-bf0a-fc15fcfb383b.yaml"
},
"CVE-2026-54194": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-54194-fusion_builder-a84da684-17b3-43d7-b8dd-2570ee44851e.yaml"
},
"CVE-2026-54236": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-532",
"name": "vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54236.yaml"
},
"CVE-2026-54836": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"cwe": "CWE-89",
"name": "YMC Filter - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54836.yaml"
},
"CVE-2026-54917": {
"cvss": 7.8,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"cwe": "CWE-22",
"name": "SeaweedFS <= 4.29 - Path Traversal File Write",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54917.yaml"
},
"CVE-2026-55040": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-1390",
"name": "Microsoft SharePoint Server - JWT Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-55040.yaml"
},
"CVE-2026-55087": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"name": "Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55087.yaml"
},
"CVE-2026-55224": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe": "CWE-22",
"name": "MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55224.yaml"
},
"CVE-2026-55229": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-918",
"name": "Gotenberg < 8.34.0 - Local File Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55229.yaml"
},
"CVE-2026-5524": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5524.yaml"
},
"CVE-2026-55450": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H",
"name": "Langflow < 1.9.1 - Unauthenticated File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55450.yaml"
},
"CVE-2026-55549": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cwe": "CWE-79",
"name": "Yamcs <=5.8.6 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55549.yaml"
},
"CVE-2026-55552": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Yamcs <=5.11.12 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55552.yaml"
},
"CVE-2026-55592": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-79",
"name": "Dashy <= 4.3.6 - Reflected XSS via Workspace",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55592.yaml"
},
"CVE-2026-5562": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Provectus kafka-ui <=0.7.2 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5562.yaml"
},
"CVE-2026-56008": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "low",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-56008-fusion_builder-5ca35c9d-a7e0-4442-82d5-5040a3443c2b.yaml"
},
"CVE-2026-5615": {
"cvss": 4.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cwe": "CWE-79",
"name": "VvvebJs <= 2.0.5 - Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5615.yaml"
},
"CVE-2026-56265": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-798",
"name": "Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56265.yaml"
},
"CVE-2026-56270": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-306",
"name": "Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56270.yaml"
},
"CVE-2026-56290": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56290.yaml"
},
"CVE-2026-56291": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56291.yaml"
},
"CVE-2026-56292": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-89",
"name": "AcyMailing < 10.11.1 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56292.yaml"
},
"CVE-2026-56681": {
"cvss": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cwe": "CWE-807",
"name": "9router <=0.5.4 - Authentication Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56681.yaml"
},
"CVE-2026-56782": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Gorse < 0.5.10 - Unauthenticated Database Dump",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56782.yaml"
},
"CVE-2026-5718": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5718.yaml"
},
"CVE-2026-57219": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-522",
"name": "RabbitMQ Management - OAuth 2 Client Secret Disclosure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-57219.yaml"
},
"CVE-2026-57582": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"cwe": "CWE-79",
"name": "GeoNetwork - Reflected Cross-Site Scripting",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-57582.yaml"
},
"CVE-2026-57827": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "RSFiles! for Joomla - Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-57827.yaml"
},
"CVE-2026-58123": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Hermes WebUI < 0.51.788 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58123.yaml"
},
"CVE-2026-58138": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58138.yaml"
},
"CVE-2026-58191": {
"cvss": 6.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"cwe": "CWE-79",
"name": "Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58191.yaml"
},
"CVE-2026-58455": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "Dockwatch <= 0.6.567 - OS Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58455.yaml"
},
"CVE-2026-58467": {
"cvss": 8.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"cwe": "CWE-22",
"name": "Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58467.yaml"
},
"CVE-2026-58644": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58644.yaml"
},
"CVE-2026-59177": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59177.yaml"
},
"CVE-2026-59509": {
"cvss": 9.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"cwe": "CWE-20",
"name": "cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59509.yaml"
},
"CVE-2026-59726": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-78",
"name": "ruflo MCP Bridge - Unauthenticated RCE via terminal_execute",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59726.yaml"
},
"CVE-2026-59774": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59774.yaml"
},
"CVE-2026-59801": {
"name": "9Router - Unauthenticated LLM Provider API Exposure",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59801.yaml"
},
"CVE-2026-60004": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Gitea <= 1.27.0 - Pre-Auth Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml"
},
"CVE-2026-60105": {
"cvss": 8.6,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"name": "Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60105.yaml"
},
"CVE-2026-6118": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "AstrBot <= 4.22.1 - Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6118.yaml"
},
"CVE-2026-61511": {
"cwe": "CWE-94",
"name": "vBulletin 6.x - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61511.yaml"
},
"CVE-2026-61560": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61560.yaml"
},
"CVE-2026-61736": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"cwe": "CWE-942",
"name": "LightRAG <= 1.5.3 - Credentialed CORS Wildcard",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61736.yaml"
},
"CVE-2026-61808": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "LightRAG <= 1.5.4 - Missing Authentication",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61808.yaml"
},
"CVE-2026-6203": {
"cvss": 6.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe": "CWE-601",
"name": "User Registration & Membership WordPress plugin - Open Redirect",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6203.yaml"
},
"CVE-2026-62382": {
"cvss": 6.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"cwe": "CWE-863",
"name": "PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-62382.yaml"
},
"CVE-2026-6279": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": ">",
"severity": "critical",
"url": "https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-6279-fusion_builder-5dc72d78-d47c-4b36-8d69-8672e15ddf8c.yaml"
},
"CVE-2026-63030": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml"
},
"CVE-2026-63077": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63077.yaml"
},
"CVE-2026-6433": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"name": "FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6433.yaml"
},
"CVE-2026-64638": {
"cvss": 8.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe": "CWE-79",
"name": "WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml"
},
"CVE-2026-64849": {
"cvss": 9.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"cwe": "CWE-918",
"name": "MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64849.yaml"
},
"CVE-2026-65442": {
"cvss": 7.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "FormCraft3 <= 3.9.15 - Server-Side Request Forgery",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65442.yaml"
},
"CVE-2026-65694": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65694.yaml"
},
"CVE-2026-65761": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Joomla Easy Store - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65761.yaml"
},
"CVE-2026-65919": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "Meshery <1.0.57 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65919.yaml"
},
"CVE-2026-6639": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-862",
"name": "AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6639.yaml"
},
"CVE-2026-67208": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-67208.yaml"
},
"CVE-2026-6826": {
"cvss": 6.9,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"cwe": "CWE-862",
"name": "Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6826.yaml"
},
"CVE-2026-6854": {
"cwe": "CWE-89",
"name": "My Calendar < 3.7.9 - Unauthenticated SQL Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6854.yaml"
},
"CVE-2026-6875": {
"cvss": 9.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6875.yaml"
},
"CVE-2026-69084": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "SiYuan - SQL Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69084.yaml"
},
"CVE-2026-69085": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-89",
"name": "SiYuan <=3.7.2 - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69085.yaml"
},
"CVE-2026-69251": {
"cvss": 9.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-94",
"name": "Flowise < 3.1.3 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69251.yaml"
},
"CVE-2026-71209": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-287",
"name": "Audiobookshelf - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71209.yaml"
},
"CVE-2026-71362": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cwe": "CWE-863",
"name": "Adobe Commerce/Magento - Customer Session Identity Switch",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml"
},
"CVE-2026-72898": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Metabase - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72898.yaml"
},
"CVE-2026-73034": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-22",
"name": "DB-GPT <= 0.8.1 - Arbitrary File Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-73034.yaml"
},
"CVE-2026-73570": {
"cvss": 8.9,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"cwe": "CWE-78",
"name": "Zimbra Collaboration Suite < 10.1.20 - OS Command Injection",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-73570.yaml"
},
"CVE-2026-7467": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-269",
"name": "Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-7467.yaml"
},
"CVE-2026-76904": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "GeoServer jsonArrayContains CQL Filter - SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-76904.yaml"
},
"CVE-2026-77806": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "SPIP < 4.4.22 - Unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-77806.yaml"
},
"CVE-2026-7798": {
"cvss": 5.4,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cwe": "CWE-918",
"name": "WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-7798.yaml"
},
"CVE-2026-80099": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-80099.yaml"
},
"CVE-2026-8037": {
"name": "Progress ADC LoadMaster - Command Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml"
},
"CVE-2026-8054": {
"name": "dotCMS Core Publish Audit API - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8054.yaml"
},
"CVE-2026-81199": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81199.yaml"
},
"CVE-2026-81578": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81578.yaml"
},
"CVE-2026-8181": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8181.yaml"
},
"CVE-2026-82222": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-502",
"name": "GiveWP <= 4.16.7.1 - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82222.yaml"
},
"CVE-2026-82329": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "JFrog Artifactory Access Blank Join Key Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml"
},
"CVE-2026-8236": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8236.yaml"
},
"CVE-2026-8237": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8237.yaml"
},
"CVE-2026-82456": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82456.yaml"
},
"CVE-2026-83548": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cwe": "CWE-918",
"name": "SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-83548.yaml"
},
"CVE-2026-8383": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "LearnPress < 4.3.7 - Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8383.yaml"
},
"CVE-2026-8385": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-200",
"name": "WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8385.yaml"
},
"CVE-2026-8386": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-862",
"name": "WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8386.yaml"
},
"CVE-2026-84434": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-434",
"name": "WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-84434.yaml"
},
"CVE-2026-8467": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Phoenix Storybook - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-8467.yaml"
},
"CVE-2026-85200": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-98",
"name": "GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85200.yaml"
},
"CVE-2026-85688": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "TEN Framework - Arbitrary File Read & Write",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85688.yaml"
},
"CVE-2026-85706": {
"cvss": 10.0,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cwe": "CWE-22",
"name": "GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85706.yaml"
},
"CVE-2026-86206": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-284",
"name": "N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86206.yaml"
},
"CVE-2026-86207": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-287",
"name": "N-able N-central - Authentication Bypass",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86207.yaml"
},
"CVE-2026-86218": {
"cvss": 10.0,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"cwe": "CWE-96",
"name": "N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86218.yaml"
},
"CVE-2026-86242": {
"cvss": 8.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86242.yaml"
},
"CVE-2026-86426": {
"cvss": 9.2,
"cwe": "CWE-287",
"name": "LibreNMS <= 26.7.0 - Unauthenticated API Access",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86426.yaml"
},
"CVE-2026-8679": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-639",
"name": "WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8679.yaml"
},
"CVE-2026-8713": {
"cvss": 9.1,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe": "CWE-22",
"name": "Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8713.yaml"
},
"CVE-2026-8732": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-862",
"name": "WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8732.yaml"
},
"CVE-2026-87820": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cwe": "CWE-489",
"name": "CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87820.yaml"
},
"CVE-2026-87902": {
"cvss": 9.2,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"cwe": "CWE-98",
"name": "WordPress Core - PHP Template Path Traversal",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml"
},
"CVE-2026-88062": {
"cvss": 9.5,
"name": "OmniRoute < 3.8.49 - Unauthenticated RCE",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-88062.yaml"
},
"CVE-2026-8839": {
"cvss": 5.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cwe": "CWE-639",
"name": "WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR",
"severity": "medium",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8839.yaml"
},
"CVE-2026-8857": {
"cvss": 8.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "MediaWiki EasyTimeline - Code Injection RCE",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8857.yaml"
},
"CVE-2026-89013": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-863",
"name": "Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-89013.yaml"
},
"CVE-2026-89063": {
"cvss": 8.2,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cwe": "CWE-639",
"name": "Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-89063.yaml"
},
"CVE-2026-9082": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9082.yaml"
},
"CVE-2026-9103": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-306",
"name": "Langflow OSS - Superuser Token Issuance",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9103.yaml"
},
"CVE-2026-9133": {
"cvss": 7.7,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe": "CWE-489",
"name": "Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9133.yaml"
},
"CVE-2026-9198": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-94",
"name": "IBM Langflow - Remote Code Execution",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9198.yaml"
},
"CVE-2026-9282": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9282.yaml"
},
"CVE-2026-9290": {
"cvss": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe": "CWE-22",
"name": "WP User Manager \u2013 User Profile Builder & Membership - Local File Inclusion",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9290.yaml"
},
"CVE-2026-9506": {
"cvss": 8.7,
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"cwe": "CWE-22",
"name": "Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read",
"severity": "high",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9506.yaml"
},
"CVE-2026-9586": {
"cvss": 9.8,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe": "CWE-89",
"name": "Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection",
"severity": "critical",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9586.yaml"
}
}