mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
35cb1e6962
A nuclei template is a runnable check for one CVE, which makes it a proof of concept whether or not anyone published a repository for it. Measured against the index: 3,952 CVEs gain a template link and 858 of those had no PoC at all, 584 of the additions falling in 2024 or later. That last figure is the point. ExploitDB carries more CVEs overall and Metasploit is better weaponised, but both skew historical; nuclei is where coverage of a recent CVE actually shows up first. Templates also carry the ratings the entries never had. Severity, CVSS with its vector, EPSS with its percentile and CWE now sit in nuclei.json for the site to read: 4,193 of 4,418 templates state a CVSS score and 4,274 an EPSS score. A result can finally say how bad a flaw is and how likely it is to be used, rather than only that somebody wrote code for it. Templates are kept in their own section and their own field. They are not somebody's repository and should not be ranked, starred or credited as one, but they do lead the PoC list, being the one link that runs as it stands. The index files are also revalidated rather than reused from cache. They are rebuilt hourly and a returning visitor was holding whatever it downloaded first, which cost a stale index here until the copy was thrown away by hand.
42871 lines
1.4 MiB
Plaintext
42871 lines
1.4 MiB
Plaintext
{
|
|
"CVE-2000-0114": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.47595,
|
|
"epss_pct": 0.98758,
|
|
"name": "Microsoft FrontPage Extensions - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2000/CVE-2000-0114.yaml"
|
|
},
|
|
"CVE-2000-0760": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
|
"epss": 0.62496,
|
|
"epss_pct": 0.99125,
|
|
"name": "Jakarta Tomcat 3.1 and 3.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2000/CVE-2000-0760.yaml"
|
|
},
|
|
"CVE-2001-0537": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.6845,
|
|
"epss_pct": 0.99282,
|
|
"name": "Cisco IOS HTTP Configuration - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2001/CVE-2001-0537.yaml"
|
|
},
|
|
"CVE-2001-1473": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-310",
|
|
"epss": 0.06268,
|
|
"epss_pct": 0.93068,
|
|
"name": "Deprecated SSHv1 Protocol Detection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2001/CVE-2001-1473.yaml"
|
|
},
|
|
"CVE-2002-1131": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.25562,
|
|
"epss_pct": 0.97804,
|
|
"name": "SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2002/CVE-2002-1131.yaml"
|
|
},
|
|
"CVE-2004-0437": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
|
"epss": 0.07672,
|
|
"epss_pct": 0.94157,
|
|
"name": "Titan FTP Server 3.01 - DoS via LIST Command Disconnection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-0437.yaml"
|
|
},
|
|
"CVE-2004-0519": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"epss": 0.22528,
|
|
"epss_pct": 0.97538,
|
|
"name": "SquirrelMail 1.4.x - Folder Name Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2004/CVE-2004-0519.yaml"
|
|
},
|
|
"CVE-2004-0656": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
|
"epss": 0.02349,
|
|
"epss_pct": 0.82486,
|
|
"name": "Pure-FTPd \u2264 1.0.18 - DoS via Connection Limit Exhaustion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-0656.yaml"
|
|
},
|
|
"CVE-2004-1602": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.30679,
|
|
"epss_pct": 0.98112,
|
|
"name": "ProFTPD 1.2.x - Username Enumeration via Timing Attack",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-1602.yaml"
|
|
},
|
|
"CVE-2004-1641": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
|
"epss": 0.0824,
|
|
"epss_pct": 0.94488,
|
|
"name": "Titan FTP \u2264 3.21 - Heap Overflow via Long Commands",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-1641.yaml"
|
|
},
|
|
"CVE-2004-1965": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"epss": 0.09001,
|
|
"epss_pct": 0.94893,
|
|
"name": "Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2004/CVE-2004-1965.yaml"
|
|
},
|
|
"CVE-2004-2687": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-16",
|
|
"epss": 0.88195,
|
|
"epss_pct": 0.99755,
|
|
"name": "Distccd v1 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2004/CVE-2004-2687.yaml"
|
|
},
|
|
"CVE-2005-0850": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.0219,
|
|
"epss_pct": 0.81164,
|
|
"name": "FileZilla Server < 0.9.6 - DoS via MS-DOS Device Names",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2005/CVE-2005-0850.yaml"
|
|
},
|
|
"CVE-2005-0851": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
|
"cwe": "CWE-835",
|
|
"epss": 0.0219,
|
|
"epss_pct": 0.81164,
|
|
"name": "FileZilla Server < 0.9.6 - DoS via MODE Z Infinite Loop",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2005/CVE-2005-0851.yaml"
|
|
},
|
|
"CVE-2005-2428": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.73028,
|
|
"epss_pct": 0.99414,
|
|
"name": "Lotus Domino R5 and R6 WebMail - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-2428.yaml"
|
|
},
|
|
"CVE-2005-3128": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.03436,
|
|
"epss_pct": 0.88117,
|
|
"name": "SquirrelMail Address Add 1.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-3128.yaml"
|
|
},
|
|
"CVE-2005-3344": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"epss": 0.07986,
|
|
"epss_pct": 0.94342,
|
|
"name": "Horde Groupware Unauthenticated Admin Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-3344.yaml"
|
|
},
|
|
"CVE-2005-3634": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"epss": 0.17757,
|
|
"epss_pct": 0.96941,
|
|
"name": "SAP Web Application Server 6.x/7.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-3634.yaml"
|
|
},
|
|
"CVE-2005-4385": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"epss": 0.08836,
|
|
"epss_pct": 0.94818,
|
|
"name": "Cofax <=2.0RC3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2005/CVE-2005-4385.yaml"
|
|
},
|
|
"CVE-2006-1681": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"epss": 0.06643,
|
|
"epss_pct": 0.93388,
|
|
"name": "Cherokee HTTPD <=0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-1681.yaml"
|
|
},
|
|
"CVE-2006-2173": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:P",
|
|
"epss": 0.06499,
|
|
"epss_pct": 0.93275,
|
|
"name": "FileZilla FTP Server 2.2.22 - Buffer Overflow",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2006/CVE-2006-2173.yaml"
|
|
},
|
|
"CVE-2006-2842": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.47196,
|
|
"epss_pct": 0.9875,
|
|
"name": "Squirrelmail <=1.4.6 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-2842.yaml"
|
|
},
|
|
"CVE-2006-3392": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.78286,
|
|
"epss_pct": 0.99546,
|
|
"name": "Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-3392.yaml"
|
|
},
|
|
"CVE-2006-6565": {
|
|
"cvss": 4.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P",
|
|
"cwe": "CWE-476",
|
|
"epss": 0.71504,
|
|
"epss_pct": 0.9937,
|
|
"name": "FileZilla Server < 0.9.22 - DoS via Wildcard Commands",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2006/CVE-2006-6565.yaml"
|
|
},
|
|
"CVE-2007-0885": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"epss": 0.05472,
|
|
"epss_pct": 0.92192,
|
|
"name": "Jira Rainbow.Zen - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-0885.yaml"
|
|
},
|
|
"CVE-2007-2449": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.77376,
|
|
"epss_pct": 0.99521,
|
|
"name": "Apache Tomcat 4.x-7.x - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-2449.yaml"
|
|
},
|
|
"CVE-2007-3010": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.97407,
|
|
"epss_pct": 0.99893,
|
|
"name": "Alcatel-Lucent OmniPCX - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-3010.yaml"
|
|
},
|
|
"CVE-2007-4504": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09491,
|
|
"epss_pct": 0.9508,
|
|
"name": "Joomla! RSfiles <=1.0.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-4504.yaml"
|
|
},
|
|
"CVE-2007-4556": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"epss": 0.25749,
|
|
"epss_pct": 0.97816,
|
|
"name": "OpenSymphony XWork/Apache Struts2 - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-4556.yaml"
|
|
},
|
|
"CVE-2007-5728": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.14639,
|
|
"epss_pct": 0.96405,
|
|
"name": "phpPgAdmin <=4.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-5728.yaml"
|
|
},
|
|
"CVE-2008-0702": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.07707,
|
|
"epss_pct": 0.94178,
|
|
"name": "Titan FTP Server 6.03 and 6.0.5.549 - Heap Overflow via Long Commands",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2008/CVE-2008-0702.yaml"
|
|
},
|
|
"CVE-2008-1059": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.48329,
|
|
"epss_pct": 0.98775,
|
|
"name": "WordPress Sniplets 1.1.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1059.yaml"
|
|
},
|
|
"CVE-2008-1061": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.074,
|
|
"epss_pct": 0.93986,
|
|
"name": "WordPress Sniplets <=1.2.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1061.yaml"
|
|
},
|
|
"CVE-2008-1547": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.48137,
|
|
"epss_pct": 0.9877,
|
|
"name": "Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1547.yaml"
|
|
},
|
|
"CVE-2008-2052": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01568,
|
|
"epss_pct": 0.73587,
|
|
"name": "Bitrix Site Manager 6.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-2052.yaml"
|
|
},
|
|
"CVE-2008-2398": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06232,
|
|
"epss_pct": 0.93034,
|
|
"name": "AppServ Open Project <=2.5.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-2398.yaml"
|
|
},
|
|
"CVE-2008-2650": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18809,
|
|
"epss_pct": 0.97074,
|
|
"name": "CMSimple 3.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-2650.yaml"
|
|
},
|
|
"CVE-2008-4668": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.21476,
|
|
"epss_pct": 0.97436,
|
|
"name": "Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-4668.yaml"
|
|
},
|
|
"CVE-2008-4764": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16505,
|
|
"epss_pct": 0.9676,
|
|
"name": "Joomla! <=2.0.0 RC2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-4764.yaml"
|
|
},
|
|
"CVE-2008-5281": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.06401,
|
|
"epss_pct": 0.93179,
|
|
"name": "Titan FTP Server 6.05 DELE Command - Heap Overflow",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2008/CVE-2008-5281.yaml"
|
|
},
|
|
"CVE-2008-5587": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12865,
|
|
"epss_pct": 0.96016,
|
|
"name": "phpPgAdmin <=4.2.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-5587.yaml"
|
|
},
|
|
"CVE-2008-6080": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10637,
|
|
"epss_pct": 0.95467,
|
|
"name": "Joomla! ionFiles 4.4.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6080.yaml"
|
|
},
|
|
"CVE-2008-6172": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12284,
|
|
"epss_pct": 0.95891,
|
|
"name": "Joomla! Component RWCards 3.0.11 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6172.yaml"
|
|
},
|
|
"CVE-2008-6222": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11497,
|
|
"epss_pct": 0.95706,
|
|
"name": "Joomla! ProDesk 1.0/1.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6222.yaml"
|
|
},
|
|
"CVE-2008-6465": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05114,
|
|
"epss_pct": 0.91778,
|
|
"name": "Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6465.yaml"
|
|
},
|
|
"CVE-2008-6668": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15346,
|
|
"epss_pct": 0.96528,
|
|
"name": "nweb2fax <=0.2.7 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6668.yaml"
|
|
},
|
|
"CVE-2008-6982": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05735,
|
|
"epss_pct": 0.92514,
|
|
"name": "Devalcms 1.4a - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-6982.yaml"
|
|
},
|
|
"CVE-2008-7269": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.08391,
|
|
"epss_pct": 0.94573,
|
|
"name": "UC Gateway Investment SiteEngine v5.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2008/CVE-2008-7269.yaml"
|
|
},
|
|
"CVE-2009-0347": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P",
|
|
"cwe": "CWE-59",
|
|
"epss": 0.10932,
|
|
"epss_pct": 0.95559,
|
|
"name": "Autonomy Ultraseek - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-0347.yaml"
|
|
},
|
|
"CVE-2009-0545": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.90386,
|
|
"epss_pct": 0.9979,
|
|
"name": "ZeroShell <= 1.0beta11 Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-0545.yaml"
|
|
},
|
|
"CVE-2009-0884": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P",
|
|
"cwe": "CWE-120",
|
|
"epss": 0.03421,
|
|
"epss_pct": 0.88057,
|
|
"name": "FileZilla Server < 0.9.31 - SSL/TLS Packet Overflow DoS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2009/CVE-2009-0884.yaml"
|
|
},
|
|
"CVE-2009-0932": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.45764,
|
|
"epss_pct": 0.98711,
|
|
"name": "Horde/Horde Groupware - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-0932.yaml"
|
|
},
|
|
"CVE-2009-1151": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.96565,
|
|
"epss_pct": 0.99877,
|
|
"name": "PhpMyAdmin Scripts - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1151.yaml"
|
|
},
|
|
"CVE-2009-1496": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07183,
|
|
"epss_pct": 0.93844,
|
|
"name": "Joomla! Cmimarketplace 0.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1496.yaml"
|
|
},
|
|
"CVE-2009-1558": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.29821,
|
|
"epss_pct": 0.98067,
|
|
"name": "Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1558.yaml"
|
|
},
|
|
"CVE-2009-1872": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.16083,
|
|
"epss_pct": 0.96684,
|
|
"name": "Adobe Coldfusion <=8.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-1872.yaml"
|
|
},
|
|
"CVE-2009-2015": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06507,
|
|
"epss_pct": 0.9328,
|
|
"name": "Joomla! MooFAQ 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-2015.yaml"
|
|
},
|
|
"CVE-2009-2100": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08229,
|
|
"epss_pct": 0.94483,
|
|
"name": "Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-2100.yaml"
|
|
},
|
|
"CVE-2009-3053": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05925,
|
|
"epss_pct": 0.92723,
|
|
"name": "Joomla! Agora 3.0.0b - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-3053.yaml"
|
|
},
|
|
"CVE-2009-3318": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06455,
|
|
"epss_pct": 0.93238,
|
|
"name": "Joomla! Roland Breedveld Album 1.14 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-3318.yaml"
|
|
},
|
|
"CVE-2009-4202": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08109,
|
|
"epss_pct": 0.94416,
|
|
"name": "Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-4202.yaml"
|
|
},
|
|
"CVE-2009-4223": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.54584,
|
|
"epss_pct": 0.98941,
|
|
"name": "KR-Web <=1.1b2 - Remote File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-4223.yaml"
|
|
},
|
|
"CVE-2009-4679": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07866,
|
|
"epss_pct": 0.94272,
|
|
"name": "Joomla! Portfolio Nexus - Remote File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-4679.yaml"
|
|
},
|
|
"CVE-2009-5020": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.03488,
|
|
"epss_pct": 0.88301,
|
|
"name": "AWStats < 6.95 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-5020.yaml"
|
|
},
|
|
"CVE-2009-5114": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13298,
|
|
"epss_pct": 0.96113,
|
|
"name": "WebGlimpse 2.18.7 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2009/CVE-2009-5114.yaml"
|
|
},
|
|
"CVE-2010-0157": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12969,
|
|
"epss_pct": 0.96036,
|
|
"name": "Joomla! Component com_biblestudy - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0157.yaml"
|
|
},
|
|
"CVE-2010-0219": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-255",
|
|
"epss": 0.89871,
|
|
"epss_pct": 0.99781,
|
|
"name": "Apache Axis2 Default Login",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0219.yaml"
|
|
},
|
|
"CVE-2010-0467": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.43296,
|
|
"epss_pct": 0.98631,
|
|
"name": "Joomla! Component CCNewsLetter - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0467.yaml"
|
|
},
|
|
"CVE-2010-0696": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.28222,
|
|
"epss_pct": 0.97975,
|
|
"name": "Joomla! Component Jw_allVideos - Arbitrary File Retrieval",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0696.yaml"
|
|
},
|
|
"CVE-2010-0759": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15242,
|
|
"epss_pct": 0.96513,
|
|
"name": "Joomla! Plugin Core Design Scriptegrator - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0759.yaml"
|
|
},
|
|
"CVE-2010-0942": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0724,
|
|
"epss_pct": 0.93879,
|
|
"name": "Joomla! Component com_jvideodirect - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0942.yaml"
|
|
},
|
|
"CVE-2010-0943": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16358,
|
|
"epss_pct": 0.96733,
|
|
"name": "Joomla! Component com_jashowcase - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0943.yaml"
|
|
},
|
|
"CVE-2010-0944": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14041,
|
|
"epss_pct": 0.96288,
|
|
"name": "Joomla! Component com_jcollection - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0944.yaml"
|
|
},
|
|
"CVE-2010-0972": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13257,
|
|
"epss_pct": 0.96104,
|
|
"name": "Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0972.yaml"
|
|
},
|
|
"CVE-2010-0982": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06238,
|
|
"epss_pct": 0.93039,
|
|
"name": "Joomla! Component com_cartweberp - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0982.yaml"
|
|
},
|
|
"CVE-2010-0985": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13095,
|
|
"epss_pct": 0.96072,
|
|
"name": "Joomla! Component com_abbrev - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0985.yaml"
|
|
},
|
|
"CVE-2010-1056": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11414,
|
|
"epss_pct": 0.95686,
|
|
"name": "Joomla! Component com_rokdownloads - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1056.yaml"
|
|
},
|
|
"CVE-2010-1081": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14597,
|
|
"epss_pct": 0.96396,
|
|
"name": "Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1081.yaml"
|
|
},
|
|
"CVE-2010-1217": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06429,
|
|
"epss_pct": 0.93209,
|
|
"name": "Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1217.yaml"
|
|
},
|
|
"CVE-2010-1219": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08266,
|
|
"epss_pct": 0.94506,
|
|
"name": "Joomla! Component com_janews - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1219.yaml"
|
|
},
|
|
"CVE-2010-1302": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08483,
|
|
"epss_pct": 0.94629,
|
|
"name": "Joomla! Component DW Graph - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1302.yaml"
|
|
},
|
|
"CVE-2010-1304": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14041,
|
|
"epss_pct": 0.96287,
|
|
"name": "Joomla! Component User Status - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1304.yaml"
|
|
},
|
|
"CVE-2010-1305": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20719,
|
|
"epss_pct": 0.97355,
|
|
"name": "Joomla! Component JInventory 1.23.02 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1305.yaml"
|
|
},
|
|
"CVE-2010-1306": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15722,
|
|
"epss_pct": 0.96616,
|
|
"name": "Joomla! Component Picasa 2.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1306.yaml"
|
|
},
|
|
"CVE-2010-1307": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10158,
|
|
"epss_pct": 0.95315,
|
|
"name": "Joomla! Component Magic Updater - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1307.yaml"
|
|
},
|
|
"CVE-2010-1308": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13997,
|
|
"epss_pct": 0.96282,
|
|
"name": "Joomla! Component SVMap 1.1.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1308.yaml"
|
|
},
|
|
"CVE-2010-1312": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13621,
|
|
"epss_pct": 0.96196,
|
|
"name": "Joomla! Component News Portal 1.5.x - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1312.yaml"
|
|
},
|
|
"CVE-2010-1313": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08684,
|
|
"epss_pct": 0.9474,
|
|
"name": "Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1313.yaml"
|
|
},
|
|
"CVE-2010-1314": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15909,
|
|
"epss_pct": 0.96652,
|
|
"name": "Joomla! Component Highslide 1.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1314.yaml"
|
|
},
|
|
"CVE-2010-1315": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08233,
|
|
"epss_pct": 0.94485,
|
|
"name": "Joomla! Component webERPcustomer - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1315.yaml"
|
|
},
|
|
"CVE-2010-1340": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13621,
|
|
"epss_pct": 0.96197,
|
|
"name": "Joomla! Component com_jresearch - 'Controller' Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1340.yaml"
|
|
},
|
|
"CVE-2010-1345": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16872,
|
|
"epss_pct": 0.96823,
|
|
"name": "Joomla! Component Cookex Agency CKForms - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1345.yaml"
|
|
},
|
|
"CVE-2010-1352": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13598,
|
|
"epss_pct": 0.96189,
|
|
"name": "Joomla! Component Juke Box 1.7 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1352.yaml"
|
|
},
|
|
"CVE-2010-1353": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19192,
|
|
"epss_pct": 0.97129,
|
|
"name": "Joomla! Component LoginBox - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1353.yaml"
|
|
},
|
|
"CVE-2010-1354": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15909,
|
|
"epss_pct": 0.96652,
|
|
"name": "Joomla! Component VJDEO 1.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1354.yaml"
|
|
},
|
|
"CVE-2010-1429": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.53728,
|
|
"epss_pct": 0.98921,
|
|
"name": "Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1429.yaml"
|
|
},
|
|
"CVE-2010-1461": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08233,
|
|
"epss_pct": 0.94485,
|
|
"name": "Joomla! Component Photo Battle 1.0.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1461.yaml"
|
|
},
|
|
"CVE-2010-1469": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08163,
|
|
"epss_pct": 0.94448,
|
|
"name": "Joomla! Component JProject Manager 1.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1469.yaml"
|
|
},
|
|
"CVE-2010-1470": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13351,
|
|
"epss_pct": 0.9613,
|
|
"name": "Joomla! Component Web TV 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1470.yaml"
|
|
},
|
|
"CVE-2010-1471": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16152,
|
|
"epss_pct": 0.96696,
|
|
"name": "Joomla! Component Address Book 1.5.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1471.yaml"
|
|
},
|
|
"CVE-2010-1472": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13351,
|
|
"epss_pct": 0.9613,
|
|
"name": "Joomla! Component Horoscope 1.5.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1472.yaml"
|
|
},
|
|
"CVE-2010-1473": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08163,
|
|
"epss_pct": 0.94448,
|
|
"name": "Joomla! Component Advertising 0.25 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1473.yaml"
|
|
},
|
|
"CVE-2010-1474": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09471,
|
|
"epss_pct": 0.95071,
|
|
"name": "Joomla! Component Sweetykeeper 1.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1474.yaml"
|
|
},
|
|
"CVE-2010-1475": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09471,
|
|
"epss_pct": 0.95073,
|
|
"name": "Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1475.yaml"
|
|
},
|
|
"CVE-2010-1476": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0994,
|
|
"epss_pct": 0.95248,
|
|
"name": "Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1476.yaml"
|
|
},
|
|
"CVE-2010-1478": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08163,
|
|
"epss_pct": 0.94448,
|
|
"name": "Joomla! Component Jfeedback 1.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1478.yaml"
|
|
},
|
|
"CVE-2010-1491": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13598,
|
|
"epss_pct": 0.96187,
|
|
"name": "Joomla! Component MMS Blog 2.3.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1491.yaml"
|
|
},
|
|
"CVE-2010-1494": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.167,
|
|
"epss_pct": 0.96799,
|
|
"name": "Joomla! Component AWDwall 1.5.4 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1494.yaml"
|
|
},
|
|
"CVE-2010-1495": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18938,
|
|
"epss_pct": 0.97092,
|
|
"name": "Joomla! Component Matamko 1.01 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1495.yaml"
|
|
},
|
|
"CVE-2010-1531": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16915,
|
|
"epss_pct": 0.9683,
|
|
"name": "Joomla! Component redSHOP 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1531.yaml"
|
|
},
|
|
"CVE-2010-1532": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1633,
|
|
"epss_pct": 0.96729,
|
|
"name": "Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1532.yaml"
|
|
},
|
|
"CVE-2010-1533": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15088,
|
|
"epss_pct": 0.96482,
|
|
"name": "Joomla! Component TweetLA 1.0.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1533.yaml"
|
|
},
|
|
"CVE-2010-1534": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13621,
|
|
"epss_pct": 0.96197,
|
|
"name": "Joomla! Component Shoutbox Pro - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1534.yaml"
|
|
},
|
|
"CVE-2010-1535": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15334,
|
|
"epss_pct": 0.96525,
|
|
"name": "Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1535.yaml"
|
|
},
|
|
"CVE-2010-1540": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08233,
|
|
"epss_pct": 0.94485,
|
|
"name": "Joomla! Component com_blog - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1540.yaml"
|
|
},
|
|
"CVE-2010-1586": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.10296,
|
|
"epss_pct": 0.95357,
|
|
"name": "HP System Management Homepage (SMH) v2.x.x.x - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1586.yaml"
|
|
},
|
|
"CVE-2010-1601": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15974,
|
|
"epss_pct": 0.96662,
|
|
"name": "Joomla! Component JA Comment - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1601.yaml"
|
|
},
|
|
"CVE-2010-1602": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15695,
|
|
"epss_pct": 0.96608,
|
|
"name": "Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1602.yaml"
|
|
},
|
|
"CVE-2010-1603": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07402,
|
|
"epss_pct": 0.93988,
|
|
"name": "Joomla! Component ZiMBCore 0.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1603.yaml"
|
|
},
|
|
"CVE-2010-1607": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08177,
|
|
"epss_pct": 0.94457,
|
|
"name": "Joomla! Component WMI 1.5.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1607.yaml"
|
|
},
|
|
"CVE-2010-1653": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13373,
|
|
"epss_pct": 0.96136,
|
|
"name": "Joomla! Component Graphics 1.0.6 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1653.yaml"
|
|
},
|
|
"CVE-2010-1657": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19192,
|
|
"epss_pct": 0.97129,
|
|
"name": "Joomla! Component SmartSite 1.0.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1657.yaml"
|
|
},
|
|
"CVE-2010-1658": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16014,
|
|
"epss_pct": 0.96672,
|
|
"name": "Joomla! Component NoticeBoard 1.3 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1658.yaml"
|
|
},
|
|
"CVE-2010-1659": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13985,
|
|
"epss_pct": 0.96279,
|
|
"name": "Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1659.yaml"
|
|
},
|
|
"CVE-2010-1714": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18703,
|
|
"epss_pct": 0.97062,
|
|
"name": "Joomla! Component Arcade Games 1.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1714.yaml"
|
|
},
|
|
"CVE-2010-1715": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08177,
|
|
"epss_pct": 0.94457,
|
|
"name": "Joomla! Component Online Exam 1.5.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1715.yaml"
|
|
},
|
|
"CVE-2010-1717": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.22285,
|
|
"epss_pct": 0.97509,
|
|
"name": "Joomla! Component iF surfALERT 1.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1717.yaml"
|
|
},
|
|
"CVE-2010-1718": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09455,
|
|
"epss_pct": 0.95065,
|
|
"name": "Joomla! Component Archery Scores 1.0.6 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1718.yaml"
|
|
},
|
|
"CVE-2010-1719": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09371,
|
|
"epss_pct": 0.95034,
|
|
"name": "Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1719.yaml"
|
|
},
|
|
"CVE-2010-1722": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09471,
|
|
"epss_pct": 0.95073,
|
|
"name": "Joomla! Component Online Market 2.x - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1722.yaml"
|
|
},
|
|
"CVE-2010-1723": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08408,
|
|
"epss_pct": 0.94583,
|
|
"name": "Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1723.yaml"
|
|
},
|
|
"CVE-2010-1858": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13621,
|
|
"epss_pct": 0.96197,
|
|
"name": "Joomla! Component SMEStorage - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1858.yaml"
|
|
},
|
|
"CVE-2010-1870": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.92015,
|
|
"epss_pct": 0.99811,
|
|
"name": "ListSERV Maestro <= 9.0-8 RCE",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1870.yaml"
|
|
},
|
|
"CVE-2010-1875": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15722,
|
|
"epss_pct": 0.96617,
|
|
"name": "Joomla! Component Property - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1875.yaml"
|
|
},
|
|
"CVE-2010-1878": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11429,
|
|
"epss_pct": 0.95691,
|
|
"name": "Joomla! Component OrgChart 1.0.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1878.yaml"
|
|
},
|
|
"CVE-2010-1952": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12991,
|
|
"epss_pct": 0.96042,
|
|
"name": "Joomla! Component BeeHeard 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1952.yaml"
|
|
},
|
|
"CVE-2010-1953": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16152,
|
|
"epss_pct": 0.96694,
|
|
"name": "Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1953.yaml"
|
|
},
|
|
"CVE-2010-1954": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16152,
|
|
"epss_pct": 0.96694,
|
|
"name": "Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1954.yaml"
|
|
},
|
|
"CVE-2010-1955": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17938,
|
|
"epss_pct": 0.96963,
|
|
"name": "Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1955.yaml"
|
|
},
|
|
"CVE-2010-1956": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17003,
|
|
"epss_pct": 0.96843,
|
|
"name": "Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1956.yaml"
|
|
},
|
|
"CVE-2010-1957": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14847,
|
|
"epss_pct": 0.96445,
|
|
"name": "Joomla! Component Love Factory 1.3.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1957.yaml"
|
|
},
|
|
"CVE-2010-1977": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07402,
|
|
"epss_pct": 0.93988,
|
|
"name": "Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1977.yaml"
|
|
},
|
|
"CVE-2010-1979": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1115,
|
|
"epss_pct": 0.95623,
|
|
"name": "Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1979.yaml"
|
|
},
|
|
"CVE-2010-1980": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18835,
|
|
"epss_pct": 0.97078,
|
|
"name": "Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1980.yaml"
|
|
},
|
|
"CVE-2010-1981": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11864,
|
|
"epss_pct": 0.95795,
|
|
"name": "Joomla! Component Fabrik 2.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1981.yaml"
|
|
},
|
|
"CVE-2010-1982": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08286,
|
|
"epss_pct": 0.94516,
|
|
"name": "Joomla! Component JA Voice 2.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1982.yaml"
|
|
},
|
|
"CVE-2010-1983": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18816,
|
|
"epss_pct": 0.97074,
|
|
"name": "Joomla! Component redTWITTER 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1983.yaml"
|
|
},
|
|
"CVE-2010-20103": {
|
|
"name": "ProFTPd-1.3.3c - Backdoor Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2010/CVE-2010-20103.yaml"
|
|
},
|
|
"CVE-2010-2018": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03258,
|
|
"epss_pct": 0.87485,
|
|
"name": "Lokomedia CMS - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2018.yaml"
|
|
},
|
|
"CVE-2010-2033": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15795,
|
|
"epss_pct": 0.96628,
|
|
"name": "Joomla! Percha Categories Tree 0.6 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2033.yaml"
|
|
},
|
|
"CVE-2010-2034": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11077,
|
|
"epss_pct": 0.95605,
|
|
"name": "Joomla! Component Percha Image Attach 1.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2034.yaml"
|
|
},
|
|
"CVE-2010-2035": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15781,
|
|
"epss_pct": 0.96627,
|
|
"name": "Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2035.yaml"
|
|
},
|
|
"CVE-2010-2036": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1321,
|
|
"epss_pct": 0.96095,
|
|
"name": "Joomla! Component Percha Fields Attach 1.0 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2036.yaml"
|
|
},
|
|
"CVE-2010-2037": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11077,
|
|
"epss_pct": 0.95603,
|
|
"name": "Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2037.yaml"
|
|
},
|
|
"CVE-2010-2045": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08931,
|
|
"epss_pct": 0.94862,
|
|
"name": "Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2045.yaml"
|
|
},
|
|
"CVE-2010-2050": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13074,
|
|
"epss_pct": 0.96069,
|
|
"name": "Joomla! Component MS Comment 0.8.0b - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2050.yaml"
|
|
},
|
|
"CVE-2010-2122": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11663,
|
|
"epss_pct": 0.95743,
|
|
"name": "Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2122.yaml"
|
|
},
|
|
"CVE-2010-2128": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15821,
|
|
"epss_pct": 0.96635,
|
|
"name": "Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2128.yaml"
|
|
},
|
|
"CVE-2010-2259": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18051,
|
|
"epss_pct": 0.96979,
|
|
"name": "Joomla! Component com_bfsurvey - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2259.yaml"
|
|
},
|
|
"CVE-2010-2307": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08604,
|
|
"epss_pct": 0.94693,
|
|
"name": "Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2307.yaml"
|
|
},
|
|
"CVE-2010-2507": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09432,
|
|
"epss_pct": 0.95056,
|
|
"name": "Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2507.yaml"
|
|
},
|
|
"CVE-2010-2680": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04848,
|
|
"epss_pct": 0.9139,
|
|
"name": "Joomla! Component jesectionfinder - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2680.yaml"
|
|
},
|
|
"CVE-2010-2682": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14311,
|
|
"epss_pct": 0.96342,
|
|
"name": "Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2682.yaml"
|
|
},
|
|
"CVE-2010-2857": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04848,
|
|
"epss_pct": 0.9139,
|
|
"name": "Joomla! Component Music Manager - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2857.yaml"
|
|
},
|
|
"CVE-2010-2861": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99721,
|
|
"epss_pct": 0.99951,
|
|
"name": "Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2861.yaml"
|
|
},
|
|
"CVE-2010-2918": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.13704,
|
|
"epss_pct": 0.96216,
|
|
"name": "Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2918.yaml"
|
|
},
|
|
"CVE-2010-2920": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05688,
|
|
"epss_pct": 0.92457,
|
|
"name": "Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2920.yaml"
|
|
},
|
|
"CVE-2010-3203": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08523,
|
|
"epss_pct": 0.9465,
|
|
"name": "Joomla! Component PicSell 1.0 - Arbitrary File Retrieval",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-3203.yaml"
|
|
},
|
|
"CVE-2010-3426": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1385,
|
|
"epss_pct": 0.9625,
|
|
"name": "Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-3426.yaml"
|
|
},
|
|
"CVE-2010-3867": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:C",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07563,
|
|
"epss_pct": 0.94084,
|
|
"name": "ProFTPD < 1.3.3c - Directory Traversal via mod_site_misc",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2010/CVE-2010-3867.yaml"
|
|
},
|
|
"CVE-2010-4231": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1633,
|
|
"epss_pct": 0.96728,
|
|
"name": "Camtron CMNC-200 IP Camera - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4231.yaml"
|
|
},
|
|
"CVE-2010-4239": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.1343,
|
|
"epss_pct": 0.96148,
|
|
"name": "Tiki Wiki CMS Groupware 5.2 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4239.yaml"
|
|
},
|
|
"CVE-2010-4282": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19647,
|
|
"epss_pct": 0.97199,
|
|
"name": "Pandora Fms < 3.1.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4282.yaml"
|
|
},
|
|
"CVE-2010-4617": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08571,
|
|
"epss_pct": 0.94676,
|
|
"name": "Joomla! Component JotLoader 2.2.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4617.yaml"
|
|
},
|
|
"CVE-2010-4719": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15786,
|
|
"epss_pct": 0.96628,
|
|
"name": "Joomla! Component JRadio - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4719.yaml"
|
|
},
|
|
"CVE-2010-4769": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07593,
|
|
"epss_pct": 0.94105,
|
|
"name": "Joomla! Component Jimtawl 1.0.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4769.yaml"
|
|
},
|
|
"CVE-2010-4977": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.15251,
|
|
"epss_pct": 0.96515,
|
|
"name": "Joomla! Component Canteen 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4977.yaml"
|
|
},
|
|
"CVE-2010-5028": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09247,
|
|
"epss_pct": 0.94988,
|
|
"name": "Joomla! Component JE Job 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-5028.yaml"
|
|
},
|
|
"CVE-2010-5278": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18633,
|
|
"epss_pct": 0.97053,
|
|
"name": "MODx manager - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-5278.yaml"
|
|
},
|
|
"CVE-2010-5286": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11382,
|
|
"epss_pct": 0.95681,
|
|
"name": "Joomla! Component Jstore - 'Controller' Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-5286.yaml"
|
|
},
|
|
"CVE-2011-0049": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.95388,
|
|
"epss_pct": 0.99862,
|
|
"name": "Majordomo2 - SMTP/HTTP Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-0049.yaml"
|
|
},
|
|
"CVE-2011-0518": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.15833,
|
|
"epss_pct": 0.96635,
|
|
"name": "LotusCMS 3.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-0518.yaml"
|
|
},
|
|
"CVE-2011-0762": {
|
|
"cvss": 4.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P",
|
|
"cwe": "CWE-400",
|
|
"epss": 0.73946,
|
|
"epss_pct": 0.9944,
|
|
"name": "vsftpd < 2.3.3 - DoS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-0762.yaml"
|
|
},
|
|
"CVE-2011-1669": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.22157,
|
|
"epss_pct": 0.97497,
|
|
"name": "WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-1669.yaml"
|
|
},
|
|
"CVE-2011-2523": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.96184,
|
|
"epss_pct": 0.99873,
|
|
"name": "VSFTPD 2.3.4 - Backdoor Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-2523.yaml"
|
|
},
|
|
"CVE-2011-2744": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0896,
|
|
"epss_pct": 0.94878,
|
|
"name": "Chyrp 2.x - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-2744.yaml"
|
|
},
|
|
"CVE-2011-2780": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12991,
|
|
"epss_pct": 0.96043,
|
|
"name": "Chyrp 2.x - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-2780.yaml"
|
|
},
|
|
"CVE-2011-3171": {
|
|
"cvss": 3.6,
|
|
"cvss_vector": "CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.00585,
|
|
"epss_pct": 0.45623,
|
|
"name": "Pure-FTPd \u2264 1.0.22 - Directory Traversal",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-3171.yaml"
|
|
},
|
|
"CVE-2011-3315": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.26393,
|
|
"epss_pct": 0.97858,
|
|
"name": "Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-3315.yaml"
|
|
},
|
|
"CVE-2011-3600": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.1591,
|
|
"epss_pct": 0.96652,
|
|
"name": "Apache OFBiz - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-3600.yaml"
|
|
},
|
|
"CVE-2011-4336": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07652,
|
|
"epss_pct": 0.94144,
|
|
"name": "Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4336.yaml"
|
|
},
|
|
"CVE-2011-4618": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10083,
|
|
"epss_pct": 0.95293,
|
|
"name": "Advanced Text Widget < 2.0.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4618.yaml"
|
|
},
|
|
"CVE-2011-4624": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07062,
|
|
"epss_pct": 0.9374,
|
|
"name": "GRAND FlAGallery 1.57 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4624.yaml"
|
|
},
|
|
"CVE-2011-4640": {
|
|
"cvss": 4.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07323,
|
|
"epss_pct": 0.93937,
|
|
"name": "WebTitan < 3.60 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4640.yaml"
|
|
},
|
|
"CVE-2011-4804": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20981,
|
|
"epss_pct": 0.97388,
|
|
"name": "Joomla! Component com_kp - 'Controller' Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4804.yaml"
|
|
},
|
|
"CVE-2011-4926": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10911,
|
|
"epss_pct": 0.9555,
|
|
"name": "Adminimize 1.7.22 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-4926.yaml"
|
|
},
|
|
"CVE-2011-5106": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10899,
|
|
"epss_pct": 0.95547,
|
|
"name": "WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5106.yaml"
|
|
},
|
|
"CVE-2011-5107": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08772,
|
|
"epss_pct": 0.94787,
|
|
"name": "Alert Before Your Post <= 0.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5107.yaml"
|
|
},
|
|
"CVE-2011-5179": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08772,
|
|
"epss_pct": 0.94787,
|
|
"name": "Skysa App Bar 1.04 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5179.yaml"
|
|
},
|
|
"CVE-2011-5181": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10428,
|
|
"epss_pct": 0.95401,
|
|
"name": "ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5181.yaml"
|
|
},
|
|
"CVE-2011-5252": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.11927,
|
|
"epss_pct": 0.95812,
|
|
"name": "Orchard 'ReturnUrl' Parameter URI - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5252.yaml"
|
|
},
|
|
"CVE-2011-5265": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09964,
|
|
"epss_pct": 0.95255,
|
|
"name": "Featurific For WordPress 1.6.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-5265.yaml"
|
|
},
|
|
"CVE-2012-0392": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"epss": 0.97534,
|
|
"epss_pct": 0.99896,
|
|
"name": "Apache Struts2 S2-008 RCE",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0392.yaml"
|
|
},
|
|
"CVE-2012-0394": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.729,
|
|
"epss_pct": 0.9941,
|
|
"name": "Apache Struts <2.3.1.1 - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0394.yaml"
|
|
},
|
|
"CVE-2012-0896": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.25224,
|
|
"epss_pct": 0.97779,
|
|
"name": "Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0896.yaml"
|
|
},
|
|
"CVE-2012-0901": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07676,
|
|
"epss_pct": 0.94159,
|
|
"name": "YouSayToo auto-publishing 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0901.yaml"
|
|
},
|
|
"CVE-2012-0981": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11059,
|
|
"epss_pct": 0.95598,
|
|
"name": "phpShowtime 2.0 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0981.yaml"
|
|
},
|
|
"CVE-2012-0991": {
|
|
"cvss": 3.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11261,
|
|
"epss_pct": 0.95654,
|
|
"name": "OpenEMR 4.1 - Local File Inclusion",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0991.yaml"
|
|
},
|
|
"CVE-2012-0996": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09794,
|
|
"epss_pct": 0.95194,
|
|
"name": "11in1 CMS 1.2.1 - Local File Inclusion (LFI)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0996.yaml"
|
|
},
|
|
"CVE-2012-10018": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01181,
|
|
"epss_pct": 0.65517,
|
|
"name": "WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-10018.yaml"
|
|
},
|
|
"CVE-2012-1226": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.251,
|
|
"epss_pct": 0.97767,
|
|
"name": "Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1226.yaml"
|
|
},
|
|
"CVE-2012-1823": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99998,
|
|
"epss_pct": 0.9999,
|
|
"name": "PHP CGI v5.3.12/5.4.2 Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1823.yaml"
|
|
},
|
|
"CVE-2012-1835": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08946,
|
|
"epss_pct": 0.94869,
|
|
"name": "WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1835.yaml"
|
|
},
|
|
"CVE-2012-2122": {
|
|
"cvss": 5.1,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.965,
|
|
"epss_pct": 0.99877,
|
|
"name": "MySQL - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2012/CVE-2012-2122.yaml"
|
|
},
|
|
"CVE-2012-2371": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12848,
|
|
"epss_pct": 0.96011,
|
|
"name": "WP-FaceThumb 0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-2371.yaml"
|
|
},
|
|
"CVE-2012-3153": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
|
"epss": 0.9822,
|
|
"epss_pct": 0.99911,
|
|
"name": "Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-3153.yaml"
|
|
},
|
|
"CVE-2012-4032": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.10311,
|
|
"epss_pct": 0.95364,
|
|
"name": "WebsitePanel before v1.2.2.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4032.yaml"
|
|
},
|
|
"CVE-2012-4242": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0928,
|
|
"epss_pct": 0.95001,
|
|
"name": "WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4242.yaml"
|
|
},
|
|
"CVE-2012-4253": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08465,
|
|
"epss_pct": 0.94621,
|
|
"name": "MySQLDumper 1.24.4 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4253.yaml"
|
|
},
|
|
"CVE-2012-4273": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0578,
|
|
"epss_pct": 0.92559,
|
|
"name": "2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4273.yaml"
|
|
},
|
|
"CVE-2012-4547": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05796,
|
|
"epss_pct": 0.92585,
|
|
"name": "AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4547.yaml"
|
|
},
|
|
"CVE-2012-4768": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10456,
|
|
"epss_pct": 0.95411,
|
|
"name": "WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4768.yaml"
|
|
},
|
|
"CVE-2012-4878": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08761,
|
|
"epss_pct": 0.94779,
|
|
"name": "FlatnuX CMS - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4878.yaml"
|
|
},
|
|
"CVE-2012-4889": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07718,
|
|
"epss_pct": 0.94188,
|
|
"name": "ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4889.yaml"
|
|
},
|
|
"CVE-2012-4940": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.83632,
|
|
"epss_pct": 0.99666,
|
|
"name": "Axigen Mail Server Filename Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4940.yaml"
|
|
},
|
|
"CVE-2012-4982": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.08907,
|
|
"epss_pct": 0.94857,
|
|
"name": "Forescout CounterACT 6.3.4.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-4982.yaml"
|
|
},
|
|
"CVE-2012-5321": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.1375,
|
|
"epss_pct": 0.96233,
|
|
"name": "TikiWiki CMS Groupware v8.3 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-5321.yaml"
|
|
},
|
|
"CVE-2012-5913": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08693,
|
|
"epss_pct": 0.94742,
|
|
"name": "WordPress Integrator 1.32 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-5913.yaml"
|
|
},
|
|
"CVE-2012-6499": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.10557,
|
|
"epss_pct": 0.95445,
|
|
"name": "WordPress Plugin Age Verification v0.4 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-6499.yaml"
|
|
},
|
|
"CVE-2013-1965": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.93527,
|
|
"epss_pct": 0.99833,
|
|
"name": "Apache Struts2 S2-012 RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-1965.yaml"
|
|
},
|
|
"CVE-2013-2248": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.94654,
|
|
"epss_pct": 0.99849,
|
|
"name": "Apache Struts - Multiple Open Redirection Vulnerabilities",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2248.yaml"
|
|
},
|
|
"CVE-2013-2251": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99998,
|
|
"epss_pct": 0.9999,
|
|
"name": "Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2251.yaml"
|
|
},
|
|
"CVE-2013-2287": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09239,
|
|
"epss_pct": 0.94984,
|
|
"name": "WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2287.yaml"
|
|
},
|
|
"CVE-2013-2621": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.10692,
|
|
"epss_pct": 0.95484,
|
|
"name": "Telaen => v1.3.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2621.yaml"
|
|
},
|
|
"CVE-2013-3526": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.13939,
|
|
"epss_pct": 0.96269,
|
|
"name": "WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-3526.yaml"
|
|
},
|
|
"CVE-2013-3827": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"epss": 0.32441,
|
|
"epss_pct": 0.98207,
|
|
"name": "Javafaces LFI",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-3827.yaml"
|
|
},
|
|
"CVE-2013-4117": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12974,
|
|
"epss_pct": 0.96039,
|
|
"name": "WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-4117.yaml"
|
|
},
|
|
"CVE-2013-4625": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.11102,
|
|
"epss_pct": 0.95611,
|
|
"name": "WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-4625.yaml"
|
|
},
|
|
"CVE-2013-4982": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.13117,
|
|
"epss_pct": 0.96075,
|
|
"name": "AVTECH DVR - Login Verification Code Bypass",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-4982.yaml"
|
|
},
|
|
"CVE-2013-5528": {
|
|
"cvss": 4.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.23309,
|
|
"epss_pct": 0.9761,
|
|
"name": "Cisco Unified Communications Manager 7/8/9 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-5528.yaml"
|
|
},
|
|
"CVE-2013-5979": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18125,
|
|
"epss_pct": 0.96989,
|
|
"name": "Xibo 1.2.2/1.4.1 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-5979.yaml"
|
|
},
|
|
"CVE-2013-6281": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0522,
|
|
"epss_pct": 0.91922,
|
|
"name": "WordPress Spreadsheet - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-6281.yaml"
|
|
},
|
|
"CVE-2013-7091": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.86311,
|
|
"epss_pct": 0.99719,
|
|
"name": "Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7091.yaml"
|
|
},
|
|
"CVE-2013-7240": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19641,
|
|
"epss_pct": 0.97197,
|
|
"name": "WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7240.yaml"
|
|
},
|
|
"CVE-2013-7285": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.84362,
|
|
"epss_pct": 0.9968,
|
|
"name": "XStream <1.4.6/1.4.10 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7285.yaml"
|
|
},
|
|
"CVE-2014-0160": {
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99997,
|
|
"name": "OpenSSL Heartbleed Vulnerability",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2014/CVE-2014-0160.yaml"
|
|
},
|
|
"CVE-2014-100004": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02016,
|
|
"epss_pct": 0.79525,
|
|
"name": "Sitecore CMS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-100004.yaml"
|
|
},
|
|
"CVE-2014-10037": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18834,
|
|
"epss_pct": 0.97077,
|
|
"name": "DomPHP 0.83 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-10037.yaml"
|
|
},
|
|
"CVE-2014-1203": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.15647,
|
|
"epss_pct": 0.96597,
|
|
"name": "Eyou E-Mail <3.6 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-1203.yaml"
|
|
},
|
|
"CVE-2014-1841": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04851,
|
|
"epss_pct": 0.91394,
|
|
"name": "Titan FTP Server < 10.40 Move Function - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2014/CVE-2014-1841.yaml"
|
|
},
|
|
"CVE-2014-1842": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04787,
|
|
"epss_pct": 0.91298,
|
|
"name": "Titan FTP Server Search Function < 10.40 - User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2014/CVE-2014-1842.yaml"
|
|
},
|
|
"CVE-2014-1843": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04667,
|
|
"epss_pct": 0.91107,
|
|
"name": "Titan FTP Server < 10.40 - User Properties Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2014/CVE-2014-1843.yaml"
|
|
},
|
|
"CVE-2014-2321": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.59259,
|
|
"epss_pct": 0.99049,
|
|
"name": "ZTE Cable Modem Web Shell",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2321.yaml"
|
|
},
|
|
"CVE-2014-2323": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.62752,
|
|
"epss_pct": 0.99132,
|
|
"name": "Lighttpd 1.4.34 SQL Injection and Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2323.yaml"
|
|
},
|
|
"CVE-2014-2383": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.39231,
|
|
"epss_pct": 0.98493,
|
|
"name": "Dompdf < v0.6.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2383.yaml"
|
|
},
|
|
"CVE-2014-2908": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.20862,
|
|
"epss_pct": 0.97374,
|
|
"name": "Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2908.yaml"
|
|
},
|
|
"CVE-2014-2962": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.47095,
|
|
"epss_pct": 0.98748,
|
|
"name": "Belkin N150 Router 1.00.08/1.00.09 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2962.yaml"
|
|
},
|
|
"CVE-2014-3120": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.88559,
|
|
"epss_pct": 0.99762,
|
|
"name": "ElasticSearch v1.1.1/1.2 RCE",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3120.yaml"
|
|
},
|
|
"CVE-2014-3206": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.51014,
|
|
"epss_pct": 0.98846,
|
|
"name": "Seagate BlackArmor NAS - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3206.yaml"
|
|
},
|
|
"CVE-2014-3704": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99974,
|
|
"epss_pct": 0.99977,
|
|
"name": "Drupal SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3704.yaml"
|
|
},
|
|
"CVE-2014-3744": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.34012,
|
|
"epss_pct": 0.98279,
|
|
"name": "Node.js st module Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3744.yaml"
|
|
},
|
|
"CVE-2014-4210": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"epss": 0.38152,
|
|
"epss_pct": 0.9845,
|
|
"name": "Oracle Weblogic - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4210.yaml"
|
|
},
|
|
"CVE-2014-4513": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04573,
|
|
"epss_pct": 0.90952,
|
|
"name": "ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4513.yaml"
|
|
},
|
|
"CVE-2014-4535": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03983,
|
|
"epss_pct": 0.89761,
|
|
"name": "Import Legacy Media <= 0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4535.yaml"
|
|
},
|
|
"CVE-2014-4536": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03902,
|
|
"epss_pct": 0.89525,
|
|
"name": "Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4536.yaml"
|
|
},
|
|
"CVE-2014-4539": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03983,
|
|
"epss_pct": 0.89761,
|
|
"name": "Movies <= 0.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4539.yaml"
|
|
},
|
|
"CVE-2014-4544": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03779,
|
|
"epss_pct": 0.89179,
|
|
"name": "Podcast Channels < 0.28 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4544.yaml"
|
|
},
|
|
"CVE-2014-4550": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03918,
|
|
"epss_pct": 0.89568,
|
|
"name": "Shortcode Ninja <= 1.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4550.yaml"
|
|
},
|
|
"CVE-2014-4558": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0421,
|
|
"epss_pct": 0.9026,
|
|
"name": "WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4558.yaml"
|
|
},
|
|
"CVE-2014-4561": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03826,
|
|
"epss_pct": 0.89325,
|
|
"name": "Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4561.yaml"
|
|
},
|
|
"CVE-2014-4577": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03749,
|
|
"epss_pct": 0.89089,
|
|
"name": "WP AmASIN \u2013 The Amazon Affiliate Shop - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4577.yaml"
|
|
},
|
|
"CVE-2014-4592": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04032,
|
|
"epss_pct": 0.8987,
|
|
"name": "WP Planet <= 0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4592.yaml"
|
|
},
|
|
"CVE-2014-4940": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1927,
|
|
"epss_pct": 0.97141,
|
|
"name": "WordPress Plugin Tera Charts - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4940.yaml"
|
|
},
|
|
"CVE-2014-4941": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04306,
|
|
"epss_pct": 0.90452,
|
|
"name": "Cross RSS 1.7 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4941.yaml"
|
|
},
|
|
"CVE-2014-4942": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.04536,
|
|
"epss_pct": 0.90877,
|
|
"name": "WordPress EasyCart <2.0.6 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4942.yaml"
|
|
},
|
|
"CVE-2014-5111": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.21569,
|
|
"epss_pct": 0.97446,
|
|
"name": "Fonality trixbox - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5111.yaml"
|
|
},
|
|
"CVE-2014-5181": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04259,
|
|
"epss_pct": 0.90362,
|
|
"name": "Last.fm Rotation 1.0 - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5181.yaml"
|
|
},
|
|
"CVE-2014-5187": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04718,
|
|
"epss_pct": 0.91186,
|
|
"name": "Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5187.yaml"
|
|
},
|
|
"CVE-2014-5258": {
|
|
"cvss": 4.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20326,
|
|
"epss_pct": 0.97292,
|
|
"name": "webEdition 6.3.8.0 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5258.yaml"
|
|
},
|
|
"CVE-2014-5368": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18817,
|
|
"epss_pct": 0.97075,
|
|
"name": "WordPress Plugin WP Content Source Control - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-5368.yaml"
|
|
},
|
|
"CVE-2014-6271": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99992,
|
|
"name": "ShellShock - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6271.yaml"
|
|
},
|
|
"CVE-2014-6287": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99323,
|
|
"epss_pct": 0.99936,
|
|
"name": "HTTP File Server <2.3c - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6287.yaml"
|
|
},
|
|
"CVE-2014-6308": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.2226,
|
|
"epss_pct": 0.97507,
|
|
"name": "Osclass Security Advisory 3.4.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6308.yaml"
|
|
},
|
|
"CVE-2014-8676": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.40779,
|
|
"epss_pct": 0.9855,
|
|
"name": "Simple Online Planning Tool <1.3.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8676.yaml"
|
|
},
|
|
"CVE-2014-8682": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.33391,
|
|
"epss_pct": 0.98253,
|
|
"name": "Gogs (Go Git Service) - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8682.yaml"
|
|
},
|
|
"CVE-2014-8739": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.91656,
|
|
"epss_pct": 0.99806,
|
|
"name": "WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8739.yaml"
|
|
},
|
|
"CVE-2014-8799": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.67631,
|
|
"epss_pct": 0.99258,
|
|
"name": "WordPress Plugin DukaPress 2.5.2 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-8799.yaml"
|
|
},
|
|
"CVE-2014-9094": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07309,
|
|
"epss_pct": 0.93928,
|
|
"name": "WordPress DZS-VideoGallery Plugin Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9094.yaml"
|
|
},
|
|
"CVE-2014-9119": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15652,
|
|
"epss_pct": 0.96599,
|
|
"name": "WordPress DB Backup <=4.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9119.yaml"
|
|
},
|
|
"CVE-2014-9180": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04417,
|
|
"epss_pct": 0.90658,
|
|
"name": "Eleanor CMS - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9180.yaml"
|
|
},
|
|
"CVE-2014-9444": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06701,
|
|
"epss_pct": 0.93436,
|
|
"name": "Frontend Uploader <= 0.9.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9444.yaml"
|
|
},
|
|
"CVE-2014-9606": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04121,
|
|
"epss_pct": 0.90066,
|
|
"name": "Netsweeper 4.0.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9606.yaml"
|
|
},
|
|
"CVE-2014-9607": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04749,
|
|
"epss_pct": 0.91238,
|
|
"name": "Netsweeper 4.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9607.yaml"
|
|
},
|
|
"CVE-2014-9608": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04663,
|
|
"epss_pct": 0.91102,
|
|
"name": "Netsweeper 4.0.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9608.yaml"
|
|
},
|
|
"CVE-2014-9609": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12631,
|
|
"epss_pct": 0.95957,
|
|
"name": "Netsweeper 4.0.8 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9609.yaml"
|
|
},
|
|
"CVE-2014-9614": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.68706,
|
|
"epss_pct": 0.99288,
|
|
"name": "Netsweeper 4.0.5 - Default Weak Account",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9614.yaml"
|
|
},
|
|
"CVE-2014-9615": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04121,
|
|
"epss_pct": 0.90067,
|
|
"name": "Netsweeper 4.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9615.yaml"
|
|
},
|
|
"CVE-2014-9617": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.08013,
|
|
"epss_pct": 0.94353,
|
|
"name": "Netsweeper 3.0.6 - Open Redirection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9617.yaml"
|
|
},
|
|
"CVE-2014-9618": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.72696,
|
|
"epss_pct": 0.99404,
|
|
"name": "Netsweeper - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9618.yaml"
|
|
},
|
|
"CVE-2014-9735": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.75701,
|
|
"epss_pct": 0.99483,
|
|
"name": "WordPress RevSlider - Remote Code Execution via File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9735.yaml"
|
|
},
|
|
"CVE-2015-0554": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:C",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.38932,
|
|
"epss_pct": 0.9848,
|
|
"name": "ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-0554.yaml"
|
|
},
|
|
"CVE-2015-1000005": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08598,
|
|
"epss_pct": 0.94689,
|
|
"name": "WordPress Candidate Application Form <= 1.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1000005.yaml"
|
|
},
|
|
"CVE-2015-1000010": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.0685,
|
|
"epss_pct": 0.93564,
|
|
"name": "WordPress Simple Image Manipulator < 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1000010.yaml"
|
|
},
|
|
"CVE-2015-1000012": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.09325,
|
|
"epss_pct": 0.95015,
|
|
"name": "WordPress MyPixs <=0.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1000012.yaml"
|
|
},
|
|
"CVE-2015-10141": {
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.05072,
|
|
"epss_pct": 0.91721,
|
|
"name": "Xdebug <= 2.5.5 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-10141.yaml"
|
|
},
|
|
"CVE-2015-1419": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"epss": 0.06732,
|
|
"epss_pct": 0.93469,
|
|
"name": "vsftpd <= 3.0.2 - Access Restriction Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-1419.yaml"
|
|
},
|
|
"CVE-2015-1427": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.99906,
|
|
"epss_pct": 0.99965,
|
|
"name": "ElasticSearch - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1427.yaml"
|
|
},
|
|
"CVE-2015-1503": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.58302,
|
|
"epss_pct": 0.99027,
|
|
"name": "IceWarp Mail Server <11.1.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1503.yaml"
|
|
},
|
|
"CVE-2015-1579": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.22055,
|
|
"epss_pct": 0.97491,
|
|
"name": "WordPress Slider Revolution - Local File Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1579.yaml"
|
|
},
|
|
"CVE-2015-1635": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99998,
|
|
"name": "Microsoft Windows 'HTTP.sys' - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1635.yaml"
|
|
},
|
|
"CVE-2015-1880": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.14157,
|
|
"epss_pct": 0.96308,
|
|
"name": "Fortinet FortiOS <=5.2.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1880.yaml"
|
|
},
|
|
"CVE-2015-20067": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.07729,
|
|
"epss_pct": 0.94193,
|
|
"name": "WP Attachment Export < 0.2.4 - Unrestricted File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-20067.yaml"
|
|
},
|
|
"CVE-2015-2067": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.39424,
|
|
"epss_pct": 0.98503,
|
|
"name": "Magento Server MAGMI - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2067.yaml"
|
|
},
|
|
"CVE-2015-2068": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.1404,
|
|
"epss_pct": 0.96288,
|
|
"name": "Magento Server Mass Importer - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2068.yaml"
|
|
},
|
|
"CVE-2015-2080": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.74881,
|
|
"epss_pct": 0.99467,
|
|
"name": "Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2080.yaml"
|
|
},
|
|
"CVE-2015-2166": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.26774,
|
|
"epss_pct": 0.97882,
|
|
"name": "Ericsson Drutt MSDP - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2166.yaml"
|
|
},
|
|
"CVE-2015-2196": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11182,
|
|
"epss_pct": 0.95633,
|
|
"name": "WordPress Spider Calendar <=1.4.9 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2196.yaml"
|
|
},
|
|
"CVE-2015-2755": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.03831,
|
|
"epss_pct": 0.8934,
|
|
"name": "WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2755.yaml"
|
|
},
|
|
"CVE-2015-2794": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.74552,
|
|
"epss_pct": 0.99459,
|
|
"name": "DotNetNuke 07.04.00 - Administration Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2794.yaml"
|
|
},
|
|
"CVE-2015-2807": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07328,
|
|
"epss_pct": 0.93941,
|
|
"name": "Navis DocumentCloud <0.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2807.yaml"
|
|
},
|
|
"CVE-2015-2863": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.10317,
|
|
"epss_pct": 0.95366,
|
|
"name": "Kaseya Virtual System Administrator - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2863.yaml"
|
|
},
|
|
"CVE-2015-2996": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:C",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.86643,
|
|
"epss_pct": 0.99725,
|
|
"name": "SysAid Help Desk <15.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2996.yaml"
|
|
},
|
|
"CVE-2015-3035": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.83948,
|
|
"epss_pct": 0.99673,
|
|
"name": "TP-LINK - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3035.yaml"
|
|
},
|
|
"CVE-2015-3224": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.44708,
|
|
"epss_pct": 0.98677,
|
|
"name": "Ruby on Rails Web Console - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3224.yaml"
|
|
},
|
|
"CVE-2015-3306": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.96752,
|
|
"epss_pct": 0.99883,
|
|
"name": "ProFTPd - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-3306.yaml"
|
|
},
|
|
"CVE-2015-3337": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.32927,
|
|
"epss_pct": 0.98234,
|
|
"name": "Elasticsearch - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3337.yaml"
|
|
},
|
|
"CVE-2015-3648": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08083,
|
|
"epss_pct": 0.94391,
|
|
"name": "ResourceSpace - Local File inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3648.yaml"
|
|
},
|
|
"CVE-2015-3897": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17681,
|
|
"epss_pct": 0.96934,
|
|
"name": "Bonita BPM Portal <6.5.3 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3897.yaml"
|
|
},
|
|
"CVE-2015-4050": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.08269,
|
|
"epss_pct": 0.94508,
|
|
"name": "Symfony - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4050.yaml"
|
|
},
|
|
"CVE-2015-4062": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09183,
|
|
"epss_pct": 0.94959,
|
|
"name": "WordPress NewStatPress 0.9.8 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4062.yaml"
|
|
},
|
|
"CVE-2015-4063": {
|
|
"cvss": 3.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:S/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06188,
|
|
"epss_pct": 0.92989,
|
|
"name": "NewStatPress <0.9.9 - Cross-Site Scripting",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4063.yaml"
|
|
},
|
|
"CVE-2015-4074": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.5651,
|
|
"epss_pct": 0.98985,
|
|
"name": "Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4074.yaml"
|
|
},
|
|
"CVE-2015-4127": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07495,
|
|
"epss_pct": 0.94041,
|
|
"name": "WordPress Church Admin <0.810 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4127.yaml"
|
|
},
|
|
"CVE-2015-4414": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18958,
|
|
"epss_pct": 0.97094,
|
|
"name": "WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4414.yaml"
|
|
},
|
|
"CVE-2015-4455": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.40595,
|
|
"epss_pct": 0.98548,
|
|
"name": "WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4455.yaml"
|
|
},
|
|
"CVE-2015-4632": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.51829,
|
|
"epss_pct": 0.98866,
|
|
"name": "Koha 3.20.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4632.yaml"
|
|
},
|
|
"CVE-2015-4666": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16235,
|
|
"epss_pct": 0.96713,
|
|
"name": "Xceedium Xsuite <=2.4.4.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4666.yaml"
|
|
},
|
|
"CVE-2015-4668": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.06719,
|
|
"epss_pct": 0.93448,
|
|
"name": "Xsuite <=2.4.4.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4668.yaml"
|
|
},
|
|
"CVE-2015-4694": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15646,
|
|
"epss_pct": 0.96598,
|
|
"name": "WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4694.yaml"
|
|
},
|
|
"CVE-2015-5354": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.12523,
|
|
"epss_pct": 0.95935,
|
|
"name": "Novius OS 5.0.1-elche - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5354.yaml"
|
|
},
|
|
"CVE-2015-5461": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
|
"epss": 0.06283,
|
|
"epss_pct": 0.93085,
|
|
"name": "WordPress StageShow <5.0.9 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5461.yaml"
|
|
},
|
|
"CVE-2015-5469": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10148,
|
|
"epss_pct": 0.95313,
|
|
"name": "WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5469.yaml"
|
|
},
|
|
"CVE-2015-5471": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.32483,
|
|
"epss_pct": 0.9821,
|
|
"name": "Swim Team <= v1.44.10777 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5471.yaml"
|
|
},
|
|
"CVE-2015-5531": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.94788,
|
|
"epss_pct": 0.99852,
|
|
"name": "ElasticSearch <1.6.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5531.yaml"
|
|
},
|
|
"CVE-2015-5688": {
|
|
"cvss": 5.0,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09385,
|
|
"epss_pct": 0.95038,
|
|
"name": "Geddy <13.0.8 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5688.yaml"
|
|
},
|
|
"CVE-2015-6477": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12042,
|
|
"epss_pct": 0.95837,
|
|
"name": "Nordex NC2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-6477.yaml"
|
|
},
|
|
"CVE-2015-6544": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05375,
|
|
"epss_pct": 0.92087,
|
|
"name": "Combodo iTop <2.2.0-2459 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-6544.yaml"
|
|
},
|
|
"CVE-2015-6920": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0384,
|
|
"epss_pct": 0.89364,
|
|
"name": "WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-6920.yaml"
|
|
},
|
|
"CVE-2015-7245": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.45479,
|
|
"epss_pct": 0.98701,
|
|
"name": "D-Link DVG-N5402SP - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7245.yaml"
|
|
},
|
|
"CVE-2015-7297": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99967,
|
|
"epss_pct": 0.99976,
|
|
"name": "Joomla! Core SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7297.yaml"
|
|
},
|
|
"CVE-2015-7377": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04405,
|
|
"epss_pct": 0.90635,
|
|
"name": "WordPress Pie-Register <2.0.19 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7377.yaml"
|
|
},
|
|
"CVE-2015-7450": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.97655,
|
|
"epss_pct": 0.99898,
|
|
"name": "IBM WebSphere Java Object Deserialization - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7450.yaml"
|
|
},
|
|
"CVE-2015-7501": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.85562,
|
|
"epss_pct": 0.99706,
|
|
"name": "Red Hat JBoss - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7501.yaml"
|
|
},
|
|
"CVE-2015-7780": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10631,
|
|
"epss_pct": 0.95466,
|
|
"name": "ManageEngine Firewall Analyzer <8.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7780.yaml"
|
|
},
|
|
"CVE-2015-7823": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"epss": 0.05143,
|
|
"epss_pct": 0.91815,
|
|
"name": "Kentico CMS 8.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-7823.yaml"
|
|
},
|
|
"CVE-2015-8349": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03263,
|
|
"epss_pct": 0.87504,
|
|
"name": "SourceBans <2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8349.yaml"
|
|
},
|
|
"CVE-2015-8350": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02645,
|
|
"epss_pct": 0.84526,
|
|
"name": "WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8350.yaml"
|
|
},
|
|
"CVE-2015-8399": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.60241,
|
|
"epss_pct": 0.9907,
|
|
"name": "Atlassian Confluence <5.8.17 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8399.yaml"
|
|
},
|
|
"CVE-2015-8562": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"epss": 0.98283,
|
|
"epss_pct": 0.99912,
|
|
"name": "Joomla HTTP Header Unauthenticated - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8562.yaml"
|
|
},
|
|
"CVE-2015-8813": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.11154,
|
|
"epss_pct": 0.95627,
|
|
"name": "Umbraco <7.4.0- Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8813.yaml"
|
|
},
|
|
"CVE-2015-9312": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01805,
|
|
"epss_pct": 0.77002,
|
|
"name": "NewStatPress <=1.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9312.yaml"
|
|
},
|
|
"CVE-2015-9323": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.46125,
|
|
"epss_pct": 0.98721,
|
|
"name": "404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9323.yaml"
|
|
},
|
|
"CVE-2015-9406": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.55008,
|
|
"epss_pct": 0.98953,
|
|
"name": "mTheme Unus < 2.3 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9406.yaml"
|
|
},
|
|
"CVE-2015-9414": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03605,
|
|
"epss_pct": 0.88647,
|
|
"name": "WordPress Symposium <=15.8.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9414.yaml"
|
|
},
|
|
"CVE-2015-9415": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.03399,
|
|
"epss_pct": 0.87992,
|
|
"name": "BJ Lazy Load (Timthumb) <= 0.7.5 - Remote File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9415.yaml"
|
|
},
|
|
"CVE-2015-9480": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12736,
|
|
"epss_pct": 0.95983,
|
|
"name": "WordPress RobotCPA 5 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9480.yaml"
|
|
},
|
|
"CVE-2015-9499": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.16254,
|
|
"epss_pct": 0.96716,
|
|
"name": "WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9499.yaml"
|
|
},
|
|
"CVE-2016-0957": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.51989,
|
|
"epss_pct": 0.9887,
|
|
"name": "Adobe AEM Dispatcher <4.15 - Rules Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-0957.yaml"
|
|
},
|
|
"CVE-2016-1000126": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03718,
|
|
"epss_pct": 0.88994,
|
|
"name": "WordPress Admin Font Editor <=1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000126.yaml"
|
|
},
|
|
"CVE-2016-1000127": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03718,
|
|
"epss_pct": 0.88994,
|
|
"name": "WordPress AJAX Random Post <=2.00 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000127.yaml"
|
|
},
|
|
"CVE-2016-1000128": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04195,
|
|
"epss_pct": 0.90227,
|
|
"name": "WordPress anti-plagiarism <=3.60 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000128.yaml"
|
|
},
|
|
"CVE-2016-1000129": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03236,
|
|
"epss_pct": 0.87391,
|
|
"name": "WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000129.yaml"
|
|
},
|
|
"CVE-2016-1000130": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02897,
|
|
"epss_pct": 0.85955,
|
|
"name": "WordPress e-search <=1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000130.yaml"
|
|
},
|
|
"CVE-2016-1000131": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0465,
|
|
"epss_pct": 0.91081,
|
|
"name": "WordPress e-search <=1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000131.yaml"
|
|
},
|
|
"CVE-2016-1000132": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04426,
|
|
"epss_pct": 0.90673,
|
|
"name": "WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000132.yaml"
|
|
},
|
|
"CVE-2016-1000133": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03415,
|
|
"epss_pct": 0.88044,
|
|
"name": "WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000133.yaml"
|
|
},
|
|
"CVE-2016-1000134": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0465,
|
|
"epss_pct": 0.91081,
|
|
"name": "WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000134.yaml"
|
|
},
|
|
"CVE-2016-1000135": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0465,
|
|
"epss_pct": 0.91081,
|
|
"name": "WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000135.yaml"
|
|
},
|
|
"CVE-2016-1000136": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03415,
|
|
"epss_pct": 0.88044,
|
|
"name": "WordPress heat-trackr 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000136.yaml"
|
|
},
|
|
"CVE-2016-1000137": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04448,
|
|
"epss_pct": 0.90723,
|
|
"name": "WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000137.yaml"
|
|
},
|
|
"CVE-2016-1000138": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03432,
|
|
"epss_pct": 0.88104,
|
|
"name": "WordPress Admin Font Editor <=1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000138.yaml"
|
|
},
|
|
"CVE-2016-1000139": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04195,
|
|
"epss_pct": 0.90226,
|
|
"name": "WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000139.yaml"
|
|
},
|
|
"CVE-2016-1000140": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03432,
|
|
"epss_pct": 0.88104,
|
|
"name": "WordPress New Year Firework <=1.1.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000140.yaml"
|
|
},
|
|
"CVE-2016-1000141": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03462,
|
|
"epss_pct": 0.88209,
|
|
"name": "WordPress Page Layout builder v1.9.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000141.yaml"
|
|
},
|
|
"CVE-2016-1000142": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04448,
|
|
"epss_pct": 0.90723,
|
|
"name": "WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000142.yaml"
|
|
},
|
|
"CVE-2016-1000143": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03558,
|
|
"epss_pct": 0.885,
|
|
"name": "WordPress Photoxhibit 2.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000143.yaml"
|
|
},
|
|
"CVE-2016-1000146": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03462,
|
|
"epss_pct": 0.88209,
|
|
"name": "WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000146.yaml"
|
|
},
|
|
"CVE-2016-1000148": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03209,
|
|
"epss_pct": 0.87275,
|
|
"name": "WordPress S3 Video <=0.983 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000148.yaml"
|
|
},
|
|
"CVE-2016-1000149": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03977,
|
|
"epss_pct": 0.89747,
|
|
"name": "WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000149.yaml"
|
|
},
|
|
"CVE-2016-1000152": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04173,
|
|
"epss_pct": 0.9018,
|
|
"name": "WordPress Tidio-form <=1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000152.yaml"
|
|
},
|
|
"CVE-2016-1000153": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04486,
|
|
"epss_pct": 0.90787,
|
|
"name": "WordPress Tidio Gallery <=1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000153.yaml"
|
|
},
|
|
"CVE-2016-1000154": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03432,
|
|
"epss_pct": 0.88104,
|
|
"name": "WordPress WHIZZ <=1.0.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000154.yaml"
|
|
},
|
|
"CVE-2016-1000155": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04486,
|
|
"epss_pct": 0.90787,
|
|
"name": "WordPress WPSOLR <=8.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1000155.yaml"
|
|
},
|
|
"CVE-2016-10033": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-88",
|
|
"epss": 0.99714,
|
|
"epss_pct": 0.9995,
|
|
"name": "WordPress PHPMailer < 5.2.18 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml"
|
|
},
|
|
"CVE-2016-10108": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.98071,
|
|
"epss_pct": 0.99908,
|
|
"name": "Western Digital MyCloud NAS - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10108.yaml"
|
|
},
|
|
"CVE-2016-10134": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.83406,
|
|
"epss_pct": 0.99659,
|
|
"name": "Zabbix - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10134.yaml"
|
|
},
|
|
"CVE-2016-10367": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16109,
|
|
"epss_pct": 0.96687,
|
|
"name": "Opsview Monitor Pro - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10367.yaml"
|
|
},
|
|
"CVE-2016-10368": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02178,
|
|
"epss_pct": 0.8107,
|
|
"name": "Opsview Monitor Pro - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10368.yaml"
|
|
},
|
|
"CVE-2016-10924": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11662,
|
|
"epss_pct": 0.95743,
|
|
"name": "Wordpress Zedna eBook download <1.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10924.yaml"
|
|
},
|
|
"CVE-2016-10940": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05596,
|
|
"epss_pct": 0.92351,
|
|
"name": "WordPress zm-gallery plugin 1.0 SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10940.yaml"
|
|
},
|
|
"CVE-2016-10956": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.10582,
|
|
"epss_pct": 0.95451,
|
|
"name": "WordPress Mail Masta 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10956.yaml"
|
|
},
|
|
"CVE-2016-10960": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.08976,
|
|
"epss_pct": 0.94882,
|
|
"name": "WordPress wSecure Lite < 2.4 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10960.yaml"
|
|
},
|
|
"CVE-2016-10972": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.09268,
|
|
"epss_pct": 0.94994,
|
|
"name": "Newspaper Theme 6.4\u20136.7.1 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10972.yaml"
|
|
},
|
|
"CVE-2016-10973": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01703,
|
|
"epss_pct": 0.75607,
|
|
"name": "Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10973.yaml"
|
|
},
|
|
"CVE-2016-10976": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01506,
|
|
"epss_pct": 0.72558,
|
|
"name": "Safe Editor Plugin < 1.2 - CSS/JS-injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10976.yaml"
|
|
},
|
|
"CVE-2016-10993": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02796,
|
|
"epss_pct": 0.85439,
|
|
"name": "ScoreMe Theme - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10993.yaml"
|
|
},
|
|
"CVE-2016-15041": {
|
|
"name": "MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15041.yaml"
|
|
},
|
|
"CVE-2016-15042": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.05719,
|
|
"epss_pct": 0.92492,
|
|
"name": "WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15042.yaml"
|
|
},
|
|
"CVE-2016-15043": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.10032,
|
|
"epss_pct": 0.95274,
|
|
"name": "WP Mobile Detector <= 3.5 - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15043.yaml"
|
|
},
|
|
"CVE-2016-1555": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.98325,
|
|
"epss_pct": 0.99913,
|
|
"name": "NETGEAR WNAP320 Access Point Firmware - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1555.yaml"
|
|
},
|
|
"CVE-2016-2004": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.94251,
|
|
"epss_pct": 0.99842,
|
|
"name": "HP Data Protector - Arbitrary Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2016/CVE-2016-2004.yaml"
|
|
},
|
|
"CVE-2016-2389": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.4145,
|
|
"epss_pct": 0.98573,
|
|
"name": "SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-2389.yaml"
|
|
},
|
|
"CVE-2016-3081": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.93352,
|
|
"epss_pct": 0.99831,
|
|
"name": "Apache S2-032 Struts - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3081.yaml"
|
|
},
|
|
"CVE-2016-3088": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.98518,
|
|
"epss_pct": 0.99918,
|
|
"name": "Apache ActiveMQ Fileserver - Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3088.yaml"
|
|
},
|
|
"CVE-2016-3510": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.91402,
|
|
"epss_pct": 0.99804,
|
|
"name": "Oracle WebLogic Server Java Object Deserialization - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2016/CVE-2016-3510.yaml"
|
|
},
|
|
"CVE-2016-3978": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05937,
|
|
"epss_pct": 0.92736,
|
|
"name": "Fortinet FortiOS - Open Redirect/Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3978.yaml"
|
|
},
|
|
"CVE-2016-4437": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.93039,
|
|
"epss_pct": 0.99825,
|
|
"name": "Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4437.yaml"
|
|
},
|
|
"CVE-2016-4975": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-93",
|
|
"epss": 0.19798,
|
|
"epss_pct": 0.97218,
|
|
"name": "Apache mod_userdir CRLF injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4975.yaml"
|
|
},
|
|
"CVE-2016-4977": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-19",
|
|
"epss": 0.79176,
|
|
"epss_pct": 0.99568,
|
|
"name": "Spring Security OAuth2 Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4977.yaml"
|
|
},
|
|
"CVE-2016-5649": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.24427,
|
|
"epss_pct": 0.97708,
|
|
"name": "NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-5649.yaml"
|
|
},
|
|
"CVE-2016-5674": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.9461,
|
|
"epss_pct": 0.99848,
|
|
"name": "NUUO NVR camera `debugging_center_utils_.php` - Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-5674.yaml"
|
|
},
|
|
"CVE-2016-6195": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.68493,
|
|
"epss_pct": 0.99283,
|
|
"name": "vBulletin <= 4.2.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6195.yaml"
|
|
},
|
|
"CVE-2016-6277": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.99803,
|
|
"epss_pct": 0.99956,
|
|
"name": "NETGEAR Routers - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6277.yaml"
|
|
},
|
|
"CVE-2016-6601": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97415,
|
|
"epss_pct": 0.99894,
|
|
"name": "ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6601.yaml"
|
|
},
|
|
"CVE-2016-7552": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.93249,
|
|
"epss_pct": 0.99828,
|
|
"name": "Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-7552.yaml"
|
|
},
|
|
"CVE-2016-7834": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03869,
|
|
"epss_pct": 0.89444,
|
|
"name": "Sony IPELA Engine IP Camera - Hardcoded Account",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-7834.yaml"
|
|
},
|
|
"CVE-2016-7981": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08216,
|
|
"epss_pct": 0.94477,
|
|
"name": "SPIP <3.1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-7981.yaml"
|
|
},
|
|
"CVE-2016-8527": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.13164,
|
|
"epss_pct": 0.96084,
|
|
"name": "Aruba Airwave <8.2.3.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-8527.yaml"
|
|
},
|
|
"CVE-2016-8706": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-190",
|
|
"epss": 0.45703,
|
|
"epss_pct": 0.98708,
|
|
"name": "Memcached Server SASL Authentication - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2016/CVE-2016-8706.yaml"
|
|
},
|
|
"CVE-2016-8735": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.90338,
|
|
"epss_pct": 0.99789,
|
|
"name": "Apache Tomcat - Remote Code Execution via JMX Ports",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2016/CVE-2016-8735.yaml"
|
|
},
|
|
"CVE-2016-9299": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-90",
|
|
"epss": 0.9765,
|
|
"epss_pct": 0.99898,
|
|
"name": "Jenkins CLI - HTTP Java Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2016/CVE-2016-9299.yaml"
|
|
},
|
|
"CVE-2017-0929": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.12543,
|
|
"epss_pct": 0.9594,
|
|
"name": "DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-0929.yaml"
|
|
},
|
|
"CVE-2017-1000028": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99479,
|
|
"epss_pct": 0.99941,
|
|
"name": "Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000028.yaml"
|
|
},
|
|
"CVE-2017-1000029": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.08348,
|
|
"epss_pct": 0.94548,
|
|
"name": "Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000029.yaml"
|
|
},
|
|
"CVE-2017-1000163": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02377,
|
|
"epss_pct": 0.82684,
|
|
"name": "Phoenix Framework - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000163.yaml"
|
|
},
|
|
"CVE-2017-1000170": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.59063,
|
|
"epss_pct": 0.99044,
|
|
"name": "WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000170.yaml"
|
|
},
|
|
"CVE-2017-1000353": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99679,
|
|
"epss_pct": 0.99948,
|
|
"name": "Jenkins CLI - Java Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2017/CVE-2017-1000353.yaml"
|
|
},
|
|
"CVE-2017-1000486": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-326",
|
|
"epss": 0.94104,
|
|
"epss_pct": 0.9984,
|
|
"name": "Primetek Primefaces 5.x - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-1000486.yaml"
|
|
},
|
|
"CVE-2017-10075": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
|
|
"epss": 0.17558,
|
|
"epss_pct": 0.96916,
|
|
"name": "Oracle Content Server - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10075.yaml"
|
|
},
|
|
"CVE-2017-10271": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.99993,
|
|
"epss_pct": 0.99987,
|
|
"name": "Oracle WebLogic Server - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10271.yaml"
|
|
},
|
|
"CVE-2017-10974": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.81159,
|
|
"epss_pct": 0.99606,
|
|
"name": "Yaws 1.91 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10974.yaml"
|
|
},
|
|
"CVE-2017-11107": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02069,
|
|
"epss_pct": 0.80074,
|
|
"name": "phpLDAPadmin <= 1.2.3 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11107.yaml"
|
|
},
|
|
"CVE-2017-11165": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.6413,
|
|
"epss_pct": 0.99166,
|
|
"name": "DataTaker DT80 dEX 1.50.012 - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11165.yaml"
|
|
},
|
|
"CVE-2017-11444": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13098,
|
|
"epss_pct": 0.96074,
|
|
"name": "Subrion CMS <4.1.5.10 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11444.yaml"
|
|
},
|
|
"CVE-2017-11512": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.79604,
|
|
"epss_pct": 0.99575,
|
|
"name": "ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11512.yaml"
|
|
},
|
|
"CVE-2017-11586": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02286,
|
|
"epss_pct": 0.81969,
|
|
"name": "FineCMS <5.0.9 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11586.yaml"
|
|
},
|
|
"CVE-2017-11610": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-276",
|
|
"epss": 0.87378,
|
|
"epss_pct": 0.99742,
|
|
"name": "XML-RPC Server - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11610.yaml"
|
|
},
|
|
"CVE-2017-11629": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01937,
|
|
"epss_pct": 0.78652,
|
|
"name": "FineCMS <=5.0.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11629.yaml"
|
|
},
|
|
"CVE-2017-12138": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03406,
|
|
"epss_pct": 0.88018,
|
|
"name": "XOOPS Core 2.5.8 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12138.yaml"
|
|
},
|
|
"CVE-2017-12149": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.90713,
|
|
"epss_pct": 0.99795,
|
|
"name": "Jboss Application Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12149.yaml"
|
|
},
|
|
"CVE-2017-12542": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99294,
|
|
"epss_pct": 0.99936,
|
|
"name": "HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12542.yaml"
|
|
},
|
|
"CVE-2017-12544": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04515,
|
|
"epss_pct": 0.90837,
|
|
"name": "HPE System Management - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12544.yaml"
|
|
},
|
|
"CVE-2017-12583": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03253,
|
|
"epss_pct": 0.87462,
|
|
"name": "DokuWiki - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12583.yaml"
|
|
},
|
|
"CVE-2017-12611": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.87123,
|
|
"epss_pct": 0.99735,
|
|
"name": "Apache Struts2 S2-053 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12611.yaml"
|
|
},
|
|
"CVE-2017-12615": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.99607,
|
|
"epss_pct": 0.99946,
|
|
"name": "Apache Tomcat Servers - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12615.yaml"
|
|
},
|
|
"CVE-2017-12617": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.99988,
|
|
"epss_pct": 0.99984,
|
|
"name": "Apache Tomcat - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12617.yaml"
|
|
},
|
|
"CVE-2017-12629": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.91896,
|
|
"epss_pct": 0.9981,
|
|
"name": "Apache Solr <= 7.1 - XML Entity Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12629.yaml"
|
|
},
|
|
"CVE-2017-12635": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.99838,
|
|
"epss_pct": 0.9996,
|
|
"name": "Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12635.yaml"
|
|
},
|
|
"CVE-2017-12637": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.95111,
|
|
"epss_pct": 0.99857,
|
|
"name": "SAP NetWeaver Application Server Java 7.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12637.yaml"
|
|
},
|
|
"CVE-2017-12794": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.23566,
|
|
"epss_pct": 0.97633,
|
|
"name": "Django Debug Page - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12794.yaml"
|
|
},
|
|
"CVE-2017-14135": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.21842,
|
|
"epss_pct": 0.97469,
|
|
"name": "OpenDreambox 2.0.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14135.yaml"
|
|
},
|
|
"CVE-2017-14186": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03718,
|
|
"epss_pct": 0.88996,
|
|
"name": "FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14186.yaml"
|
|
},
|
|
"CVE-2017-14524": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0294,
|
|
"epss_pct": 0.86146,
|
|
"name": "OpenText Documentum Administrator 7.2.0180.0055 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14524.yaml"
|
|
},
|
|
"CVE-2017-14535": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.50069,
|
|
"epss_pct": 0.98819,
|
|
"name": "Trixbox - 2.8.0.4 OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14535.yaml"
|
|
},
|
|
"CVE-2017-14537": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.39278,
|
|
"epss_pct": 0.98495,
|
|
"name": "Trixbox 2.8.0 - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14537.yaml"
|
|
},
|
|
"CVE-2017-14622": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02892,
|
|
"epss_pct": 0.85929,
|
|
"name": "WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14622.yaml"
|
|
},
|
|
"CVE-2017-14651": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03836,
|
|
"epss_pct": 0.89355,
|
|
"name": "WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14651.yaml"
|
|
},
|
|
"CVE-2017-14725": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02187,
|
|
"epss_pct": 0.81145,
|
|
"name": "WordPress < 4.8.2 - Authenticated Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14725.yaml"
|
|
},
|
|
"CVE-2017-14849": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.54389,
|
|
"epss_pct": 0.98936,
|
|
"name": "Node.js <8.6.0 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14849.yaml"
|
|
},
|
|
"CVE-2017-14942": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.60857,
|
|
"epss_pct": 0.99088,
|
|
"name": "Intelbras WRN 150 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14942.yaml"
|
|
},
|
|
"CVE-2017-15287": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06147,
|
|
"epss_pct": 0.9295,
|
|
"name": "Dreambox WebControl 2.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15287.yaml"
|
|
},
|
|
"CVE-2017-15363": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15333,
|
|
"epss_pct": 0.96526,
|
|
"name": "Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15363.yaml"
|
|
},
|
|
"CVE-2017-15647": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.26619,
|
|
"epss_pct": 0.9787,
|
|
"name": "FiberHome Routers - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15647.yaml"
|
|
},
|
|
"CVE-2017-15715": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.8572,
|
|
"epss_pct": 0.99709,
|
|
"name": "Apache httpd <=2.4.29 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15715.yaml"
|
|
},
|
|
"CVE-2017-15944": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.98303,
|
|
"epss_pct": 0.99912,
|
|
"name": "Palo Alto Network PAN-OS - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15944.yaml"
|
|
},
|
|
"CVE-2017-16806": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.91496,
|
|
"epss_pct": 0.99805,
|
|
"name": "Ulterius Server < 1.9.5.0 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16806.yaml"
|
|
},
|
|
"CVE-2017-16877": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14104,
|
|
"epss_pct": 0.96296,
|
|
"name": "Nextjs <2.4.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16877.yaml"
|
|
},
|
|
"CVE-2017-16894": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.8703,
|
|
"epss_pct": 0.99733,
|
|
"name": "Laravel <5.5.21 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16894.yaml"
|
|
},
|
|
"CVE-2017-17043": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05096,
|
|
"epss_pct": 0.91758,
|
|
"name": "WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17043.yaml"
|
|
},
|
|
"CVE-2017-17059": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03419,
|
|
"epss_pct": 0.88054,
|
|
"name": "WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17059.yaml"
|
|
},
|
|
"CVE-2017-17092": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03473,
|
|
"epss_pct": 0.88247,
|
|
"name": "WordPress < 4.9.1 - Authenticated JavaScript File Upload",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17092.yaml"
|
|
},
|
|
"CVE-2017-17451": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05088,
|
|
"epss_pct": 0.91748,
|
|
"name": "WordPress Mailster <=1.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17451.yaml"
|
|
},
|
|
"CVE-2017-17562": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.96327,
|
|
"epss_pct": 0.99876,
|
|
"name": "Embedthis GoAhead <3.6.5 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17562.yaml"
|
|
},
|
|
"CVE-2017-17731": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13194,
|
|
"epss_pct": 0.96091,
|
|
"name": "DedeCMS 5.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17731.yaml"
|
|
},
|
|
"CVE-2017-17736": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.68956,
|
|
"epss_pct": 0.99297,
|
|
"name": "Kentico - Installer Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17736.yaml"
|
|
},
|
|
"CVE-2017-17762": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.04648,
|
|
"epss_pct": 0.91079,
|
|
"name": "Episerver 7 - Blind XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17762.yaml"
|
|
},
|
|
"CVE-2017-18024": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04531,
|
|
"epss_pct": 0.90869,
|
|
"name": "AvantFAX 3.3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18024.yaml"
|
|
},
|
|
"CVE-2017-18349": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.3897,
|
|
"epss_pct": 0.98482,
|
|
"name": "Fastjson Insecure Deserialization - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18349.yaml"
|
|
},
|
|
"CVE-2017-18362": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.8682,
|
|
"epss_pct": 0.9973,
|
|
"name": "Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18362.yaml"
|
|
},
|
|
"CVE-2017-18487": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01458,
|
|
"epss_pct": 0.7166,
|
|
"name": "AdPush < 1.44 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18487.yaml"
|
|
},
|
|
"CVE-2017-18490": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01458,
|
|
"epss_pct": 0.71661,
|
|
"name": "Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18490.yaml"
|
|
},
|
|
"CVE-2017-18491": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01458,
|
|
"epss_pct": 0.7166,
|
|
"name": "Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18491.yaml"
|
|
},
|
|
"CVE-2017-18492": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01458,
|
|
"epss_pct": 0.7166,
|
|
"name": "Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18492.yaml"
|
|
},
|
|
"CVE-2017-18493": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.014,
|
|
"epss_pct": 0.70579,
|
|
"name": "Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18493.yaml"
|
|
},
|
|
"CVE-2017-18494": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.014,
|
|
"epss_pct": 0.70579,
|
|
"name": "Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18494.yaml"
|
|
},
|
|
"CVE-2017-18496": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.014,
|
|
"epss_pct": 0.70579,
|
|
"name": "Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18496.yaml"
|
|
},
|
|
"CVE-2017-18500": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0141,
|
|
"epss_pct": 0.7077,
|
|
"name": "Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18500.yaml"
|
|
},
|
|
"CVE-2017-18501": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0141,
|
|
"epss_pct": 0.70769,
|
|
"name": "Social Login by BestWebSoft < 0.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18501.yaml"
|
|
},
|
|
"CVE-2017-18502": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01652,
|
|
"epss_pct": 0.74852,
|
|
"name": "Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18502.yaml"
|
|
},
|
|
"CVE-2017-18505": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01652,
|
|
"epss_pct": 0.74852,
|
|
"name": "BestWebSoft's Twitter < 2.55 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18505.yaml"
|
|
},
|
|
"CVE-2017-18516": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01688,
|
|
"epss_pct": 0.7541,
|
|
"name": "LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18516.yaml"
|
|
},
|
|
"CVE-2017-18517": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01621,
|
|
"epss_pct": 0.74379,
|
|
"name": "Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18517.yaml"
|
|
},
|
|
"CVE-2017-18518": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01621,
|
|
"epss_pct": 0.74379,
|
|
"name": "SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18518.yaml"
|
|
},
|
|
"CVE-2017-18527": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01688,
|
|
"epss_pct": 0.75409,
|
|
"name": "Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18527.yaml"
|
|
},
|
|
"CVE-2017-18528": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01757,
|
|
"epss_pct": 0.76367,
|
|
"name": "PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18528.yaml"
|
|
},
|
|
"CVE-2017-18529": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01621,
|
|
"epss_pct": 0.7438,
|
|
"name": "PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18529.yaml"
|
|
},
|
|
"CVE-2017-18530": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01384,
|
|
"epss_pct": 0.70258,
|
|
"name": "Rating by BestWebSoft < 0.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18530.yaml"
|
|
},
|
|
"CVE-2017-18532": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01441,
|
|
"epss_pct": 0.71343,
|
|
"name": "Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18532.yaml"
|
|
},
|
|
"CVE-2017-18536": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0203,
|
|
"epss_pct": 0.79669,
|
|
"name": "WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18536.yaml"
|
|
},
|
|
"CVE-2017-18537": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01621,
|
|
"epss_pct": 0.7438,
|
|
"name": "Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18537.yaml"
|
|
},
|
|
"CVE-2017-18542": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01388,
|
|
"epss_pct": 0.70332,
|
|
"name": "Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18542.yaml"
|
|
},
|
|
"CVE-2017-18556": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01384,
|
|
"epss_pct": 0.70259,
|
|
"name": "Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18556.yaml"
|
|
},
|
|
"CVE-2017-18557": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01384,
|
|
"epss_pct": 0.70259,
|
|
"name": "Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18557.yaml"
|
|
},
|
|
"CVE-2017-18558": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01384,
|
|
"epss_pct": 0.70259,
|
|
"name": "Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18558.yaml"
|
|
},
|
|
"CVE-2017-18562": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01384,
|
|
"epss_pct": 0.7026,
|
|
"name": "Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18562.yaml"
|
|
},
|
|
"CVE-2017-18564": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0139,
|
|
"epss_pct": 0.70396,
|
|
"name": "Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18564.yaml"
|
|
},
|
|
"CVE-2017-18565": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0139,
|
|
"epss_pct": 0.70397,
|
|
"name": "Updater by BestWebSoft < 1.35 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18565.yaml"
|
|
},
|
|
"CVE-2017-18566": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0139,
|
|
"epss_pct": 0.70396,
|
|
"name": "User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18566.yaml"
|
|
},
|
|
"CVE-2017-18580": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.12092,
|
|
"epss_pct": 0.95847,
|
|
"name": "WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18580.yaml"
|
|
},
|
|
"CVE-2017-18590": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01404,
|
|
"epss_pct": 0.70665,
|
|
"name": "Timesheet Plugin < 0.1.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18590.yaml"
|
|
},
|
|
"CVE-2017-18598": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01933,
|
|
"epss_pct": 0.78597,
|
|
"name": "WordPress Qards - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18598.yaml"
|
|
},
|
|
"CVE-2017-18638": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.15301,
|
|
"epss_pct": 0.96522,
|
|
"name": "Graphite <=1.1.5 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18638.yaml"
|
|
},
|
|
"CVE-2017-20192": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01026,
|
|
"epss_pct": 0.6117,
|
|
"name": "Formidable Forms < 2.05.02 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-20192.yaml"
|
|
},
|
|
"CVE-2017-20194": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01128,
|
|
"epss_pct": 0.64055,
|
|
"name": "Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-20194.yaml"
|
|
},
|
|
"CVE-2017-3131": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07681,
|
|
"epss_pct": 0.94162,
|
|
"name": "FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3131.yaml"
|
|
},
|
|
"CVE-2017-3132": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08112,
|
|
"epss_pct": 0.94418,
|
|
"name": "Fortinet FortiOS < 5.6.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3132.yaml"
|
|
},
|
|
"CVE-2017-3133": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10677,
|
|
"epss_pct": 0.95481,
|
|
"name": "Fortinet FortiOS < 5.6.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3133.yaml"
|
|
},
|
|
"CVE-2017-3506": {
|
|
"cvss": 7.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"epss": 0.96281,
|
|
"epss_pct": 0.99875,
|
|
"name": "Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3506.yaml"
|
|
},
|
|
"CVE-2017-3528": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.14622,
|
|
"epss_pct": 0.96401,
|
|
"name": "Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3528.yaml"
|
|
},
|
|
"CVE-2017-3881": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.98975,
|
|
"epss_pct": 0.99928,
|
|
"name": "Cisco IOS 12.2(55)SE11 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2017/CVE-2017-3881.yaml"
|
|
},
|
|
"CVE-2017-4011": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03271,
|
|
"epss_pct": 0.87529,
|
|
"name": "McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-4011.yaml"
|
|
},
|
|
"CVE-2017-5521": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.89353,
|
|
"epss_pct": 0.99771,
|
|
"name": "NETGEAR Routers - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5521.yaml"
|
|
},
|
|
"CVE-2017-5631": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04487,
|
|
"epss_pct": 0.9079,
|
|
"name": "KMCIS CaseAware - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5631.yaml"
|
|
},
|
|
"CVE-2017-5638": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99994,
|
|
"name": "Apache Struts 2 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5638.yaml"
|
|
},
|
|
"CVE-2017-5645": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.89792,
|
|
"epss_pct": 0.99779,
|
|
"name": "Apache Log4j Server - Deserialization Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2017/CVE-2017-5645.yaml"
|
|
},
|
|
"CVE-2017-5689": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.92189,
|
|
"epss_pct": 0.99814,
|
|
"name": "Intel Active Management - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5689.yaml"
|
|
},
|
|
"CVE-2017-5868": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-93",
|
|
"epss": 0.04622,
|
|
"epss_pct": 0.91036,
|
|
"name": "OpenVPN Access Server 2.1.4 - CRLF Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5868.yaml"
|
|
},
|
|
"CVE-2017-5871": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02676,
|
|
"epss_pct": 0.84735,
|
|
"name": "Odoo <= 8.0-20160726 & 9.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5871.yaml"
|
|
},
|
|
"CVE-2017-5982": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.7763,
|
|
"epss_pct": 0.99527,
|
|
"name": "Kodi 17.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5982.yaml"
|
|
},
|
|
"CVE-2017-5983": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.16373,
|
|
"epss_pct": 0.96735,
|
|
"name": "JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5983.yaml"
|
|
},
|
|
"CVE-2017-6090": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.96234,
|
|
"epss_pct": 0.99873,
|
|
"name": "PhpColl 2.5.1 Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-6090.yaml"
|
|
},
|
|
"CVE-2017-6478": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02574,
|
|
"epss_pct": 0.84074,
|
|
"name": "MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-6478.yaml"
|
|
},
|
|
"CVE-2017-7269": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.99823,
|
|
"epss_pct": 0.99958,
|
|
"name": "Windows Server 2003 & IIS 6.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7269.yaml"
|
|
},
|
|
"CVE-2017-7391": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08242,
|
|
"epss_pct": 0.94489,
|
|
"name": "Magmi 0.7.22 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7391.yaml"
|
|
},
|
|
"CVE-2017-7504": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.41019,
|
|
"epss_pct": 0.98558,
|
|
"name": "JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7504.yaml"
|
|
},
|
|
"CVE-2017-7615": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-640",
|
|
"epss": 0.90856,
|
|
"epss_pct": 0.99797,
|
|
"name": "MantisBT <=2.30 - Arbitrary Password Reset/Admin Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7615.yaml"
|
|
},
|
|
"CVE-2017-7855": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0201,
|
|
"epss_pct": 0.79479,
|
|
"name": "IceWarp WebMail 11.3.1.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7855.yaml"
|
|
},
|
|
"CVE-2017-7921": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99998,
|
|
"epss_pct": 0.9999,
|
|
"name": "Hikvision - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7921.yaml"
|
|
},
|
|
"CVE-2017-7925": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.51418,
|
|
"epss_pct": 0.98857,
|
|
"name": "Dahua Security - Configuration File Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7925.yaml"
|
|
},
|
|
"CVE-2017-8046": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.7453,
|
|
"epss_pct": 0.99458,
|
|
"name": "Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8046.yaml"
|
|
},
|
|
"CVE-2017-8225": {
|
|
"cvss": 9.8,
|
|
"cwe": "CWE-200",
|
|
"epss": 0.35359,
|
|
"epss_pct": 0.98331,
|
|
"name": "GoAhead Camera - Credential Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8225.yaml"
|
|
},
|
|
"CVE-2017-8229": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-255",
|
|
"epss": 0.73959,
|
|
"epss_pct": 0.99441,
|
|
"name": "Amcrest IP Camera Web Management - Data Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8229.yaml"
|
|
},
|
|
"CVE-2017-8917": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99826,
|
|
"epss_pct": 0.99958,
|
|
"name": "Joomla! <3.7.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8917.yaml"
|
|
},
|
|
"CVE-2017-9140": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09724,
|
|
"epss_pct": 0.95165,
|
|
"name": "Reflected XSS - Telerik Reporting Module",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9140.yaml"
|
|
},
|
|
"CVE-2017-9288": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04018,
|
|
"epss_pct": 0.8984,
|
|
"name": "WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9288.yaml"
|
|
},
|
|
"CVE-2017-9416": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05651,
|
|
"epss_pct": 0.92422,
|
|
"name": "Odoo 8.0/9.0/10.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9416.yaml"
|
|
},
|
|
"CVE-2017-9506": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.71601,
|
|
"epss_pct": 0.99372,
|
|
"name": "Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9506.yaml"
|
|
},
|
|
"CVE-2017-9791": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.98908,
|
|
"epss_pct": 0.99924,
|
|
"name": "Apache Struts2 S2-053 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9791.yaml"
|
|
},
|
|
"CVE-2017-9805": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99396,
|
|
"epss_pct": 0.99938,
|
|
"name": "Apache Struts2 S2-052 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9805.yaml"
|
|
},
|
|
"CVE-2017-9822": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.94789,
|
|
"epss_pct": 0.99852,
|
|
"name": "DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9822.yaml"
|
|
},
|
|
"CVE-2017-9833": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.68464,
|
|
"epss_pct": 0.99282,
|
|
"name": "BOA Web Server 0.94.14 - Arbitrary File Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9833.yaml"
|
|
},
|
|
"CVE-2017-9841": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99994,
|
|
"name": "PHPUnit - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml"
|
|
},
|
|
"CVE-2017-9965": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04612,
|
|
"epss_pct": 0.91019,
|
|
"name": "Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9965.yaml"
|
|
},
|
|
"CVE-2018-0127": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.77484,
|
|
"epss_pct": 0.99524,
|
|
"name": "Cisco RV132W/RV134W Router - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0127.yaml"
|
|
},
|
|
"CVE-2018-0171": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.9949,
|
|
"epss_pct": 0.99941,
|
|
"name": "Cisco Smart Install - Configuration Download",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-0171.yaml"
|
|
},
|
|
"CVE-2018-0296": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.99913,
|
|
"epss_pct": 0.99966,
|
|
"name": "Cisco ASA - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0296.yaml"
|
|
},
|
|
"CVE-2018-1000129": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.24674,
|
|
"epss_pct": 0.97729,
|
|
"name": "Jolokia 1.3.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000129.yaml"
|
|
},
|
|
"CVE-2018-1000130": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.72696,
|
|
"epss_pct": 0.99404,
|
|
"name": "Jolokia Agent - JNDI Code Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000130.yaml"
|
|
},
|
|
"CVE-2018-1000226": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.12484,
|
|
"epss_pct": 0.9593,
|
|
"name": "Cobbler - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000226.yaml"
|
|
},
|
|
"CVE-2018-1000533": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.72967,
|
|
"epss_pct": 0.99412,
|
|
"name": "GitList < 0.6.0 Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000533.yaml"
|
|
},
|
|
"CVE-2018-1000600": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.90894,
|
|
"epss_pct": 0.99797,
|
|
"name": "Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000600.yaml"
|
|
},
|
|
"CVE-2018-1000671": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03982,
|
|
"epss_pct": 0.89759,
|
|
"name": "Sympa version =>6.2.16 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000671.yaml"
|
|
},
|
|
"CVE-2018-1000856": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01424,
|
|
"epss_pct": 0.71036,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000856.yaml"
|
|
},
|
|
"CVE-2018-1000861": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.98326,
|
|
"epss_pct": 0.99913,
|
|
"name": "Jenkins - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000861.yaml"
|
|
},
|
|
"CVE-2018-10088": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.39715,
|
|
"epss_pct": 0.98516,
|
|
"name": "XiongMai uc-httpd 1.0.0 - Buffer Overflow",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10088.yaml"
|
|
},
|
|
"CVE-2018-10093": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.6819,
|
|
"epss_pct": 0.99274,
|
|
"name": "AudioCodes 420HD - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10093.yaml"
|
|
},
|
|
"CVE-2018-10095": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.86988,
|
|
"epss_pct": 0.99732,
|
|
"name": "Dolibarr <7.0.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10095.yaml"
|
|
},
|
|
"CVE-2018-10141": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03883,
|
|
"epss_pct": 0.8948,
|
|
"name": "Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10141.yaml"
|
|
},
|
|
"CVE-2018-10201": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.44417,
|
|
"epss_pct": 0.98668,
|
|
"name": "Ncomputing vSPace Pro 10 and 11 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10201.yaml"
|
|
},
|
|
"CVE-2018-10230": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02663,
|
|
"epss_pct": 0.84644,
|
|
"name": "Zend Server <9.13 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10230.yaml"
|
|
},
|
|
"CVE-2018-10245": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"name": "AWStats <= 7.5 - Full Path Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10245.yaml"
|
|
},
|
|
"CVE-2018-10383": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01912,
|
|
"epss_pct": 0.78348,
|
|
"name": "Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10383.yaml"
|
|
},
|
|
"CVE-2018-10562": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99952,
|
|
"epss_pct": 0.99973,
|
|
"name": "Dasan GPON Devices - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10562.yaml"
|
|
},
|
|
"CVE-2018-10735": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.42556,
|
|
"epss_pct": 0.98608,
|
|
"name": "NagiosXI <= 5.4.12 `commandline.php` SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10735.yaml"
|
|
},
|
|
"CVE-2018-10736": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.42556,
|
|
"epss_pct": 0.98609,
|
|
"name": "NagiosXI <= 5.4.12 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10736.yaml"
|
|
},
|
|
"CVE-2018-10737": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.42556,
|
|
"epss_pct": 0.98609,
|
|
"name": "NagiosXI <= 5.4.12 logbook.php SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10737.yaml"
|
|
},
|
|
"CVE-2018-10738": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.42556,
|
|
"epss_pct": 0.98608,
|
|
"name": "NagiosXI <= 5.4.12 menuaccess.php - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10738.yaml"
|
|
},
|
|
"CVE-2018-10822": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.39268,
|
|
"epss_pct": 0.98495,
|
|
"name": "D-Link Routers - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10822.yaml"
|
|
},
|
|
"CVE-2018-10823": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.77699,
|
|
"epss_pct": 0.9953,
|
|
"name": "D-Link Routers - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10823.yaml"
|
|
},
|
|
"CVE-2018-10942": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.12744,
|
|
"epss_pct": 0.95984,
|
|
"name": "Prestashop AttributeWizardPro Module - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10942.yaml"
|
|
},
|
|
"CVE-2018-10956": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.54967,
|
|
"epss_pct": 0.98951,
|
|
"name": "IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10956.yaml"
|
|
},
|
|
"CVE-2018-11133": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08743,
|
|
"epss_pct": 0.94771,
|
|
"name": "Quest KACE SMA /common/run_cross_report.php 'fmt' XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11133.yaml"
|
|
},
|
|
"CVE-2018-11138": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.92061,
|
|
"epss_pct": 0.99812,
|
|
"name": "Quest KACE System Management Appliance 8.0.318 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11138.yaml"
|
|
},
|
|
"CVE-2018-11222": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.06534,
|
|
"epss_pct": 0.93305,
|
|
"name": "Pandora FMS <=7.0NG.722 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11222.yaml"
|
|
},
|
|
"CVE-2018-11227": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04733,
|
|
"epss_pct": 0.91209,
|
|
"name": "Monstra CMS <=3.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11227.yaml"
|
|
},
|
|
"CVE-2018-11231": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09054,
|
|
"epss_pct": 0.9491,
|
|
"name": "Opencart Divido - Sql Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11231.yaml"
|
|
},
|
|
"CVE-2018-11409": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.98314,
|
|
"epss_pct": 0.99913,
|
|
"name": "Splunk <=7.0.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11409.yaml"
|
|
},
|
|
"CVE-2018-11473": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02273,
|
|
"epss_pct": 0.81855,
|
|
"name": "Monstra CMS 3.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11473.yaml"
|
|
},
|
|
"CVE-2018-11511": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11176,
|
|
"epss_pct": 0.95632,
|
|
"name": "ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11511.yaml"
|
|
},
|
|
"CVE-2018-11686": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.52542,
|
|
"epss_pct": 0.98882,
|
|
"name": "FlexPaper/FlowPaper 2.3.6 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11686.yaml"
|
|
},
|
|
"CVE-2018-11709": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.036,
|
|
"epss_pct": 0.88634,
|
|
"name": "WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11709.yaml"
|
|
},
|
|
"CVE-2018-11759": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.90647,
|
|
"epss_pct": 0.99794,
|
|
"name": "Apache Tomcat JK Connect <=1.2.44 - Manager Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11759.yaml"
|
|
},
|
|
"CVE-2018-11776": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99991,
|
|
"epss_pct": 0.99985,
|
|
"name": "Apache Struts2 S2-057 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11776.yaml"
|
|
},
|
|
"CVE-2018-11784": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.94494,
|
|
"epss_pct": 0.99846,
|
|
"name": "Apache Tomcat - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11784.yaml"
|
|
},
|
|
"CVE-2018-12031": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17313,
|
|
"epss_pct": 0.96884,
|
|
"name": "Eaton Intelligent Power Manager 1.6 - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12031.yaml"
|
|
},
|
|
"CVE-2018-12054": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.38988,
|
|
"epss_pct": 0.98482,
|
|
"name": "Schools Alert Management Script - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12054.yaml"
|
|
},
|
|
"CVE-2018-1207": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.90333,
|
|
"epss_pct": 0.99789,
|
|
"name": "Dell iDRAC7/8 Devices - Remote Code Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1207.yaml"
|
|
},
|
|
"CVE-2018-12095": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05634,
|
|
"epss_pct": 0.92404,
|
|
"name": "OEcms 3.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12095.yaml"
|
|
},
|
|
"CVE-2018-1217": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.45957,
|
|
"epss_pct": 0.98716,
|
|
"name": "Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1217.yaml"
|
|
},
|
|
"CVE-2018-12296": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.10905,
|
|
"epss_pct": 0.9555,
|
|
"name": "Seagate NAS OS 4.3.15.1 - Server Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12296.yaml"
|
|
},
|
|
"CVE-2018-12300": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03127,
|
|
"epss_pct": 0.86938,
|
|
"name": "Seagate NAS OS 4.3.15.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12300.yaml"
|
|
},
|
|
"CVE-2018-12455": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.05867,
|
|
"epss_pct": 0.92675,
|
|
"name": "Intelbras NPLUG 1.0.0.14 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12455.yaml"
|
|
},
|
|
"CVE-2018-12613": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.9835,
|
|
"epss_pct": 0.99914,
|
|
"name": "PhpMyAdmin <4.8.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12613.yaml"
|
|
},
|
|
"CVE-2018-12634": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.56401,
|
|
"epss_pct": 0.98983,
|
|
"name": "CirCarLife Scada <4.3 - System Log Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12634.yaml"
|
|
},
|
|
"CVE-2018-12675": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0315,
|
|
"epss_pct": 0.8703,
|
|
"name": "SV3C HD Camera L Series - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12675.yaml"
|
|
},
|
|
"CVE-2018-1271": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.34505,
|
|
"epss_pct": 0.98298,
|
|
"name": "Spring MVC Framework - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1271.yaml"
|
|
},
|
|
"CVE-2018-1273": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.97002,
|
|
"epss_pct": 0.99886,
|
|
"name": "Spring Data Commons - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml"
|
|
},
|
|
"CVE-2018-12909": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16118,
|
|
"epss_pct": 0.9669,
|
|
"name": "Webgrind <= 1.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12909.yaml"
|
|
},
|
|
"CVE-2018-12998": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.99293,
|
|
"epss_pct": 0.99936,
|
|
"name": "Zoho manageengine - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12998.yaml"
|
|
},
|
|
"CVE-2018-13317": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00991,
|
|
"epss_pct": 0.60093,
|
|
"name": "TOTOLINK A3002RU 1.0.8 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13317.yaml"
|
|
},
|
|
"CVE-2018-1335": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.93972,
|
|
"epss_pct": 0.99838,
|
|
"name": "Apache Tika < 1.1.8 - Header Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1335.yaml"
|
|
},
|
|
"CVE-2018-13379": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99994,
|
|
"name": "Fortinet FortiOS - Credentials Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13379.yaml"
|
|
},
|
|
"CVE-2018-13380": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.62474,
|
|
"epss_pct": 0.99123,
|
|
"name": "Fortinet FortiOS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13380.yaml"
|
|
},
|
|
"CVE-2018-13980": {
|
|
"cvss": 5.5,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06902,
|
|
"epss_pct": 0.93604,
|
|
"name": "Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13980.yaml"
|
|
},
|
|
"CVE-2018-14013": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07436,
|
|
"epss_pct": 0.94006,
|
|
"name": "Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14013.yaml"
|
|
},
|
|
"CVE-2018-14064": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.3757,
|
|
"epss_pct": 0.98426,
|
|
"name": "VelotiSmart Wifi - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14064.yaml"
|
|
},
|
|
"CVE-2018-14474": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02257,
|
|
"epss_pct": 0.81733,
|
|
"name": "Orange Forum 1.4.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14474.yaml"
|
|
},
|
|
"CVE-2018-14574": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.2549,
|
|
"epss_pct": 0.97799,
|
|
"name": "Django - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14574.yaml"
|
|
},
|
|
"CVE-2018-14728": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.76511,
|
|
"epss_pct": 0.99502,
|
|
"name": "Responsive filemanager 9.13.1 Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14728.yaml"
|
|
},
|
|
"CVE-2018-14912": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.9288,
|
|
"epss_pct": 0.99823,
|
|
"name": "cgit < 1.2.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14912.yaml"
|
|
},
|
|
"CVE-2018-14916": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.17195,
|
|
"epss_pct": 0.96869,
|
|
"name": "Loytec LGATE-902 <6.4.2 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14916.yaml"
|
|
},
|
|
"CVE-2018-14918": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17982,
|
|
"epss_pct": 0.96973,
|
|
"name": "LOYTEC LGATE-902 6.3.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14918.yaml"
|
|
},
|
|
"CVE-2018-14931": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02398,
|
|
"epss_pct": 0.82841,
|
|
"name": "Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14931.yaml"
|
|
},
|
|
"CVE-2018-14933": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.94884,
|
|
"epss_pct": 0.99853,
|
|
"name": "NUUO NVRmini - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14933.yaml"
|
|
},
|
|
"CVE-2018-15138": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12851,
|
|
"epss_pct": 0.96011,
|
|
"name": "LG-Ericsson iPECS NMS 30M - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15138.yaml"
|
|
},
|
|
"CVE-2018-15517": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.44101,
|
|
"epss_pct": 0.98659,
|
|
"name": "D-Link Central WifiManager - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15517.yaml"
|
|
},
|
|
"CVE-2018-15535": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.45242,
|
|
"epss_pct": 0.98695,
|
|
"name": "Responsive FileManager <9.13.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15535.yaml"
|
|
},
|
|
"CVE-2018-15745": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97709,
|
|
"epss_pct": 0.999,
|
|
"name": "Argus Surveillance DVR 4.0.0.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15745.yaml"
|
|
},
|
|
"CVE-2018-15811": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-326",
|
|
"epss": 0.74048,
|
|
"epss_pct": 0.99444,
|
|
"name": "DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15811.yaml"
|
|
},
|
|
"CVE-2018-15917": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06483,
|
|
"epss_pct": 0.93261,
|
|
"name": "Jorani Leave Management System 0.6.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15917.yaml"
|
|
},
|
|
"CVE-2018-15961": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.9995,
|
|
"epss_pct": 0.99972,
|
|
"name": "Adobe ColdFusion - Unrestricted File Upload Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15961.yaml"
|
|
},
|
|
"CVE-2018-16059": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.29816,
|
|
"epss_pct": 0.98067,
|
|
"name": "WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16059.yaml"
|
|
},
|
|
"CVE-2018-16133": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.39279,
|
|
"epss_pct": 0.98495,
|
|
"name": "Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16133.yaml"
|
|
},
|
|
"CVE-2018-16139": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02285,
|
|
"epss_pct": 0.8195,
|
|
"name": "BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16139.yaml"
|
|
},
|
|
"CVE-2018-16159": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.49918,
|
|
"epss_pct": 0.98814,
|
|
"name": "WordPress Gift Voucher <4.1.8 - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16159.yaml"
|
|
},
|
|
"CVE-2018-16167": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.74745,
|
|
"epss_pct": 0.99465,
|
|
"name": "LogonTracer <=1.2.0 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16167.yaml"
|
|
},
|
|
"CVE-2018-16283": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.6307,
|
|
"epss_pct": 0.99139,
|
|
"name": "WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16283.yaml"
|
|
},
|
|
"CVE-2018-16288": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.35828,
|
|
"epss_pct": 0.98351,
|
|
"name": "LG SuperSign EZ CMS 2.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16288.yaml"
|
|
},
|
|
"CVE-2018-16299": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.44358,
|
|
"epss_pct": 0.98667,
|
|
"name": "WordPress Localize My Post 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16299.yaml"
|
|
},
|
|
"CVE-2018-16363": {
|
|
"name": "WordPress File Manager < 3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16363.yaml"
|
|
},
|
|
"CVE-2018-16668": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.09512,
|
|
"epss_pct": 0.95089,
|
|
"name": "CirCarLife <4.3 - Improper Authentication",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16668.yaml"
|
|
},
|
|
"CVE-2018-16670": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.24568,
|
|
"epss_pct": 0.97719,
|
|
"name": "CirCarLife <4.3 - Improper Authentication",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16670.yaml"
|
|
},
|
|
"CVE-2018-16671": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.08851,
|
|
"epss_pct": 0.94828,
|
|
"name": "CirCarLife <4.3 - Improper Authentication",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16671.yaml"
|
|
},
|
|
"CVE-2018-16716": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0857,
|
|
"epss_pct": 0.94676,
|
|
"name": "NCBI ToolBox - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16716.yaml"
|
|
},
|
|
"CVE-2018-16761": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02201,
|
|
"epss_pct": 0.81283,
|
|
"name": "Eventum <3.4.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16761.yaml"
|
|
},
|
|
"CVE-2018-16763": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.82937,
|
|
"epss_pct": 0.99649,
|
|
"name": "FUEL CMS 1.4.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16763.yaml"
|
|
},
|
|
"CVE-2018-16836": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.61437,
|
|
"epss_pct": 0.99101,
|
|
"name": "Rubedo CMS <=3.4.0 - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16836.yaml"
|
|
},
|
|
"CVE-2018-16979": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-113",
|
|
"epss": 0.0302,
|
|
"epss_pct": 0.86498,
|
|
"name": "Monstra CMS 3.0.4 - HTTP Header Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16979.yaml"
|
|
},
|
|
"CVE-2018-17082": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04103,
|
|
"epss_pct": 0.90031,
|
|
"name": "Apache2 - Transfer-Encoding Chunked XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17082.yaml"
|
|
},
|
|
"CVE-2018-17153": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.86586,
|
|
"epss_pct": 0.99724,
|
|
"name": "Western Digital MyCloud NAS - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17153.yaml"
|
|
},
|
|
"CVE-2018-17173": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.56237,
|
|
"epss_pct": 0.98977,
|
|
"name": "LG Supersign EZ CMS - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17173.yaml"
|
|
},
|
|
"CVE-2018-17207": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.60086,
|
|
"epss_pct": 0.99067,
|
|
"name": "WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17207.yaml"
|
|
},
|
|
"CVE-2018-17246": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.82251,
|
|
"epss_pct": 0.99633,
|
|
"name": "Kibana - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17246.yaml"
|
|
},
|
|
"CVE-2018-17254": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.82976,
|
|
"epss_pct": 0.9965,
|
|
"name": "Joomla! JCK Editor SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17254.yaml"
|
|
},
|
|
"CVE-2018-17283": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.66347,
|
|
"epss_pct": 0.99222,
|
|
"name": "Zoho ManageEngine OpManager - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17283.yaml"
|
|
},
|
|
"CVE-2018-17422": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03717,
|
|
"epss_pct": 0.88992,
|
|
"name": "DotCMS < 5.0.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17422.yaml"
|
|
},
|
|
"CVE-2018-17431": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.83912,
|
|
"epss_pct": 0.99672,
|
|
"name": "Comodo Unified Threat Management Web Console - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17431.yaml"
|
|
},
|
|
"CVE-2018-18069": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.13207,
|
|
"epss_pct": 0.96094,
|
|
"name": "WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18069.yaml"
|
|
},
|
|
"CVE-2018-18264": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.70372,
|
|
"epss_pct": 0.99336,
|
|
"name": "Kubernetes Dashboard <1.10.1 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18264.yaml"
|
|
},
|
|
"CVE-2018-18323": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.70736,
|
|
"epss_pct": 0.99348,
|
|
"name": "Centos Web Panel 0.9.8.480 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18323.yaml"
|
|
},
|
|
"CVE-2018-18325": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-326",
|
|
"epss": 0.74048,
|
|
"epss_pct": 0.99445,
|
|
"name": "DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18325.yaml"
|
|
},
|
|
"CVE-2018-18570": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02465,
|
|
"epss_pct": 0.83334,
|
|
"name": "Planon <Live Build 41 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18570.yaml"
|
|
},
|
|
"CVE-2018-18608": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02754,
|
|
"epss_pct": 0.85191,
|
|
"name": "DedeCMS 5.7 SP2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18608.yaml"
|
|
},
|
|
"CVE-2018-18775": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07905,
|
|
"epss_pct": 0.94297,
|
|
"name": "Microstrategy Web 7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18775.yaml"
|
|
},
|
|
"CVE-2018-18777": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.22768,
|
|
"epss_pct": 0.97562,
|
|
"name": "Microstrategy Web 7 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18777.yaml"
|
|
},
|
|
"CVE-2018-18778": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.70791,
|
|
"epss_pct": 0.9935,
|
|
"name": "ACME mini_httpd <1.30 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18778.yaml"
|
|
},
|
|
"CVE-2018-18809": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.79064,
|
|
"epss_pct": 0.99567,
|
|
"name": "TIBCO JasperReports Library - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18809.yaml"
|
|
},
|
|
"CVE-2018-18925": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-384",
|
|
"epss": 0.31133,
|
|
"epss_pct": 0.98138,
|
|
"name": "Gogs (Go Git Service) 0.11.66 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18925.yaml"
|
|
},
|
|
"CVE-2018-19127": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.20766,
|
|
"epss_pct": 0.97362,
|
|
"name": "PHPCMS 2008 - Remote Code Execution via Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19127.yaml"
|
|
},
|
|
"CVE-2018-19136": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06623,
|
|
"epss_pct": 0.93377,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19136.yaml"
|
|
},
|
|
"CVE-2018-19137": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02878,
|
|
"epss_pct": 0.85858,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19137.yaml"
|
|
},
|
|
"CVE-2018-19207": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.88065,
|
|
"epss_pct": 0.99754,
|
|
"name": "WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19207.yaml"
|
|
},
|
|
"CVE-2018-19276": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.98714,
|
|
"epss_pct": 0.99922,
|
|
"name": "OpenMRS Platform < 2.24.0 - Insecure Object Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19276.yaml"
|
|
},
|
|
"CVE-2018-19287": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08863,
|
|
"epss_pct": 0.94834,
|
|
"name": "WordPress Ninja Forms <3.3.18 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19287.yaml"
|
|
},
|
|
"CVE-2018-19326": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09759,
|
|
"epss_pct": 0.95179,
|
|
"name": "Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19326.yaml"
|
|
},
|
|
"CVE-2018-19365": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.22292,
|
|
"epss_pct": 0.97509,
|
|
"name": "Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19365.yaml"
|
|
},
|
|
"CVE-2018-19386": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09044,
|
|
"epss_pct": 0.94907,
|
|
"name": "SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19386.yaml"
|
|
},
|
|
"CVE-2018-19410": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.97939,
|
|
"epss_pct": 0.99905,
|
|
"name": "PRTG Network Monitor - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19410.yaml"
|
|
},
|
|
"CVE-2018-19439": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.20457,
|
|
"epss_pct": 0.97315,
|
|
"name": "Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19439.yaml"
|
|
},
|
|
"CVE-2018-19458": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.32885,
|
|
"epss_pct": 0.98231,
|
|
"name": "PHP Proxy 3.0.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19458.yaml"
|
|
},
|
|
"CVE-2018-19518": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-88",
|
|
"epss": 0.9523,
|
|
"epss_pct": 0.99859,
|
|
"name": "PHP imap - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2018/CVE-2018-19518.yaml"
|
|
},
|
|
"CVE-2018-19749": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03316,
|
|
"epss_pct": 0.87708,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19749.yaml"
|
|
},
|
|
"CVE-2018-19751": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03316,
|
|
"epss_pct": 0.87707,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19751.yaml"
|
|
},
|
|
"CVE-2018-19752": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03316,
|
|
"epss_pct": 0.87708,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19752.yaml"
|
|
},
|
|
"CVE-2018-19753": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16564,
|
|
"epss_pct": 0.96777,
|
|
"name": "Tarantella Enterprise <3.11 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19753.yaml"
|
|
},
|
|
"CVE-2018-19877": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.18563,
|
|
"epss_pct": 0.97045,
|
|
"name": "Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19877.yaml"
|
|
},
|
|
"CVE-2018-19892": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01514,
|
|
"epss_pct": 0.72701,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19892.yaml"
|
|
},
|
|
"CVE-2018-19914": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03316,
|
|
"epss_pct": 0.87707,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19914.yaml"
|
|
},
|
|
"CVE-2018-19915": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04008,
|
|
"epss_pct": 0.89822,
|
|
"name": "DomainMOD <=4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19915.yaml"
|
|
},
|
|
"CVE-2018-20009": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04428,
|
|
"epss_pct": 0.9068,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20009.yaml"
|
|
},
|
|
"CVE-2018-20010": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04428,
|
|
"epss_pct": 0.9068,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20010.yaml"
|
|
},
|
|
"CVE-2018-20011": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04428,
|
|
"epss_pct": 0.9068,
|
|
"name": "DomainMOD 4.11.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20011.yaml"
|
|
},
|
|
"CVE-2018-20062": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.9953,
|
|
"epss_pct": 0.99943,
|
|
"name": "ThinkPHP 5.0.23 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20062.yaml"
|
|
},
|
|
"CVE-2018-20462": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0397,
|
|
"epss_pct": 0.89731,
|
|
"name": "WordPress JSmol2WP <=1.07 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20462.yaml"
|
|
},
|
|
"CVE-2018-20463": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13187,
|
|
"epss_pct": 0.96089,
|
|
"name": "WordPress JSmol2WP <=1.07 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20463.yaml"
|
|
},
|
|
"CVE-2018-20470": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.4606,
|
|
"epss_pct": 0.98719,
|
|
"name": "Tyto Sahi pro 7.x/8.x - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20470.yaml"
|
|
},
|
|
"CVE-2018-20526": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.73056,
|
|
"epss_pct": 0.99414,
|
|
"name": "Roxy Fileman 1.4.5 - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20526.yaml"
|
|
},
|
|
"CVE-2018-20608": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.12063,
|
|
"epss_pct": 0.95842,
|
|
"name": "Imcat 4.4 - Phpinfo Configuration",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20608.yaml"
|
|
},
|
|
"CVE-2018-20824": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.37986,
|
|
"epss_pct": 0.98443,
|
|
"name": "Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20824.yaml"
|
|
},
|
|
"CVE-2018-20985": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.07671,
|
|
"epss_pct": 0.94156,
|
|
"name": "WordPress Payeezy Pay <=2.97 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20985.yaml"
|
|
},
|
|
"CVE-2018-2392": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.41051,
|
|
"epss_pct": 0.98559,
|
|
"name": "SAP Internet Graphics Server (IGS) - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2392.yaml"
|
|
},
|
|
"CVE-2018-25031": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.42326,
|
|
"epss_pct": 0.98601,
|
|
"name": "Swagger UI < 3.38.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2018/CVE-2018-25031.yaml"
|
|
},
|
|
"CVE-2018-25114": {
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.0282,
|
|
"epss_pct": 0.85575,
|
|
"name": "osCommerce 2.3.4.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-25114.yaml"
|
|
},
|
|
"CVE-2018-2628": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99448,
|
|
"epss_pct": 0.9994,
|
|
"name": "Oracle WebLogic Server Deserialization - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2018/CVE-2018-2628.yaml"
|
|
},
|
|
"CVE-2018-2791": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
|
|
"epss": 0.38811,
|
|
"epss_pct": 0.98478,
|
|
"name": "Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2791.yaml"
|
|
},
|
|
"CVE-2018-2893": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.71196,
|
|
"epss_pct": 0.99362,
|
|
"name": "Oracle WebLogic Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2018/CVE-2018-2893.yaml"
|
|
},
|
|
"CVE-2018-2894": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.50224,
|
|
"epss_pct": 0.98823,
|
|
"name": "Oracle WebLogic Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2894.yaml"
|
|
},
|
|
"CVE-2018-3167": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.17118,
|
|
"epss_pct": 0.96858,
|
|
"name": "Oracle E-Business Suite - Blind SSRF",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3167.yaml"
|
|
},
|
|
"CVE-2018-3238": {
|
|
"cvss": 6.9,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N",
|
|
"epss": 0.04579,
|
|
"epss_pct": 0.90963,
|
|
"name": "Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3238.yaml"
|
|
},
|
|
"CVE-2018-3714": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08632,
|
|
"epss_pct": 0.94709,
|
|
"name": "node-srv - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3714.yaml"
|
|
},
|
|
"CVE-2018-3760": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.26717,
|
|
"epss_pct": 0.97879,
|
|
"name": "Ruby On Rails - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3760.yaml"
|
|
},
|
|
"CVE-2018-3810": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.91141,
|
|
"epss_pct": 0.998,
|
|
"name": "Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3810.yaml"
|
|
},
|
|
"CVE-2018-5230": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.37611,
|
|
"epss_pct": 0.98428,
|
|
"name": "Atlassian Jira Confluence - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5230.yaml"
|
|
},
|
|
"CVE-2018-5233": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03286,
|
|
"epss_pct": 0.87593,
|
|
"name": "Grav CMS <1.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5233.yaml"
|
|
},
|
|
"CVE-2018-5316": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03685,
|
|
"epss_pct": 0.88899,
|
|
"name": "WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5316.yaml"
|
|
},
|
|
"CVE-2018-5715": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06914,
|
|
"epss_pct": 0.93615,
|
|
"name": "SugarCRM 3.5.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-5715.yaml"
|
|
},
|
|
"CVE-2018-6008": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.36823,
|
|
"epss_pct": 0.98392,
|
|
"name": "Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6008.yaml"
|
|
},
|
|
"CVE-2018-6184": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0906,
|
|
"epss_pct": 0.94913,
|
|
"name": "Zeit Next.js < 4.2.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6184.yaml"
|
|
},
|
|
"CVE-2018-6200": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03474,
|
|
"epss_pct": 0.88255,
|
|
"name": "vBulletin - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6200.yaml"
|
|
},
|
|
"CVE-2018-6530": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.96682,
|
|
"epss_pct": 0.99881,
|
|
"name": "D-Link - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6530.yaml"
|
|
},
|
|
"CVE-2018-6605": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.57702,
|
|
"epss_pct": 0.99013,
|
|
"name": "Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6605.yaml"
|
|
},
|
|
"CVE-2018-6882": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.2542,
|
|
"epss_pct": 0.97794,
|
|
"name": "Zimbra Collaboration Suite - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6882.yaml"
|
|
},
|
|
"CVE-2018-6910": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.18838,
|
|
"epss_pct": 0.97077,
|
|
"name": "DedeCMS 5.7 - Path Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6910.yaml"
|
|
},
|
|
"CVE-2018-6961": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.86252,
|
|
"epss_pct": 0.99718,
|
|
"name": "VMware NSX SD-WAN Edge - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6961.yaml"
|
|
},
|
|
"CVE-2018-7192": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02041,
|
|
"epss_pct": 0.79786,
|
|
"name": "osTicket < 1.10.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7192.yaml"
|
|
},
|
|
"CVE-2018-7193": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02444,
|
|
"epss_pct": 0.83172,
|
|
"name": "osTicket < 1.10.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7193.yaml"
|
|
},
|
|
"CVE-2018-7196": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02444,
|
|
"epss_pct": 0.83172,
|
|
"name": "osTicket < 1.10.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7196.yaml"
|
|
},
|
|
"CVE-2018-7251": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.7183,
|
|
"epss_pct": 0.99378,
|
|
"name": "Anchor CMS 0.12.3 - Error Log Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7251.yaml"
|
|
},
|
|
"CVE-2018-7282": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10095,
|
|
"epss_pct": 0.95298,
|
|
"name": "TITool PrintMonitor - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7282.yaml"
|
|
},
|
|
"CVE-2018-7314": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.57752,
|
|
"epss_pct": 0.99014,
|
|
"name": "Joomla! Component PrayerCenter 3.0.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7314.yaml"
|
|
},
|
|
"CVE-2018-7422": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.6225,
|
|
"epss_pct": 0.99119,
|
|
"name": "WordPress Site Editor <=1.1.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7422.yaml"
|
|
},
|
|
"CVE-2018-7467": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10169,
|
|
"epss_pct": 0.9532,
|
|
"name": "AxxonSoft Axxon Next - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7467.yaml"
|
|
},
|
|
"CVE-2018-7490": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.69423,
|
|
"epss_pct": 0.99307,
|
|
"name": "uWSGI PHP Plugin Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7490.yaml"
|
|
},
|
|
"CVE-2018-7600": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99991,
|
|
"epss_pct": 0.99985,
|
|
"name": "Drupal - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml"
|
|
},
|
|
"CVE-2018-7602": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99236,
|
|
"epss_pct": 0.99935,
|
|
"name": "Drupal - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7602.yaml"
|
|
},
|
|
"CVE-2018-7653": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07854,
|
|
"epss_pct": 0.94265,
|
|
"name": "YzmCMS v3.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7653.yaml"
|
|
},
|
|
"CVE-2018-7662": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.47085,
|
|
"epss_pct": 0.98746,
|
|
"name": "CouchCMS <= 2.0 - Path Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7662.yaml"
|
|
},
|
|
"CVE-2018-7700": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.74519,
|
|
"epss_pct": 0.99457,
|
|
"name": "DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7700.yaml"
|
|
},
|
|
"CVE-2018-7719": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.47514,
|
|
"epss_pct": 0.98756,
|
|
"name": "Acrolinx Server <5.2.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7719.yaml"
|
|
},
|
|
"CVE-2018-7765": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02917,
|
|
"epss_pct": 0.86048,
|
|
"name": "Schneider Electric U.motion Builder - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7765.yaml"
|
|
},
|
|
"CVE-2018-7841": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.72675,
|
|
"epss_pct": 0.99403,
|
|
"name": "Schneider Electric U.motion Builder - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7841.yaml"
|
|
},
|
|
"CVE-2018-8006": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.57227,
|
|
"epss_pct": 0.99002,
|
|
"name": "Apache ActiveMQ <=5.15.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8006.yaml"
|
|
},
|
|
"CVE-2018-8011": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.56037,
|
|
"epss_pct": 0.98973,
|
|
"name": "Apache HTTP Server - NULL Pointer Dereference",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-8011.yaml"
|
|
},
|
|
"CVE-2018-8024": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05251,
|
|
"epss_pct": 0.91954,
|
|
"name": "Apache Spark UI - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8024.yaml"
|
|
},
|
|
"CVE-2018-8033": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.25743,
|
|
"epss_pct": 0.97816,
|
|
"name": "Apache OFBiz - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8033.yaml"
|
|
},
|
|
"CVE-2018-8715": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.2279,
|
|
"epss_pct": 0.97563,
|
|
"name": "AppWeb - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8715.yaml"
|
|
},
|
|
"CVE-2018-8719": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.15905,
|
|
"epss_pct": 0.96651,
|
|
"name": "WordPress WP Security Audit Log 3.1.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8719.yaml"
|
|
},
|
|
"CVE-2018-8727": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08005,
|
|
"epss_pct": 0.94348,
|
|
"name": "Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8727.yaml"
|
|
},
|
|
"CVE-2018-8770": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.59208,
|
|
"epss_pct": 0.99047,
|
|
"name": "Cobub Razor 0.8.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8770.yaml"
|
|
},
|
|
"CVE-2018-8823": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.51043,
|
|
"epss_pct": 0.98846,
|
|
"name": "PrestaShop Responsive Mega Menu Module - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8823.yaml"
|
|
},
|
|
"CVE-2018-9118": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.46931,
|
|
"epss_pct": 0.98741,
|
|
"name": "WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9118.yaml"
|
|
},
|
|
"CVE-2018-9161": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.57335,
|
|
"epss_pct": 0.99005,
|
|
"name": "PrismaWEB - Credentials Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9161.yaml"
|
|
},
|
|
"CVE-2018-9205": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.55714,
|
|
"epss_pct": 0.98966,
|
|
"name": "Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9205.yaml"
|
|
},
|
|
"CVE-2018-9206": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.97255,
|
|
"epss_pct": 0.9989,
|
|
"name": "Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9206.yaml"
|
|
},
|
|
"CVE-2018-9845": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-178",
|
|
"epss": 0.13132,
|
|
"epss_pct": 0.96081,
|
|
"name": "Etherpad Lite <1.6.4 - Admin Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9845.yaml"
|
|
},
|
|
"CVE-2018-9995": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.82608,
|
|
"epss_pct": 0.99642,
|
|
"name": "TBK DVR4104/DVR4216 Devices - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9995.yaml"
|
|
},
|
|
"CVE-2019-0192": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.77508,
|
|
"epss_pct": 0.99524,
|
|
"name": "Apache Solr - Deserialization of Untrusted Data",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0192.yaml"
|
|
},
|
|
"CVE-2019-0193": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.83547,
|
|
"epss_pct": 0.99663,
|
|
"name": "Apache Solr DataImportHandler <8.2.0 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0193.yaml"
|
|
},
|
|
"CVE-2019-0221": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.45571,
|
|
"epss_pct": 0.98704,
|
|
"name": "Apache Tomcat - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0221.yaml"
|
|
},
|
|
"CVE-2019-0230": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1321",
|
|
"epss": 0.97112,
|
|
"epss_pct": 0.99887,
|
|
"name": "Apache Struts <=2.5.20 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0230.yaml"
|
|
},
|
|
"CVE-2019-0232": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99652,
|
|
"epss_pct": 0.99948,
|
|
"name": "Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0232.yaml"
|
|
},
|
|
"CVE-2019-0604": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99913,
|
|
"epss_pct": 0.99966,
|
|
"name": "Microsoft SharePoint - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2019/CVE-2019-0604.yaml"
|
|
},
|
|
"CVE-2019-1003000": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.98375,
|
|
"epss_pct": 0.99914,
|
|
"name": "Jenkins Script Security Plugin <=1.49 - Sandbox Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003000.yaml"
|
|
},
|
|
"CVE-2019-1003030": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-693",
|
|
"epss": 0.96868,
|
|
"epss_pct": 0.99884,
|
|
"name": "Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003030.yaml"
|
|
},
|
|
"CVE-2019-10068": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.95074,
|
|
"epss_pct": 0.99855,
|
|
"name": "Kentico CMS Insecure Deserialization Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10068.yaml"
|
|
},
|
|
"CVE-2019-10092": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.81466,
|
|
"epss_pct": 0.99612,
|
|
"name": "Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10092.yaml"
|
|
},
|
|
"CVE-2019-10098": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.73981,
|
|
"epss_pct": 0.99442,
|
|
"name": "Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10098.yaml"
|
|
},
|
|
"CVE-2019-1010287": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.043,
|
|
"epss_pct": 0.9044,
|
|
"name": "Timesheet Next Gen <=1.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1010287.yaml"
|
|
},
|
|
"CVE-2019-1010290": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04059,
|
|
"epss_pct": 0.89929,
|
|
"name": "Babel - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1010290.yaml"
|
|
},
|
|
"CVE-2019-10232": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.23211,
|
|
"epss_pct": 0.97604,
|
|
"name": "Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10232.yaml"
|
|
},
|
|
"CVE-2019-10405": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.65753,
|
|
"epss_pct": 0.99209,
|
|
"name": "Jenkins <=2.196 - Cookie Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10405.yaml"
|
|
},
|
|
"CVE-2019-10475": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.57735,
|
|
"epss_pct": 0.99014,
|
|
"name": "Jenkins build-metrics 1.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10475.yaml"
|
|
},
|
|
"CVE-2019-10647": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.06643,
|
|
"epss_pct": 0.93389,
|
|
"name": "ZZZCMS ZZZPHP 1.6.3 \u2013 Remote PHP Code Execution (RCE)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2019-10647.yaml"
|
|
},
|
|
"CVE-2019-10692": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.78699,
|
|
"epss_pct": 0.99557,
|
|
"name": "WordPress Google Maps <7.11.18 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10692.yaml"
|
|
},
|
|
"CVE-2019-10717": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05399,
|
|
"epss_pct": 0.92115,
|
|
"name": "BlogEngine.NET 3.3.7.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10717.yaml"
|
|
},
|
|
"CVE-2019-10758": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.84845,
|
|
"epss_pct": 0.99694,
|
|
"name": "mongo-express Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10758.yaml"
|
|
},
|
|
"CVE-2019-11013": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.23978,
|
|
"epss_pct": 0.97672,
|
|
"name": "Nimble Streamer <=3.5.4-9 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11013.yaml"
|
|
},
|
|
"CVE-2019-11043": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.9978,
|
|
"epss_pct": 0.99955,
|
|
"name": "PHP-FPM Path Info Buffer Underflow - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11043.yaml"
|
|
},
|
|
"CVE-2019-11248": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
|
|
"epss": 0.7506,
|
|
"epss_pct": 0.99471,
|
|
"name": "Debug Endpoint pprof - Exposure Detection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11248.yaml"
|
|
},
|
|
"CVE-2019-11253": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-400",
|
|
"epss": 0.25939,
|
|
"epss_pct": 0.97831,
|
|
"name": "Kubernetes API Server - YAML Parsing DoS (Billion Laughs)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11253.yaml"
|
|
},
|
|
"CVE-2019-11370": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03977,
|
|
"epss_pct": 0.89748,
|
|
"name": "Carel pCOWeb <B1.2.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11370.yaml"
|
|
},
|
|
"CVE-2019-11507": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04055,
|
|
"epss_pct": 0.89924,
|
|
"name": "Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11507.yaml"
|
|
},
|
|
"CVE-2019-11510": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99995,
|
|
"name": "Pulse Connect Secure SSL VPN Arbitrary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11510.yaml"
|
|
},
|
|
"CVE-2019-11580": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.95355,
|
|
"epss_pct": 0.99862,
|
|
"name": "Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11580.yaml"
|
|
},
|
|
"CVE-2019-11581": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.84621,
|
|
"epss_pct": 0.99687,
|
|
"name": "Atlassian Jira Server-Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11581.yaml"
|
|
},
|
|
"CVE-2019-11869": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05331,
|
|
"epss_pct": 0.92037,
|
|
"name": "WordPress Yuzo <5.12.94 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11869.yaml"
|
|
},
|
|
"CVE-2019-11886": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.0189,
|
|
"epss_pct": 0.78084,
|
|
"name": "Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11886.yaml"
|
|
},
|
|
"CVE-2019-12276": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.53705,
|
|
"epss_pct": 0.98919,
|
|
"name": "GrandNode 4.40 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12276.yaml"
|
|
},
|
|
"CVE-2019-12314": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.8422,
|
|
"epss_pct": 0.99678,
|
|
"name": "Deltek Maconomy 2.2.5 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12314.yaml"
|
|
},
|
|
"CVE-2019-12461": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09916,
|
|
"epss_pct": 0.95237,
|
|
"name": "WebPort 1.19.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12461.yaml"
|
|
},
|
|
"CVE-2019-12581": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.064,
|
|
"epss_pct": 0.93178,
|
|
"name": "Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12581.yaml"
|
|
},
|
|
"CVE-2019-12583": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.43926,
|
|
"epss_pct": 0.98655,
|
|
"name": "Zyxel ZyWall UAG/USG - Account Creation Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12583.yaml"
|
|
},
|
|
"CVE-2019-12593": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.40965,
|
|
"epss_pct": 0.98555,
|
|
"name": "IceWarp Mail Server <=10.4.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12593.yaml"
|
|
},
|
|
"CVE-2019-12725": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.89849,
|
|
"epss_pct": 0.9978,
|
|
"name": "Zeroshell 3.9.0 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12725.yaml"
|
|
},
|
|
"CVE-2019-12935": {
|
|
"cvss": 7.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02734,
|
|
"epss_pct": 0.85062,
|
|
"name": "Shopware < 5.5.8 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12935.yaml"
|
|
},
|
|
"CVE-2019-12962": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09052,
|
|
"epss_pct": 0.94911,
|
|
"name": "LiveZilla Server 8.0.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12962.yaml"
|
|
},
|
|
"CVE-2019-12985": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.39544,
|
|
"epss_pct": 0.98507,
|
|
"name": "Citrix SD-WAN Center - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12985.yaml"
|
|
},
|
|
"CVE-2019-12986": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.39544,
|
|
"epss_pct": 0.98507,
|
|
"name": "Citrix SD-WAN Center - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12986.yaml"
|
|
},
|
|
"CVE-2019-12987": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.42551,
|
|
"epss_pct": 0.98607,
|
|
"name": "Citrix SD-WAN Center - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12987.yaml"
|
|
},
|
|
"CVE-2019-12988": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.42551,
|
|
"epss_pct": 0.98607,
|
|
"name": "Citrix SD-WAN Center - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12988.yaml"
|
|
},
|
|
"CVE-2019-12989": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.94131,
|
|
"epss_pct": 0.9984,
|
|
"name": "Citrix SD-WAN and NetScaler SD-WAN - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12989.yaml"
|
|
},
|
|
"CVE-2019-12990": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.39335,
|
|
"epss_pct": 0.98498,
|
|
"name": "Citrix SD-WAN Center - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12990.yaml"
|
|
},
|
|
"CVE-2019-13101": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.67091,
|
|
"epss_pct": 0.99244,
|
|
"name": "D-Link DIR-600M - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13101.yaml"
|
|
},
|
|
"CVE-2019-13372": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.8249,
|
|
"epss_pct": 0.9964,
|
|
"name": "D-Link Central WiFi Manager CWM(100) - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13372.yaml"
|
|
},
|
|
"CVE-2019-13392": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04019,
|
|
"epss_pct": 0.89841,
|
|
"name": "MindPalette NateMail 3.0.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13392.yaml"
|
|
},
|
|
"CVE-2019-13396": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.62572,
|
|
"epss_pct": 0.99126,
|
|
"name": "FlightPath - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13396.yaml"
|
|
},
|
|
"CVE-2019-13462": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.1131,
|
|
"epss_pct": 0.95664,
|
|
"name": "Lansweeper Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13462.yaml"
|
|
},
|
|
"CVE-2019-13608": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.30041,
|
|
"epss_pct": 0.98078,
|
|
"name": "Citrix StoreFront Server - XML External Entity",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13608.yaml"
|
|
},
|
|
"CVE-2019-14205": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.63375,
|
|
"epss_pct": 0.99148,
|
|
"name": "WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14205.yaml"
|
|
},
|
|
"CVE-2019-14206": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04728,
|
|
"epss_pct": 0.91202,
|
|
"name": "Nevma Adaptive Images - Arbitrary File Deletion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14206.yaml"
|
|
},
|
|
"CVE-2019-14223": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04474,
|
|
"epss_pct": 0.90768,
|
|
"name": "Alfresco Share - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14223.yaml"
|
|
},
|
|
"CVE-2019-14251": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07849,
|
|
"epss_pct": 0.94261,
|
|
"name": "T24 Web Server - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14251.yaml"
|
|
},
|
|
"CVE-2019-14287": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-755",
|
|
"epss": 0.63764,
|
|
"epss_pct": 0.9916,
|
|
"name": "Sudo <= 1.8.27 - Security Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2019/CVE-2019-14287.yaml"
|
|
},
|
|
"CVE-2019-14312": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20586,
|
|
"epss_pct": 0.97334,
|
|
"name": "Aptana Jaxer 1.0.3.4547 - Local File inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14312.yaml"
|
|
},
|
|
"CVE-2019-14322": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.55803,
|
|
"epss_pct": 0.98968,
|
|
"name": "Pallets Werkzeug <0.15.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14322.yaml"
|
|
},
|
|
"CVE-2019-14470": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.82962,
|
|
"epss_pct": 0.99649,
|
|
"name": "WordPress UserPro 4.9.32 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14470.yaml"
|
|
},
|
|
"CVE-2019-14530": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.65529,
|
|
"epss_pct": 0.99205,
|
|
"name": "OpenEMR <5.0.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14530.yaml"
|
|
},
|
|
"CVE-2019-14696": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.15682,
|
|
"epss_pct": 0.96605,
|
|
"name": "Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14696.yaml"
|
|
},
|
|
"CVE-2019-14750": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10902,
|
|
"epss_pct": 0.95549,
|
|
"name": "osTicket < 1.12.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14750.yaml"
|
|
},
|
|
"CVE-2019-14789": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01611,
|
|
"epss_pct": 0.74222,
|
|
"name": "Custom 404 Pro < 3.2.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14789.yaml"
|
|
},
|
|
"CVE-2019-14793": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01706,
|
|
"epss_pct": 0.75656,
|
|
"name": "Meta Box <= 4.16.2 - Arbitrary File Deletion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14793.yaml"
|
|
},
|
|
"CVE-2019-14950": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01211,
|
|
"epss_pct": 0.66314,
|
|
"name": "WP Live Chat Support <= 8.0.27 \u2014 Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14950.yaml"
|
|
},
|
|
"CVE-2019-14974": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.28433,
|
|
"epss_pct": 0.97986,
|
|
"name": "SugarCRM Enterprise 9.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14974.yaml"
|
|
},
|
|
"CVE-2019-15043": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.63388,
|
|
"epss_pct": 0.99148,
|
|
"name": "Grafana - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15043.yaml"
|
|
},
|
|
"CVE-2019-15107": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99766,
|
|
"epss_pct": 0.99954,
|
|
"name": "Webmin <= 1.920 - Unauthenticated Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15107.yaml"
|
|
},
|
|
"CVE-2019-15501": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07416,
|
|
"epss_pct": 0.93998,
|
|
"name": "L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15501.yaml"
|
|
},
|
|
"CVE-2019-15642": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.34798,
|
|
"epss_pct": 0.98311,
|
|
"name": "Webmin < 1.920 - Authenticated Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15642.yaml"
|
|
},
|
|
"CVE-2019-15713": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02192,
|
|
"epss_pct": 0.81187,
|
|
"name": "WordPress My Calendar <= 3.1.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15713.yaml"
|
|
},
|
|
"CVE-2019-15774": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01731,
|
|
"epss_pct": 0.75993,
|
|
"name": "ND Booking < 2.5 - Unauthenticated Options Change",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15774.yaml"
|
|
},
|
|
"CVE-2019-15811": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0699,
|
|
"epss_pct": 0.9368,
|
|
"name": "DomainMOD <=4.13.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15811.yaml"
|
|
},
|
|
"CVE-2019-15823": {
|
|
"name": "WPS Hide Login <= 1.5.2.2 - Login Page Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15823.yaml"
|
|
},
|
|
"CVE-2019-15829": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01318,
|
|
"epss_pct": 0.68796,
|
|
"name": "Gallery Photoblocks < 1.1.43 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15829.yaml"
|
|
},
|
|
"CVE-2019-15858": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.18463,
|
|
"epss_pct": 0.97033,
|
|
"name": "WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15858.yaml"
|
|
},
|
|
"CVE-2019-15859": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.31487,
|
|
"epss_pct": 0.98155,
|
|
"name": "Socomec DIRIS A-40 Devices Password Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15859.yaml"
|
|
},
|
|
"CVE-2019-15889": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.11375,
|
|
"epss_pct": 0.95677,
|
|
"name": "WordPress Download Manager <2.9.94 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15889.yaml"
|
|
},
|
|
"CVE-2019-16057": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.87065,
|
|
"epss_pct": 0.99734,
|
|
"name": "D-Link DNS-320 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16057.yaml"
|
|
},
|
|
"CVE-2019-16072": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.25853,
|
|
"epss_pct": 0.97824,
|
|
"name": "Enigma NMS < 65.0.0 - Authenticated OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16072.yaml"
|
|
},
|
|
"CVE-2019-16097": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.22443,
|
|
"epss_pct": 0.97523,
|
|
"name": "Harbor <=1.82.0 - Privilege Escalation",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16097.yaml"
|
|
},
|
|
"CVE-2019-16123": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16619,
|
|
"epss_pct": 0.96784,
|
|
"name": "PilusCart <=1.4.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16123.yaml"
|
|
},
|
|
"CVE-2019-16278": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99033,
|
|
"epss_pct": 0.99929,
|
|
"name": "nostromo 1.9.6 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16278.yaml"
|
|
},
|
|
"CVE-2019-16313": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.46109,
|
|
"epss_pct": 0.98721,
|
|
"name": "ifw8 Router ROM v4.31 - Credential Discovery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16313.yaml"
|
|
},
|
|
"CVE-2019-16332": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05672,
|
|
"epss_pct": 0.92442,
|
|
"name": "WordPress API Bearer Auth <20190907 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16332.yaml"
|
|
},
|
|
"CVE-2019-16469": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.17186,
|
|
"epss_pct": 0.96867,
|
|
"name": "Adobe Experience Manager - Expression Language Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16469.yaml"
|
|
},
|
|
"CVE-2019-16525": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05524,
|
|
"epss_pct": 0.9225,
|
|
"name": "WordPress Checklist <1.1.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16525.yaml"
|
|
},
|
|
"CVE-2019-1653": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.99876,
|
|
"epss_pct": 0.99962,
|
|
"name": "Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1653.yaml"
|
|
},
|
|
"CVE-2019-16662": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97702,
|
|
"epss_pct": 0.99899,
|
|
"name": "rConfig 3.9.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16662.yaml"
|
|
},
|
|
"CVE-2019-16759": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99728,
|
|
"epss_pct": 0.99952,
|
|
"name": "vBulletin 5.0.0-5.5.4 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16759.yaml"
|
|
},
|
|
"CVE-2019-16920": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99996,
|
|
"epss_pct": 0.99988,
|
|
"name": "D-Link Routers - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16920.yaml"
|
|
},
|
|
"CVE-2019-16931": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03342,
|
|
"epss_pct": 0.87799,
|
|
"name": "WordPress Visualizer <3.3.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16931.yaml"
|
|
},
|
|
"CVE-2019-16932": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.39137,
|
|
"epss_pct": 0.98487,
|
|
"name": "Visualizer <3.3.1 - Blind Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16932.yaml"
|
|
},
|
|
"CVE-2019-16996": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12443,
|
|
"epss_pct": 0.9592,
|
|
"name": "Metinfo 7.0.0 beta - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16996.yaml"
|
|
},
|
|
"CVE-2019-16997": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.49398,
|
|
"epss_pct": 0.98802,
|
|
"name": "Metinfo 7.0.0 beta - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16997.yaml"
|
|
},
|
|
"CVE-2019-17228": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-345",
|
|
"epss": 0.01153,
|
|
"epss_pct": 0.64725,
|
|
"name": "Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17228.yaml"
|
|
},
|
|
"CVE-2019-17230": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"epss": 0.02362,
|
|
"epss_pct": 0.82583,
|
|
"name": "WordPress OneTone theme <= 3.0.6 \u2013 Unauthenticated Options Changes",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17230.yaml"
|
|
},
|
|
"CVE-2019-17231": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.01216,
|
|
"epss_pct": 0.66453,
|
|
"name": "WordPress OneTone theme <= 3.0.6 \u2013 Unauthenticated Stored XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17231.yaml"
|
|
},
|
|
"CVE-2019-17232": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.03518,
|
|
"epss_pct": 0.88386,
|
|
"name": "WordPress Ultimate FAQs <= 1.8.24 \u2013 Unauthenticated Options Import and Export",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17232.yaml"
|
|
},
|
|
"CVE-2019-17233": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.01843,
|
|
"epss_pct": 0.77502,
|
|
"name": "WordPress Ultimate FAQs <= 1.8.24 \u2013 Unauthenticated HTML Content Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17233.yaml"
|
|
},
|
|
"CVE-2019-17270": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.58879,
|
|
"epss_pct": 0.99039,
|
|
"name": "Yachtcontrol Webapplication 1.0 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17270.yaml"
|
|
},
|
|
"CVE-2019-17382": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.5415,
|
|
"epss_pct": 0.98931,
|
|
"name": "Zabbix <=4.4 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17382.yaml"
|
|
},
|
|
"CVE-2019-17418": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.49299,
|
|
"epss_pct": 0.98799,
|
|
"name": "MetInfo 7.0.0 beta - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17418.yaml"
|
|
},
|
|
"CVE-2019-17444": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-521",
|
|
"epss": 0.69445,
|
|
"epss_pct": 0.99309,
|
|
"name": "Jfrog Artifactory <6.17.0 - Default Admin Password",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17444.yaml"
|
|
},
|
|
"CVE-2019-17503": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.48303,
|
|
"epss_pct": 0.98775,
|
|
"name": "Kirona Dynamic Resource Scheduler - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17503.yaml"
|
|
},
|
|
"CVE-2019-17506": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.56386,
|
|
"epss_pct": 0.98982,
|
|
"name": "D-Link DIR-868L/817LW - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17506.yaml"
|
|
},
|
|
"CVE-2019-17538": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11302,
|
|
"epss_pct": 0.95662,
|
|
"name": "Jiangnan Online Judge 0.8.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17538.yaml"
|
|
},
|
|
"CVE-2019-17558": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.98567,
|
|
"epss_pct": 0.99919,
|
|
"name": "Apache Solr <=8.3.1 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17558.yaml"
|
|
},
|
|
"CVE-2019-17564": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.36513,
|
|
"epss_pct": 0.98379,
|
|
"name": "Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17564.yaml"
|
|
},
|
|
"CVE-2019-17574": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.09432,
|
|
"epss_pct": 0.95055,
|
|
"name": "Popup-Maker < 1.8.12 - Broken Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17574.yaml"
|
|
},
|
|
"CVE-2019-17662": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.96758,
|
|
"epss_pct": 0.99882,
|
|
"name": "ThinVNC 1.0b1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17662.yaml"
|
|
},
|
|
"CVE-2019-17671": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.36503,
|
|
"epss_pct": 0.98377,
|
|
"name": "WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17671.yaml"
|
|
},
|
|
"CVE-2019-1821": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.98051,
|
|
"epss_pct": 0.99907,
|
|
"name": "Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1821.yaml"
|
|
},
|
|
"CVE-2019-18217": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-835",
|
|
"epss": 0.19507,
|
|
"epss_pct": 0.9718,
|
|
"name": "ProFTPD < 1.3.6b - Remote Unauthenticated DoS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-18217.yaml"
|
|
},
|
|
"CVE-2019-18371": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.55872,
|
|
"epss_pct": 0.9897,
|
|
"name": "Xiaomi Mi WiFi R3G Routers - Local file Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18371.yaml"
|
|
},
|
|
"CVE-2019-18393": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13419,
|
|
"epss_pct": 0.96146,
|
|
"name": "Ignite Realtime Openfire <4.42 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18393.yaml"
|
|
},
|
|
"CVE-2019-18394": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.32304,
|
|
"epss_pct": 0.98199,
|
|
"name": "Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18394.yaml"
|
|
},
|
|
"CVE-2019-18665": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14855,
|
|
"epss_pct": 0.96446,
|
|
"name": "DOMOS 5.5 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18665.yaml"
|
|
},
|
|
"CVE-2019-18818": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-640",
|
|
"epss": 0.97639,
|
|
"epss_pct": 0.99898,
|
|
"name": "strapi CMS <3.0.0-beta.17.5 - Admin Password Reset",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18818.yaml"
|
|
},
|
|
"CVE-2019-18922": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.23856,
|
|
"epss_pct": 0.9766,
|
|
"name": "Allied Telesis AT-GS950/8 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18922.yaml"
|
|
},
|
|
"CVE-2019-18952": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.45361,
|
|
"epss_pct": 0.98699,
|
|
"name": "Xfilesharing 2.5.1 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18952.yaml"
|
|
},
|
|
"CVE-2019-18957": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04857,
|
|
"epss_pct": 0.91404,
|
|
"name": "MicroStrategy Library <11.1.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18957.yaml"
|
|
},
|
|
"CVE-2019-1898": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.41657,
|
|
"epss_pct": 0.98581,
|
|
"name": "Cisco RV110W RV130W RV215W Router - Information leakage",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1898.yaml"
|
|
},
|
|
"CVE-2019-19134": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05726,
|
|
"epss_pct": 0.92504,
|
|
"name": "WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19134.yaml"
|
|
},
|
|
"CVE-2019-19368": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.25889,
|
|
"epss_pct": 0.97828,
|
|
"name": "Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19368.yaml"
|
|
},
|
|
"CVE-2019-19411": {
|
|
"cvss": 3.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-665",
|
|
"epss": 0.01238,
|
|
"epss_pct": 0.66987,
|
|
"name": "Huawei Firewall - Local File Inclusion",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19411.yaml"
|
|
},
|
|
"CVE-2019-1943": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.09687,
|
|
"epss_pct": 0.95152,
|
|
"name": "Cisco Small Business 200,300 and 500 Series Switches - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1943.yaml"
|
|
},
|
|
"CVE-2019-19781": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99998,
|
|
"name": "Citrix ADC and Gateway - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19781.yaml"
|
|
},
|
|
"CVE-2019-19822": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.08669,
|
|
"epss_pct": 0.9473,
|
|
"name": "TOTOLINK/Realtek Routers - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19822.yaml"
|
|
},
|
|
"CVE-2019-19823": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.06411,
|
|
"epss_pct": 0.93194,
|
|
"name": "TOTOLINK/Realtek Routers - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19823.yaml"
|
|
},
|
|
"CVE-2019-19824": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.25135,
|
|
"epss_pct": 0.97772,
|
|
"name": "TOTOLINK Realtek SD Routers - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19824.yaml"
|
|
},
|
|
"CVE-2019-19825": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.29557,
|
|
"epss_pct": 0.98053,
|
|
"name": "TOTOLINK/Realtek Routers - CAPTCHA Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19825.yaml"
|
|
},
|
|
"CVE-2019-19908": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.21232,
|
|
"epss_pct": 0.97414,
|
|
"name": "phpMyChat-Plus 1.98 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19908.yaml"
|
|
},
|
|
"CVE-2019-19985": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.71399,
|
|
"epss_pct": 0.99367,
|
|
"name": "WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19985.yaml"
|
|
},
|
|
"CVE-2019-20085": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.96071,
|
|
"epss_pct": 0.99872,
|
|
"name": "TVT NVMS 1000 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20085.yaml"
|
|
},
|
|
"CVE-2019-20141": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05008,
|
|
"epss_pct": 0.9163,
|
|
"name": "WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20141.yaml"
|
|
},
|
|
"CVE-2019-20176": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-400",
|
|
"epss": 0.04365,
|
|
"epss_pct": 0.90565,
|
|
"name": "Pure-FTPd < 1.0.50 - DoS via Resource Exhaustion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-20176.yaml"
|
|
},
|
|
"CVE-2019-20183": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.07625,
|
|
"epss_pct": 0.94127,
|
|
"name": "Simple Employee Records System 1.0 - Unrestricted File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20183.yaml"
|
|
},
|
|
"CVE-2019-20210": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03243,
|
|
"epss_pct": 0.8742,
|
|
"name": "WordPress CTHthemes - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20210.yaml"
|
|
},
|
|
"CVE-2019-20224": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.4968,
|
|
"epss_pct": 0.98809,
|
|
"name": "Pandora FMS 7.0NG - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20224.yaml"
|
|
},
|
|
"CVE-2019-20504": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.0955,
|
|
"epss_pct": 0.95105,
|
|
"name": "Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20504.yaml"
|
|
},
|
|
"CVE-2019-20933": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.30921,
|
|
"epss_pct": 0.98124,
|
|
"name": "InfluxDB <1.7.6 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20933.yaml"
|
|
},
|
|
"CVE-2019-25141": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.04498,
|
|
"epss_pct": 0.9081,
|
|
"name": "Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25141.yaml"
|
|
},
|
|
"CVE-2019-25152": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"epss": 0.01364,
|
|
"epss_pct": 0.69847,
|
|
"name": "Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25152.yaml"
|
|
},
|
|
"CVE-2019-25213": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.02772,
|
|
"epss_pct": 0.85296,
|
|
"name": "WordPress Advanced Access Manager - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25213.yaml"
|
|
},
|
|
"CVE-2019-25246": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"epss": 0.18903,
|
|
"epss_pct": 0.97087,
|
|
"name": "BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25246.yaml"
|
|
},
|
|
"CVE-2019-2578": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"epss": 0.72402,
|
|
"epss_pct": 0.99396,
|
|
"name": "Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2578.yaml"
|
|
},
|
|
"CVE-2019-2579": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.05969,
|
|
"epss_pct": 0.92772,
|
|
"name": "Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2579.yaml"
|
|
},
|
|
"CVE-2019-2588": {
|
|
"cvss": 4.9,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.36787,
|
|
"epss_pct": 0.98391,
|
|
"name": "Oracle Business Intelligence - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2588.yaml"
|
|
},
|
|
"CVE-2019-2616": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"epss": 0.92183,
|
|
"epss_pct": 0.99814,
|
|
"name": "Oracle Business Intelligence/XML Publisher - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2616.yaml"
|
|
},
|
|
"CVE-2019-2725": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.99964,
|
|
"epss_pct": 0.99976,
|
|
"name": "Oracle WebLogic Server - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2725.yaml"
|
|
},
|
|
"CVE-2019-2729": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.8883,
|
|
"epss_pct": 0.99764,
|
|
"name": "Oracle WebLogic Server Administration Console - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2729.yaml"
|
|
},
|
|
"CVE-2019-2767": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"epss": 0.05238,
|
|
"epss_pct": 0.91937,
|
|
"name": "Oracle Business Intelligence Publisher - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2767.yaml"
|
|
},
|
|
"CVE-2019-3396": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99913,
|
|
"epss_pct": 0.99966,
|
|
"name": "Atlassian Confluence Server - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3396.yaml"
|
|
},
|
|
"CVE-2019-3398": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.96837,
|
|
"epss_pct": 0.99883,
|
|
"name": "Atlassian Confluence Download Attachments - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3398.yaml"
|
|
},
|
|
"CVE-2019-3401": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.12719,
|
|
"epss_pct": 0.95977,
|
|
"name": "Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3401.yaml"
|
|
},
|
|
"CVE-2019-3402": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08947,
|
|
"epss_pct": 0.9487,
|
|
"name": "Jira < 8.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3402.yaml"
|
|
},
|
|
"CVE-2019-3403": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.52637,
|
|
"epss_pct": 0.98885,
|
|
"name": "Jira - Incorrect Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3403.yaml"
|
|
},
|
|
"CVE-2019-3799": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.85295,
|
|
"epss_pct": 0.997,
|
|
"name": "Spring Cloud Config Server - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3799.yaml"
|
|
},
|
|
"CVE-2019-3911": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03813,
|
|
"epss_pct": 0.89291,
|
|
"name": "LabKey Server Community Edition <18.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3911.yaml"
|
|
},
|
|
"CVE-2019-3912": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04825,
|
|
"epss_pct": 0.91349,
|
|
"name": "LabKey Server Community Edition <18.3.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3912.yaml"
|
|
},
|
|
"CVE-2019-3929": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.98952,
|
|
"epss_pct": 0.99926,
|
|
"name": "Barco/AWIND OEM Presentation Platform - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3929.yaml"
|
|
},
|
|
"CVE-2019-4061": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.22547,
|
|
"epss_pct": 0.9754,
|
|
"name": "IBM BigFix Platform - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-4061.yaml"
|
|
},
|
|
"CVE-2019-4716": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.86441,
|
|
"epss_pct": 0.99722,
|
|
"name": "IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-4716.yaml"
|
|
},
|
|
"CVE-2019-5127": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.45302,
|
|
"epss_pct": 0.98696,
|
|
"name": "YouPHPTube Encoder 2.3 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5127.yaml"
|
|
},
|
|
"CVE-2019-5128": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.30174,
|
|
"epss_pct": 0.98087,
|
|
"name": "YouPHPTube Encoder - Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5128.yaml"
|
|
},
|
|
"CVE-2019-5129": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.38531,
|
|
"epss_pct": 0.98466,
|
|
"name": "YouPHPTube Encoder 2.3 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5129.yaml"
|
|
},
|
|
"CVE-2019-5418": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.98507,
|
|
"epss_pct": 0.99916,
|
|
"name": "Rails File Content Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml"
|
|
},
|
|
"CVE-2019-5434": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.57022,
|
|
"epss_pct": 0.98996,
|
|
"name": "Revive Adserver 4.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5434.yaml"
|
|
},
|
|
"CVE-2019-5544": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-787",
|
|
"epss": 0.97258,
|
|
"epss_pct": 0.9989,
|
|
"name": "VMware ESXi SLP - Heap Overflow DoS",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-5544.yaml"
|
|
},
|
|
"CVE-2019-5591": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.18422,
|
|
"epss_pct": 0.97028,
|
|
"name": "FortiOS - Insecure LDAP Configuration Detection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5591.yaml"
|
|
},
|
|
"CVE-2019-6112": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09221,
|
|
"epss_pct": 0.94979,
|
|
"name": "WordPress Sell Media 2.4.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6112.yaml"
|
|
},
|
|
"CVE-2019-6340": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.92017,
|
|
"epss_pct": 0.99812,
|
|
"name": "Drupal - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6340.yaml"
|
|
},
|
|
"CVE-2019-6443": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-125",
|
|
"epss": 0.66881,
|
|
"epss_pct": 0.99236,
|
|
"name": "NTPsec > 1.1.3 - 'ctl_getitem' Out-of-Bounds Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2019/CVE-2019-6443.yaml"
|
|
},
|
|
"CVE-2019-6703": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.26076,
|
|
"epss_pct": 0.97838,
|
|
"name": "Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6703.yaml"
|
|
},
|
|
"CVE-2019-6715": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.19396,
|
|
"epss_pct": 0.9716,
|
|
"name": "W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6715.yaml"
|
|
},
|
|
"CVE-2019-6793": {
|
|
"cvss": 7.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03506,
|
|
"epss_pct": 0.88352,
|
|
"name": "GitLab Enterprise Edition - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6793.yaml"
|
|
},
|
|
"CVE-2019-6799": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.14829,
|
|
"epss_pct": 0.9644,
|
|
"name": "phpMyAdmin <4.8.5 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6799.yaml"
|
|
},
|
|
"CVE-2019-6802": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.03802,
|
|
"epss_pct": 0.89253,
|
|
"name": "Pypiserver <1.2.5 - Carriage Return Line Feed Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6802.yaml"
|
|
},
|
|
"CVE-2019-7139": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.17657,
|
|
"epss_pct": 0.9693,
|
|
"name": "Magento - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7139.yaml"
|
|
},
|
|
"CVE-2019-7192": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.88213,
|
|
"epss_pct": 0.99756,
|
|
"name": "QNAP QTS and Photo Station 6.0.3 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7192.yaml"
|
|
},
|
|
"CVE-2019-7194": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.83124,
|
|
"epss_pct": 0.99652,
|
|
"name": "QNAP Photo Station < 6.0.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7194.yaml"
|
|
},
|
|
"CVE-2019-7195": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.89681,
|
|
"epss_pct": 0.99777,
|
|
"name": "QNAP Photo Station - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7195.yaml"
|
|
},
|
|
"CVE-2019-7219": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05038,
|
|
"epss_pct": 0.91667,
|
|
"name": "Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7219.yaml"
|
|
},
|
|
"CVE-2019-7238": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.77146,
|
|
"epss_pct": 0.99517,
|
|
"name": "Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7238.yaml"
|
|
},
|
|
"CVE-2019-7254": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.82292,
|
|
"epss_pct": 0.99635,
|
|
"name": "eMerge E3 1.00-06 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7254.yaml"
|
|
},
|
|
"CVE-2019-7255": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.55807,
|
|
"epss_pct": 0.98968,
|
|
"name": "Linear eMerge E3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7255.yaml"
|
|
},
|
|
"CVE-2019-7256": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97136,
|
|
"epss_pct": 0.99888,
|
|
"name": "eMerge E3 1.00-06 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7256.yaml"
|
|
},
|
|
"CVE-2019-7275": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.09087,
|
|
"epss_pct": 0.94925,
|
|
"name": "Optergy Proton/Enterprise Building Management System - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7275.yaml"
|
|
},
|
|
"CVE-2019-7276": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.93384,
|
|
"epss_pct": 0.99832,
|
|
"name": "Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7276.yaml"
|
|
},
|
|
"CVE-2019-7315": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11198,
|
|
"epss_pct": 0.95638,
|
|
"name": "Genie Access WIP3BVAF IP Camera - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7315.yaml"
|
|
},
|
|
"CVE-2019-7481": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99906,
|
|
"epss_pct": 0.99965,
|
|
"name": "SonicWall SRA 4600 VPN - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7481.yaml"
|
|
},
|
|
"CVE-2019-7543": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03161,
|
|
"epss_pct": 0.8708,
|
|
"name": "KindEditor 4.1.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7543.yaml"
|
|
},
|
|
"CVE-2019-7609": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.95338,
|
|
"epss_pct": 0.9986,
|
|
"name": "Kibana Timelion - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7609.yaml"
|
|
},
|
|
"CVE-2019-8086": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.22541,
|
|
"epss_pct": 0.9754,
|
|
"name": "Adobe Experience Manager - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8086.yaml"
|
|
},
|
|
"CVE-2019-8390": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09836,
|
|
"epss_pct": 0.95208,
|
|
"name": "qdPM 9.1 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8390.yaml"
|
|
},
|
|
"CVE-2019-8442": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.59832,
|
|
"epss_pct": 0.99063,
|
|
"name": "Jira - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8442.yaml"
|
|
},
|
|
"CVE-2019-8446": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.1755,
|
|
"epss_pct": 0.96916,
|
|
"name": "Jira Improper Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8446.yaml"
|
|
},
|
|
"CVE-2019-8449": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.84771,
|
|
"epss_pct": 0.99691,
|
|
"name": "Jira <8.4.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8449.yaml"
|
|
},
|
|
"CVE-2019-8451": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.94453,
|
|
"epss_pct": 0.99845,
|
|
"name": "Jira <8.4.0 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8451.yaml"
|
|
},
|
|
"CVE-2019-8903": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.72058,
|
|
"epss_pct": 0.99385,
|
|
"name": "Totaljs <3.2.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8903.yaml"
|
|
},
|
|
"CVE-2019-8937": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10633,
|
|
"epss_pct": 0.95465,
|
|
"name": "HotelDruid 2.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8937.yaml"
|
|
},
|
|
"CVE-2019-8943": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.92642,
|
|
"epss_pct": 0.9982,
|
|
"name": "WordPress Core 5.0.0 - Crop-image Shell Upload",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8943.yaml"
|
|
},
|
|
"CVE-2019-8982": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.27963,
|
|
"epss_pct": 0.97959,
|
|
"name": "Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8982.yaml"
|
|
},
|
|
"CVE-2019-9041": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.31421,
|
|
"epss_pct": 0.98151,
|
|
"name": "ZZZCMS 1.6.1 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9041.yaml"
|
|
},
|
|
"CVE-2019-9082": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.97419,
|
|
"epss_pct": 0.99894,
|
|
"name": "ThinkPHP < 3.2.4 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9082.yaml"
|
|
},
|
|
"CVE-2019-9193": {
|
|
"epss": 0.91655,
|
|
"epss_pct": 0.99806,
|
|
"name": "PostgreSQL 9.3-12.3 Authenticated Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2019/CVE-2019-9193.yaml"
|
|
},
|
|
"CVE-2019-9194": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.9673,
|
|
"epss_pct": 0.99881,
|
|
"name": "elFinder <= 2.1.47 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9194.yaml"
|
|
},
|
|
"CVE-2019-9618": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.43796,
|
|
"epss_pct": 0.9865,
|
|
"name": "WordPress GraceMedia Media Player 1.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9618.yaml"
|
|
},
|
|
"CVE-2019-9621": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.81037,
|
|
"epss_pct": 0.99602,
|
|
"name": "Zimbra Collaboration Suite - SSRF",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9621.yaml"
|
|
},
|
|
"CVE-2019-9632": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.39885,
|
|
"epss_pct": 0.98521,
|
|
"name": "ESAFENET CDG - Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9632.yaml"
|
|
},
|
|
"CVE-2019-9670": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.99986,
|
|
"epss_pct": 0.99983,
|
|
"name": "Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9670.yaml"
|
|
},
|
|
"CVE-2019-9726": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16342,
|
|
"epss_pct": 0.9673,
|
|
"name": "Homematic CCU3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9726.yaml"
|
|
},
|
|
"CVE-2019-9733": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.52948,
|
|
"epss_pct": 0.98897,
|
|
"name": "JFrog Artifactory 6.7.3 - Admin Login Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9733.yaml"
|
|
},
|
|
"CVE-2019-9757": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.37336,
|
|
"epss_pct": 0.98416,
|
|
"name": "LabKey Server 19.1.0 - XML External Entity (XXE)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9757.yaml"
|
|
},
|
|
"CVE-2019-9762": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06041,
|
|
"epss_pct": 0.92848,
|
|
"name": "PHPSHE 1.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9762.yaml"
|
|
},
|
|
"CVE-2019-9874": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.83736,
|
|
"epss_pct": 0.99669,
|
|
"name": "Sitecore Experience Platform - Deserialization of Untrusted Data",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9874.yaml"
|
|
},
|
|
"CVE-2019-9879": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.46614,
|
|
"epss_pct": 0.98735,
|
|
"name": "WPGraphQL 0.2.3 - User Creation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9879.yaml"
|
|
},
|
|
"CVE-2019-9880": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.34761,
|
|
"epss_pct": 0.98308,
|
|
"name": "WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9880.yaml"
|
|
},
|
|
"CVE-2019-9881": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.18832,
|
|
"epss_pct": 0.97077,
|
|
"name": "WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9881.yaml"
|
|
},
|
|
"CVE-2019-9912": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03151,
|
|
"epss_pct": 0.87034,
|
|
"name": "WP Google Maps < 7.10.43 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9912.yaml"
|
|
},
|
|
"CVE-2019-9915": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03626,
|
|
"epss_pct": 0.88705,
|
|
"name": "GetSimple CMS 3.3.13 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9915.yaml"
|
|
},
|
|
"CVE-2019-9922": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1059,
|
|
"epss_pct": 0.95452,
|
|
"name": "Joomla! Harmis Messenger 1.2.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9922.yaml"
|
|
},
|
|
"CVE-2019-9955": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.2118,
|
|
"epss_pct": 0.97409,
|
|
"name": "Zyxel - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9955.yaml"
|
|
},
|
|
"CVE-2019-9978": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.72946,
|
|
"epss_pct": 0.99411,
|
|
"name": "WordPress Social Warfare <3.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml"
|
|
},
|
|
"CVE-2020-0618": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99022,
|
|
"epss_pct": 0.99928,
|
|
"name": "Microsoft SQL Server Reporting Services - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-0618.yaml"
|
|
},
|
|
"CVE-2020-0646": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-91",
|
|
"epss": 0.99222,
|
|
"epss_pct": 0.99933,
|
|
"name": "Microsoft .NET Framework - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2020/CVE-2020-0646.yaml"
|
|
},
|
|
"CVE-2020-0796": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.9981,
|
|
"epss_pct": 0.99957,
|
|
"name": "Microsoft SMBv3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-0796.yaml"
|
|
},
|
|
"CVE-2020-10148": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.9198,
|
|
"epss_pct": 0.99811,
|
|
"name": "SolarWinds Orion API - Auth Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10148.yaml"
|
|
},
|
|
"CVE-2020-10189": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99941,
|
|
"epss_pct": 0.99971,
|
|
"name": "ManageEngine Desktop Central Java Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10189.yaml"
|
|
},
|
|
"CVE-2020-10199": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.99064,
|
|
"epss_pct": 0.99929,
|
|
"name": "Sonatype Nexus Repository Manager 3 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10199.yaml"
|
|
},
|
|
"CVE-2020-10204": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.38166,
|
|
"epss_pct": 0.9845,
|
|
"name": "Sonatype Nexus Repository Manager 3 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10204.yaml"
|
|
},
|
|
"CVE-2020-10220": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99683,
|
|
"epss_pct": 0.99949,
|
|
"name": "rConfig 3.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10220.yaml"
|
|
},
|
|
"CVE-2020-10221": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.80221,
|
|
"epss_pct": 0.99587,
|
|
"name": "rConfig <= 3.9.4 - Authenticated OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10221.yaml"
|
|
},
|
|
"CVE-2020-10257": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.08877,
|
|
"epss_pct": 0.9484,
|
|
"name": "ThemeREX Addons - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10257.yaml"
|
|
},
|
|
"CVE-2020-10532": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.02785,
|
|
"epss_pct": 0.85385,
|
|
"name": "WatchGuard Fireware AD Helper Component - Credentials Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10532.yaml"
|
|
},
|
|
"CVE-2020-10546": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.8733,
|
|
"epss_pct": 0.99741,
|
|
"name": "rConfig 3.9.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10546.yaml"
|
|
},
|
|
"CVE-2020-10547": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.33266,
|
|
"epss_pct": 0.98246,
|
|
"name": "rConfig 3.9.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10547.yaml"
|
|
},
|
|
"CVE-2020-10548": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.37732,
|
|
"epss_pct": 0.98435,
|
|
"name": "rConfig 3.9.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10548.yaml"
|
|
},
|
|
"CVE-2020-10549": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.32124,
|
|
"epss_pct": 0.98189,
|
|
"name": "rConfig <=3.9.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10549.yaml"
|
|
},
|
|
"CVE-2020-10770": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.69724,
|
|
"epss_pct": 0.99318,
|
|
"name": "Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10770.yaml"
|
|
},
|
|
"CVE-2020-10973": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.07552,
|
|
"epss_pct": 0.94077,
|
|
"name": "WAVLINK - Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10973.yaml"
|
|
},
|
|
"CVE-2020-10987": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.7981,
|
|
"epss_pct": 0.99579,
|
|
"name": "Tenda AC15 AC1900 version 15.03.05.19 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10987.yaml"
|
|
},
|
|
"CVE-2020-11034": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.07574,
|
|
"epss_pct": 0.94091,
|
|
"name": "GLPI <9.4.6 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11034.yaml"
|
|
},
|
|
"CVE-2020-11110": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09619,
|
|
"epss_pct": 0.9513,
|
|
"name": "Grafana <= 6.7.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11110.yaml"
|
|
},
|
|
"CVE-2020-11441": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-93",
|
|
"epss": 0.02406,
|
|
"epss_pct": 0.82902,
|
|
"name": "phpMyAdmin 5.0.2 - CRLF Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11441.yaml"
|
|
},
|
|
"CVE-2020-11450": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.17841,
|
|
"epss_pct": 0.96952,
|
|
"name": "MicroStrategy Web 10.4 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11450.yaml"
|
|
},
|
|
"CVE-2020-11455": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97179,
|
|
"epss_pct": 0.99889,
|
|
"name": "LimeSurvey 4.1.11 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11455.yaml"
|
|
},
|
|
"CVE-2020-11514": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.09106,
|
|
"epss_pct": 0.94932,
|
|
"name": "Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11514.yaml"
|
|
},
|
|
"CVE-2020-11515": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02072,
|
|
"epss_pct": 0.80104,
|
|
"name": "Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11515.yaml"
|
|
},
|
|
"CVE-2020-11529": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.10879,
|
|
"epss_pct": 0.95542,
|
|
"name": "Grav < 1.7 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11529.yaml"
|
|
},
|
|
"CVE-2020-11530": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.95657,
|
|
"epss_pct": 0.99866,
|
|
"name": "WordPress Chop Slider 3 - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11530.yaml"
|
|
},
|
|
"CVE-2020-11546": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.32841,
|
|
"epss_pct": 0.98229,
|
|
"name": "SuperWebmailer 7.21.0.01526 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11546.yaml"
|
|
},
|
|
"CVE-2020-11547": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.52059,
|
|
"epss_pct": 0.98872,
|
|
"name": "PRTG Network Monitor <20.1.57.1745 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11547.yaml"
|
|
},
|
|
"CVE-2020-11710": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.33127,
|
|
"epss_pct": 0.98241,
|
|
"name": "Kong Admin <=2.03 - Admin API Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11710.yaml"
|
|
},
|
|
"CVE-2020-11732": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.04917,
|
|
"epss_pct": 0.91492,
|
|
"name": "Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11732.yaml"
|
|
},
|
|
"CVE-2020-11738": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97822,
|
|
"epss_pct": 0.999,
|
|
"name": "WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11738.yaml"
|
|
},
|
|
"CVE-2020-11798": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.48771,
|
|
"epss_pct": 0.98789,
|
|
"name": "Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11798.yaml"
|
|
},
|
|
"CVE-2020-11853": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.7699,
|
|
"epss_pct": 0.99514,
|
|
"name": "Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11853.yaml"
|
|
},
|
|
"CVE-2020-11854": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.74449,
|
|
"epss_pct": 0.99454,
|
|
"name": "Micro Focus UCMDB - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11854.yaml"
|
|
},
|
|
"CVE-2020-11930": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04457,
|
|
"epss_pct": 0.90742,
|
|
"name": "WordPress GTranslate <2.8.52 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11930.yaml"
|
|
},
|
|
"CVE-2020-11975": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.29885,
|
|
"epss_pct": 0.9807,
|
|
"name": "Apache Unomi - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11975.yaml"
|
|
},
|
|
"CVE-2020-11978": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99189,
|
|
"epss_pct": 0.99932,
|
|
"name": "Apache Airflow <=1.10.10 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11978.yaml"
|
|
},
|
|
"CVE-2020-11981": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.36537,
|
|
"epss_pct": 0.9838,
|
|
"name": "Apache Airflow <=1.10.10 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-11981.yaml"
|
|
},
|
|
"CVE-2020-11984": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-120",
|
|
"epss": 0.90039,
|
|
"epss_pct": 0.99785,
|
|
"name": "Apache HTTP Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11984.yaml"
|
|
},
|
|
"CVE-2020-11991": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.72456,
|
|
"epss_pct": 0.99397,
|
|
"name": "Apache Cocoon 2.1.12 - XML Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11991.yaml"
|
|
},
|
|
"CVE-2020-12054": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03611,
|
|
"epss_pct": 0.88663,
|
|
"name": "WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12054.yaml"
|
|
},
|
|
"CVE-2020-12116": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97418,
|
|
"epss_pct": 0.99894,
|
|
"name": "Zoho ManageEngine OpManger - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12116.yaml"
|
|
},
|
|
"CVE-2020-12124": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.7465,
|
|
"epss_pct": 0.99462,
|
|
"name": "WAVLINK WN530H4 live_api.cgi - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12124.yaml"
|
|
},
|
|
"CVE-2020-12127": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.07401,
|
|
"epss_pct": 0.93986,
|
|
"name": "WAVLINK WN530H4 M30H4.V5030.190403 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12127.yaml"
|
|
},
|
|
"CVE-2020-12256": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.95752,
|
|
"epss_pct": 0.99866,
|
|
"name": "rConfig 3.9.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12256.yaml"
|
|
},
|
|
"CVE-2020-12259": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.96179,
|
|
"epss_pct": 0.99872,
|
|
"name": "rConfig 3.9.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12259.yaml"
|
|
},
|
|
"CVE-2020-12262": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01711,
|
|
"epss_pct": 0.75729,
|
|
"name": "Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12262.yaml"
|
|
},
|
|
"CVE-2020-12447": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13704,
|
|
"epss_pct": 0.96218,
|
|
"name": "Onkyo TX-NR585 Web Interface - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12447.yaml"
|
|
},
|
|
"CVE-2020-12478": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.08392,
|
|
"epss_pct": 0.94574,
|
|
"name": "TeamPass 2.1.27.36 - Improper Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12478.yaml"
|
|
},
|
|
"CVE-2020-12641": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.84456,
|
|
"epss_pct": 0.99683,
|
|
"name": "Roundcube Webmail - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12641.yaml"
|
|
},
|
|
"CVE-2020-12720": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.88948,
|
|
"epss_pct": 0.99768,
|
|
"name": "vBulletin SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12720.yaml"
|
|
},
|
|
"CVE-2020-12800": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.78751,
|
|
"epss_pct": 0.99559,
|
|
"name": "WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12800.yaml"
|
|
},
|
|
"CVE-2020-12832": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07131,
|
|
"epss_pct": 0.93796,
|
|
"name": "WordPress Simple File List - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12832.yaml"
|
|
},
|
|
"CVE-2020-13117": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.68794,
|
|
"epss_pct": 0.99292,
|
|
"name": "Wavlink Multiple AP - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13117.yaml"
|
|
},
|
|
"CVE-2020-13121": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02956,
|
|
"epss_pct": 0.86212,
|
|
"name": "Submitty <= 20.04.01 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13121.yaml"
|
|
},
|
|
"CVE-2020-13125": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"epss": 0.02307,
|
|
"epss_pct": 0.82145,
|
|
"name": "Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13125.yaml"
|
|
},
|
|
"CVE-2020-13158": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.53973,
|
|
"epss_pct": 0.98926,
|
|
"name": "Artica Proxy Community Edition <4.30.000000 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13158.yaml"
|
|
},
|
|
"CVE-2020-13167": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.95415,
|
|
"epss_pct": 0.99862,
|
|
"name": "Netsweeper <=6.4.3 - Python Code Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13167.yaml"
|
|
},
|
|
"CVE-2020-13258": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02063,
|
|
"epss_pct": 0.8001,
|
|
"name": "Contentful <=2020-05-21 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13258.yaml"
|
|
},
|
|
"CVE-2020-13379": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.99856,
|
|
"epss_pct": 0.9996,
|
|
"name": "Grafana 3.0.1-7.0.1 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13379.yaml"
|
|
},
|
|
"CVE-2020-13405": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.13614,
|
|
"epss_pct": 0.96193,
|
|
"name": "Microweber <1.1.20 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13405.yaml"
|
|
},
|
|
"CVE-2020-13483": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04511,
|
|
"epss_pct": 0.90833,
|
|
"name": "Bitrix24 <=20.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13483.yaml"
|
|
},
|
|
"CVE-2020-13638": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.76601,
|
|
"epss_pct": 0.99505,
|
|
"name": "rConfig 3.9 - Authentication Bypass(Admin Login)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13638.yaml"
|
|
},
|
|
"CVE-2020-13640": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12605,
|
|
"epss_pct": 0.95953,
|
|
"name": "wpDiscuz <= 5.3.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13640.yaml"
|
|
},
|
|
"CVE-2020-13700": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.13463,
|
|
"epss_pct": 0.96159,
|
|
"name": "WordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13700.yaml"
|
|
},
|
|
"CVE-2020-13820": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04178,
|
|
"epss_pct": 0.90193,
|
|
"name": "Extreme Management Center 8.4.1.24 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13820.yaml"
|
|
},
|
|
"CVE-2020-13851": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.91095,
|
|
"epss_pct": 0.99799,
|
|
"name": "Artica Pandora FMS 7.44 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13851.yaml"
|
|
},
|
|
"CVE-2020-13886": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05198,
|
|
"epss_pct": 0.91888,
|
|
"name": "Intelbras TIP 200/200 LITE/300 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13886.yaml"
|
|
},
|
|
"CVE-2020-13927": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.99778,
|
|
"epss_pct": 0.99955,
|
|
"name": "Airflow Experimental <1.10.11 - REST API Auth Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13927.yaml"
|
|
},
|
|
"CVE-2020-13935": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.86608,
|
|
"epss_pct": 0.99724,
|
|
"name": "Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2020/CVE-2020-13935.yaml"
|
|
},
|
|
"CVE-2020-13937": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-922",
|
|
"epss": 0.78331,
|
|
"epss_pct": 0.99547,
|
|
"name": "Apache Kylin - Exposed Configuration File",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13937.yaml"
|
|
},
|
|
"CVE-2020-13942": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.68398,
|
|
"epss_pct": 0.9928,
|
|
"name": "Apache Unomi <1.5.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13942.yaml"
|
|
},
|
|
"CVE-2020-13945": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.72976,
|
|
"epss_pct": 0.99412,
|
|
"name": "Apache APISIX - Insufficiently Protected Credentials",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13945.yaml"
|
|
},
|
|
"CVE-2020-14092": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.9453,
|
|
"epss_pct": 0.99846,
|
|
"name": "WordPress PayPal Pro <1.1.65 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14092.yaml"
|
|
},
|
|
"CVE-2020-14144": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.95357,
|
|
"epss_pct": 0.99862,
|
|
"name": "Gitea 1.1.0 - 1.12.5 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14144.yaml"
|
|
},
|
|
"CVE-2020-14179": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.76042,
|
|
"epss_pct": 0.99493,
|
|
"name": "Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14179.yaml"
|
|
},
|
|
"CVE-2020-14181": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.99603,
|
|
"epss_pct": 0.99945,
|
|
"name": "Jira Server and Data Center - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14181.yaml"
|
|
},
|
|
"CVE-2020-14408": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03003,
|
|
"epss_pct": 0.86429,
|
|
"name": "Agentejo Cockpit 0.10.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14408.yaml"
|
|
},
|
|
"CVE-2020-14413": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03442,
|
|
"epss_pct": 0.88143,
|
|
"name": "NeDi 1.9C - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14413.yaml"
|
|
},
|
|
"CVE-2020-14644": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.94548,
|
|
"epss_pct": 0.99847,
|
|
"name": "Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-14644.yaml"
|
|
},
|
|
"CVE-2020-14750": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.9927,
|
|
"epss_pct": 0.99935,
|
|
"name": "Oracle WebLogic Server - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14750.yaml"
|
|
},
|
|
"CVE-2020-14864": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97233,
|
|
"epss_pct": 0.99889,
|
|
"name": "Oracle Fusion - Directory Traversal/Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14864.yaml"
|
|
},
|
|
"CVE-2020-14882": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99997,
|
|
"epss_pct": 0.99989,
|
|
"name": "Oracle Weblogic Server - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14882.yaml"
|
|
},
|
|
"CVE-2020-14883": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.97929,
|
|
"epss_pct": 0.99906,
|
|
"name": "Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14883.yaml"
|
|
},
|
|
"CVE-2020-15050": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.50734,
|
|
"epss_pct": 0.98839,
|
|
"name": "Suprema BioStar <2.8.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15050.yaml"
|
|
},
|
|
"CVE-2020-15081": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-548",
|
|
"epss": 0.01648,
|
|
"epss_pct": 0.74801,
|
|
"name": "PrestaShop < 1.7.6.6 - Information Exposure via Upload Directory",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15081.yaml"
|
|
},
|
|
"CVE-2020-15129": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.08011,
|
|
"epss_pct": 0.94351,
|
|
"name": "Traefik - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15129.yaml"
|
|
},
|
|
"CVE-2020-15148": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.78759,
|
|
"epss_pct": 0.99559,
|
|
"name": "Yii 2 < 2.0.38 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15148.yaml"
|
|
},
|
|
"CVE-2020-15227": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.34424,
|
|
"epss_pct": 0.98295,
|
|
"name": "Nette Framework - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15227.yaml"
|
|
},
|
|
"CVE-2020-15415": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.8448,
|
|
"epss_pct": 0.99683,
|
|
"name": "DrayTek Vigor - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15415.yaml"
|
|
},
|
|
"CVE-2020-15500": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12224,
|
|
"epss_pct": 0.95875,
|
|
"name": "TileServer GL <=3.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15500.yaml"
|
|
},
|
|
"CVE-2020-15505": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-706",
|
|
"epss": 0.99737,
|
|
"epss_pct": 0.99952,
|
|
"name": "MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15505.yaml"
|
|
},
|
|
"CVE-2020-15568": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-913",
|
|
"epss": 0.28984,
|
|
"epss_pct": 0.98023,
|
|
"name": "TerraMaster TOS <.1.29 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15568.yaml"
|
|
},
|
|
"CVE-2020-15718": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06354,
|
|
"epss_pct": 0.93146,
|
|
"name": "RosarioSIS 6.7.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15718.yaml"
|
|
},
|
|
"CVE-2020-15867": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.87416,
|
|
"epss_pct": 0.99743,
|
|
"name": "Gogs 0.5.5 - 0.12.2 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15867.yaml"
|
|
},
|
|
"CVE-2020-15895": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02848,
|
|
"epss_pct": 0.85714,
|
|
"name": "D-Link DIR-816L 2.x - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15895.yaml"
|
|
},
|
|
"CVE-2020-15906": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-307",
|
|
"epss": 0.2716,
|
|
"epss_pct": 0.97909,
|
|
"name": "Tiki Wiki CMS GroupWare - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15906.yaml"
|
|
},
|
|
"CVE-2020-15920": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.98239,
|
|
"epss_pct": 0.99911,
|
|
"name": "Mida eFramework <=2.9.0 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15920.yaml"
|
|
},
|
|
"CVE-2020-16139": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.7977,
|
|
"epss_pct": 0.99577,
|
|
"name": "Cisco Unified IP Conference Station 7937G - Denial-of-Service",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16139.yaml"
|
|
},
|
|
"CVE-2020-16248": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02698,
|
|
"epss_pct": 0.84865,
|
|
"name": "Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16248.yaml"
|
|
},
|
|
"CVE-2020-16846": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99585,
|
|
"epss_pct": 0.99944,
|
|
"name": "SaltStack <=3002 - Shell Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16846.yaml"
|
|
},
|
|
"CVE-2020-16952": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-346",
|
|
"epss": 0.71095,
|
|
"epss_pct": 0.99359,
|
|
"name": "Microsoft SharePoint - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16952.yaml"
|
|
},
|
|
"CVE-2020-17362": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02873,
|
|
"epss_pct": 0.85834,
|
|
"name": "Nova Lite < 1.3.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17362.yaml"
|
|
},
|
|
"CVE-2020-17453": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.26225,
|
|
"epss_pct": 0.97848,
|
|
"name": "WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17453.yaml"
|
|
},
|
|
"CVE-2020-17456": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.73635,
|
|
"epss_pct": 0.9943,
|
|
"name": "SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17456.yaml"
|
|
},
|
|
"CVE-2020-17463": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.89689,
|
|
"epss_pct": 0.99777,
|
|
"name": "Fuel CMS 1.4.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17463.yaml"
|
|
},
|
|
"CVE-2020-17496": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.8774,
|
|
"epss_pct": 0.99748,
|
|
"name": "vBulletin 5.5.4 - 5.6.2- Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17496.yaml"
|
|
},
|
|
"CVE-2020-17505": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.82165,
|
|
"epss_pct": 0.99631,
|
|
"name": "Artica Web Proxy 4.30 - OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17505.yaml"
|
|
},
|
|
"CVE-2020-17506": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.93967,
|
|
"epss_pct": 0.99837,
|
|
"name": "Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17506.yaml"
|
|
},
|
|
"CVE-2020-17518": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"epss": 0.50038,
|
|
"epss_pct": 0.98817,
|
|
"name": "Apache Flink 1.5.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17518.yaml"
|
|
},
|
|
"CVE-2020-17519": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.97856,
|
|
"epss_pct": 0.99902,
|
|
"name": "Apache Flink - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17519.yaml"
|
|
},
|
|
"CVE-2020-17526": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.23336,
|
|
"epss_pct": 0.97613,
|
|
"name": "Apache Airflow <1.10.14 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17526.yaml"
|
|
},
|
|
"CVE-2020-17530": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.95931,
|
|
"epss_pct": 0.99869,
|
|
"name": "Apache Struts 2.0.0-2.5.25 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17530.yaml"
|
|
},
|
|
"CVE-2020-18268": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02687,
|
|
"epss_pct": 0.84801,
|
|
"name": "Z-Blog <=1.5.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-18268.yaml"
|
|
},
|
|
"CVE-2020-19282": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03162,
|
|
"epss_pct": 0.87085,
|
|
"name": "Jeesns 1.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19282.yaml"
|
|
},
|
|
"CVE-2020-19283": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02633,
|
|
"epss_pct": 0.84462,
|
|
"name": "Jeesns 1.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19283.yaml"
|
|
},
|
|
"CVE-2020-19295": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03509,
|
|
"epss_pct": 0.88362,
|
|
"name": "Jeesns 1.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19295.yaml"
|
|
},
|
|
"CVE-2020-19360": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19722,
|
|
"epss_pct": 0.97208,
|
|
"name": "FHEM 6.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19360.yaml"
|
|
},
|
|
"CVE-2020-19363": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03613,
|
|
"epss_pct": 0.88669,
|
|
"name": "Vtiger CRM v7.2.0 - Directory Listing",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19363.yaml"
|
|
},
|
|
"CVE-2020-1938": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.9927,
|
|
"epss_pct": 0.99935,
|
|
"name": "Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-1938.yaml"
|
|
},
|
|
"CVE-2020-1943": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.97309,
|
|
"epss_pct": 0.99891,
|
|
"name": "Apache OFBiz <=16.11.07 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-1943.yaml"
|
|
},
|
|
"CVE-2020-19515": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01789,
|
|
"epss_pct": 0.76775,
|
|
"name": "qdPM 9.1 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19515.yaml"
|
|
},
|
|
"CVE-2020-1956": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97337,
|
|
"epss_pct": 0.99892,
|
|
"name": "Apache Kylin 3.0.1 - Command Injection Vulnerability",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-1956.yaml"
|
|
},
|
|
"CVE-2020-19625": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.13143,
|
|
"epss_pct": 0.96081,
|
|
"name": "Gridx 1.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-19625.yaml"
|
|
},
|
|
"CVE-2020-20285": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01407,
|
|
"epss_pct": 0.70721,
|
|
"name": "ZZcms - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20285.yaml"
|
|
},
|
|
"CVE-2020-20300": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08752,
|
|
"epss_pct": 0.94776,
|
|
"name": "WeiPHP 5.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20300.yaml"
|
|
},
|
|
"CVE-2020-2036": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.2389,
|
|
"epss_pct": 0.97663,
|
|
"name": "Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2036.yaml"
|
|
},
|
|
"CVE-2020-20601": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.07598,
|
|
"epss_pct": 0.94111,
|
|
"name": "ThinkCMF X2.2.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20601.yaml"
|
|
},
|
|
"CVE-2020-20627": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.01881,
|
|
"epss_pct": 0.77979,
|
|
"name": "GiveWP - Missing Authorization to Settings Update",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20627.yaml"
|
|
},
|
|
"CVE-2020-2096": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.9279,
|
|
"epss_pct": 0.99821,
|
|
"name": "Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2096.yaml"
|
|
},
|
|
"CVE-2020-20982": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06191,
|
|
"epss_pct": 0.92991,
|
|
"name": "shadoweb wdja v1.5.1 - Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20982.yaml"
|
|
},
|
|
"CVE-2020-20988": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01331,
|
|
"epss_pct": 0.69102,
|
|
"name": "DomainMOD 4.13.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20988.yaml"
|
|
},
|
|
"CVE-2020-2103": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.07044,
|
|
"epss_pct": 0.93727,
|
|
"name": "Jenkins <=2.218 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2103.yaml"
|
|
},
|
|
"CVE-2020-21224": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-88",
|
|
"epss": 0.38745,
|
|
"epss_pct": 0.98475,
|
|
"name": "Inspur ClusterEngine 4.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21224.yaml"
|
|
},
|
|
"CVE-2020-2140": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.75975,
|
|
"epss_pct": 0.99491,
|
|
"name": "Jenkin Audit Trail <=3.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2140.yaml"
|
|
},
|
|
"CVE-2020-21998": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01319,
|
|
"epss_pct": 0.68824,
|
|
"name": "HomeAutomation 3.3.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21998.yaml"
|
|
},
|
|
"CVE-2020-22165": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06348,
|
|
"epss_pct": 0.93143,
|
|
"name": "PHPGurukul Hospital Management System 4.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22165.yaml"
|
|
},
|
|
"CVE-2020-22208": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10017,
|
|
"epss_pct": 0.95272,
|
|
"name": "74cms - ajax_street.php 'x' SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22208.yaml"
|
|
},
|
|
"CVE-2020-22209": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08579,
|
|
"epss_pct": 0.9468,
|
|
"name": "74cms - ajax_common.php SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22209.yaml"
|
|
},
|
|
"CVE-2020-22210": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08579,
|
|
"epss_pct": 0.9468,
|
|
"name": "74cms - ajax_officebuilding.php SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22210.yaml"
|
|
},
|
|
"CVE-2020-22211": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0794,
|
|
"epss_pct": 0.94319,
|
|
"name": "74cms - ajax_street.php 'key' SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22211.yaml"
|
|
},
|
|
"CVE-2020-22840": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.13817,
|
|
"epss_pct": 0.96243,
|
|
"name": "b2evolution CMS <6.11.6 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-22840.yaml"
|
|
},
|
|
"CVE-2020-23015": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02689,
|
|
"epss_pct": 0.84811,
|
|
"name": "OPNsense <=20.1.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23015.yaml"
|
|
},
|
|
"CVE-2020-23517": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07051,
|
|
"epss_pct": 0.93732,
|
|
"name": "Aryanic HighMail (High CMS) - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23517.yaml"
|
|
},
|
|
"CVE-2020-23575": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.36765,
|
|
"epss_pct": 0.98389,
|
|
"name": "Kyocera Printer d-COPIA253MF - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23575.yaml"
|
|
},
|
|
"CVE-2020-23697": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01885,
|
|
"epss_pct": 0.78033,
|
|
"name": "Monstra CMS 3.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23697.yaml"
|
|
},
|
|
"CVE-2020-23814": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01188,
|
|
"epss_pct": 0.65687,
|
|
"name": "XXL-JOB v2.2.0 \u2014 Stored Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23814.yaml"
|
|
},
|
|
"CVE-2020-23972": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.31444,
|
|
"epss_pct": 0.98153,
|
|
"name": "Joomla! Component GMapFP 3.5 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23972.yaml"
|
|
},
|
|
"CVE-2020-24148": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.14745,
|
|
"epss_pct": 0.96426,
|
|
"name": "Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24148.yaml"
|
|
},
|
|
"CVE-2020-24186": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.94616,
|
|
"epss_pct": 0.99849,
|
|
"name": "WordPress wpDiscuz <=7.0.4 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24186.yaml"
|
|
},
|
|
"CVE-2020-24223": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.14552,
|
|
"epss_pct": 0.96388,
|
|
"name": "Mara CMS 7.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24223.yaml"
|
|
},
|
|
"CVE-2020-24285": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.04412,
|
|
"epss_pct": 0.90646,
|
|
"name": "INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24285.yaml"
|
|
},
|
|
"CVE-2020-24312": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.15906,
|
|
"epss_pct": 0.9665,
|
|
"name": "WordPress Plugin File Manager (wp-file-manager) Backup Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24312.yaml"
|
|
},
|
|
"CVE-2020-24391": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.74519,
|
|
"epss_pct": 0.99457,
|
|
"name": "Mongo-Express - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24391.yaml"
|
|
},
|
|
"CVE-2020-24550": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04719,
|
|
"epss_pct": 0.91187,
|
|
"name": "EpiServer Find <13.2.7 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24550.yaml"
|
|
},
|
|
"CVE-2020-24571": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17959,
|
|
"epss_pct": 0.96967,
|
|
"name": "NexusDB <4.50.23 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24571.yaml"
|
|
},
|
|
"CVE-2020-24579": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.09997,
|
|
"epss_pct": 0.95265,
|
|
"name": "D-Link DSL 2888a - Authentication Bypass/Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24579.yaml"
|
|
},
|
|
"CVE-2020-24589": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.26282,
|
|
"epss_pct": 0.9785,
|
|
"name": "WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24589.yaml"
|
|
},
|
|
"CVE-2020-24701": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06788,
|
|
"epss_pct": 0.93514,
|
|
"name": "OX Appsuite - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24701.yaml"
|
|
},
|
|
"CVE-2020-24881": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.73267,
|
|
"epss_pct": 0.99418,
|
|
"name": "OsTicket < 1.14.3 - Server Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24881.yaml"
|
|
},
|
|
"CVE-2020-24902": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02852,
|
|
"epss_pct": 0.85734,
|
|
"name": "Quixplorer <=2.4.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24902.yaml"
|
|
},
|
|
"CVE-2020-24903": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02932,
|
|
"epss_pct": 0.86111,
|
|
"name": "Cute Editor for ASP.NET 6.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24903.yaml"
|
|
},
|
|
"CVE-2020-24912": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0634,
|
|
"epss_pct": 0.93136,
|
|
"name": "QCube Cross-Site-Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24912.yaml"
|
|
},
|
|
"CVE-2020-24949": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.67516,
|
|
"epss_pct": 0.99255,
|
|
"name": "PHP-Fusion 9.03.50 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24949.yaml"
|
|
},
|
|
"CVE-2020-25078": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.97901,
|
|
"epss_pct": 0.99904,
|
|
"name": "D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25078.yaml"
|
|
},
|
|
"CVE-2020-25200": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.0747,
|
|
"epss_pct": 0.94025,
|
|
"name": "Pritunl VPN Server 1.29.2145.25 - Username Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25200.yaml"
|
|
},
|
|
"CVE-2020-25213": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.97328,
|
|
"epss_pct": 0.99893,
|
|
"name": "WordPress File Manager Plugin - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25213.yaml"
|
|
},
|
|
"CVE-2020-25223": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.96693,
|
|
"epss_pct": 0.99881,
|
|
"name": "Sophos UTM Preauth - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25223.yaml"
|
|
},
|
|
"CVE-2020-25495": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08981,
|
|
"epss_pct": 0.94886,
|
|
"name": "Xinuo Openserver 5/6 - Cross-Site scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25495.yaml"
|
|
},
|
|
"CVE-2020-25506": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99968,
|
|
"epss_pct": 0.99976,
|
|
"name": "D-Link DNS-320 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25506.yaml"
|
|
},
|
|
"CVE-2020-2551": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.93168,
|
|
"epss_pct": 0.99827,
|
|
"name": "Oracle WebLogic Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2551.yaml"
|
|
},
|
|
"CVE-2020-25540": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.75332,
|
|
"epss_pct": 0.99477,
|
|
"name": "ThinkAdmin 6 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25540.yaml"
|
|
},
|
|
"CVE-2020-25780": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09884,
|
|
"epss_pct": 0.95225,
|
|
"name": "Commvault CommCell - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25780.yaml"
|
|
},
|
|
"CVE-2020-25864": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06085,
|
|
"epss_pct": 0.92899,
|
|
"name": "HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25864.yaml"
|
|
},
|
|
"CVE-2020-26073": {
|
|
"epss": 0.12583,
|
|
"epss_pct": 0.95947,
|
|
"name": "Cisco SD-WAN vManage Software - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26073.yaml"
|
|
},
|
|
"CVE-2020-26153": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04378,
|
|
"epss_pct": 0.90592,
|
|
"name": "Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26153.yaml"
|
|
},
|
|
"CVE-2020-26214": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.65933,
|
|
"epss_pct": 0.99215,
|
|
"name": "Alerta < 8.1.0 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26214.yaml"
|
|
},
|
|
"CVE-2020-26217": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.85001,
|
|
"epss_pct": 0.99696,
|
|
"name": "XStream <1.4.14 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26217.yaml"
|
|
},
|
|
"CVE-2020-26248": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12388,
|
|
"epss_pct": 0.95911,
|
|
"name": "PrestaShop Product Comments <4.2.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26248.yaml"
|
|
},
|
|
"CVE-2020-26258": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.81817,
|
|
"epss_pct": 0.9962,
|
|
"name": "XStream <1.4.15 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26258.yaml"
|
|
},
|
|
"CVE-2020-26413": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.34931,
|
|
"epss_pct": 0.98316,
|
|
"name": "Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26413.yaml"
|
|
},
|
|
"CVE-2020-26836": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02338,
|
|
"epss_pct": 0.82405,
|
|
"name": "SAP Solution Manager - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26836.yaml"
|
|
},
|
|
"CVE-2020-26876": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.10551,
|
|
"epss_pct": 0.95443,
|
|
"name": "WordPress WP Courses Plugin Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26876.yaml"
|
|
},
|
|
"CVE-2020-26879": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.45083,
|
|
"epss_pct": 0.9869,
|
|
"name": "Ruckus vRioT IoT Controller - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26879.yaml"
|
|
},
|
|
"CVE-2020-26919": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.57195,
|
|
"epss_pct": 0.99002,
|
|
"name": "NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26919.yaml"
|
|
},
|
|
"CVE-2020-26935": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.67081,
|
|
"epss_pct": 0.99243,
|
|
"name": "phpMyAdmin < 5.0.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26935.yaml"
|
|
},
|
|
"CVE-2020-26948": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.87154,
|
|
"epss_pct": 0.99736,
|
|
"name": "Emby < 4.5.0 - Server Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26948.yaml"
|
|
},
|
|
"CVE-2020-27191": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09595,
|
|
"epss_pct": 0.95124,
|
|
"name": "LionWiki <3.2.12 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27191.yaml"
|
|
},
|
|
"CVE-2020-2733": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.18645,
|
|
"epss_pct": 0.97055,
|
|
"name": "JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2733.yaml"
|
|
},
|
|
"CVE-2020-27361": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.06769,
|
|
"epss_pct": 0.93504,
|
|
"name": "Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27361.yaml"
|
|
},
|
|
"CVE-2020-27467": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15737,
|
|
"epss_pct": 0.96619,
|
|
"name": "Processwire CMS <2.7.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27467.yaml"
|
|
},
|
|
"CVE-2020-27481": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10027,
|
|
"epss_pct": 0.95274,
|
|
"name": "Good Layers LMS Plugin <= 2.1.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27481.yaml"
|
|
},
|
|
"CVE-2020-27615": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.52261,
|
|
"epss_pct": 0.98877,
|
|
"name": "WordPress Loginizer < 1.6.4 \u2013 Unauthenticated SQL Injection via `log` Parameter",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27615.yaml"
|
|
},
|
|
"CVE-2020-27735": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0579,
|
|
"epss_pct": 0.92572,
|
|
"name": "Wing FTP 6.4.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27735.yaml"
|
|
},
|
|
"CVE-2020-27838": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.17943,
|
|
"epss_pct": 0.96966,
|
|
"name": "KeyCloak - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27838.yaml"
|
|
},
|
|
"CVE-2020-27866": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.08656,
|
|
"epss_pct": 0.94723,
|
|
"name": "NETGEAR - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27866.yaml"
|
|
},
|
|
"CVE-2020-27982": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05342,
|
|
"epss_pct": 0.92049,
|
|
"name": "IceWarp WebMail 11.4.5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27982.yaml"
|
|
},
|
|
"CVE-2020-27986": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.16389,
|
|
"epss_pct": 0.96739,
|
|
"name": "SonarQube - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27986.yaml"
|
|
},
|
|
"CVE-2020-28185": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.18253,
|
|
"epss_pct": 0.97006,
|
|
"name": "TerraMaster TOS < 4.2.06 - User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28185.yaml"
|
|
},
|
|
"CVE-2020-28188": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.96598,
|
|
"epss_pct": 0.99878,
|
|
"name": "TerraMaster TOS - Unauthenticated Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28188.yaml"
|
|
},
|
|
"CVE-2020-28208": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.10817,
|
|
"epss_pct": 0.95526,
|
|
"name": "Rocket.Chat <3.9.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28208.yaml"
|
|
},
|
|
"CVE-2020-28351": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.15987,
|
|
"epss_pct": 0.96665,
|
|
"name": "Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28351.yaml"
|
|
},
|
|
"CVE-2020-28429": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.63305,
|
|
"epss_pct": 0.99146,
|
|
"name": "geojson2kml - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28429.yaml"
|
|
},
|
|
"CVE-2020-28653": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.787,
|
|
"epss_pct": 0.99558,
|
|
"name": "ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28653.yaml"
|
|
},
|
|
"CVE-2020-2883": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.94928,
|
|
"epss_pct": 0.99853,
|
|
"name": "Oracle WebLogic Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-2883.yaml"
|
|
},
|
|
"CVE-2020-28871": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.85785,
|
|
"epss_pct": 0.99711,
|
|
"name": "Monitorr 1.7.6m - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28871.yaml"
|
|
},
|
|
"CVE-2020-28976": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.27771,
|
|
"epss_pct": 0.97948,
|
|
"name": "WordPress Canto 1.3.0 - Blind Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28976.yaml"
|
|
},
|
|
"CVE-2020-29047": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.16017,
|
|
"epss_pct": 0.96674,
|
|
"name": "WP Hotel Booking < 1.10.4 - PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29047.yaml"
|
|
},
|
|
"CVE-2020-29164": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06198,
|
|
"epss_pct": 0.93,
|
|
"name": "PacsOne Server <7.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29164.yaml"
|
|
},
|
|
"CVE-2020-29214": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04499,
|
|
"epss_pct": 0.90811,
|
|
"name": "Alumni Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29214.yaml"
|
|
},
|
|
"CVE-2020-29227": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.16822,
|
|
"epss_pct": 0.96816,
|
|
"name": "Car Rental Management System 1.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29227.yaml"
|
|
},
|
|
"CVE-2020-29279": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.52881,
|
|
"epss_pct": 0.98894,
|
|
"name": "74CMS - Remote File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29279.yaml"
|
|
},
|
|
"CVE-2020-29390": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.39565,
|
|
"epss_pct": 0.98508,
|
|
"name": "Zeroshell 3.9.3 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29390.yaml"
|
|
},
|
|
"CVE-2020-29395": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12883,
|
|
"epss_pct": 0.9602,
|
|
"name": "Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29395.yaml"
|
|
},
|
|
"CVE-2020-29453": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.23948,
|
|
"epss_pct": 0.9767,
|
|
"name": "Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29453.yaml"
|
|
},
|
|
"CVE-2020-29583": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.90155,
|
|
"epss_pct": 0.99787,
|
|
"name": "ZyXel USG - Hardcoded Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29583.yaml"
|
|
},
|
|
"CVE-2020-29597": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.71006,
|
|
"epss_pct": 0.99356,
|
|
"name": "IncomCMS 2.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29597.yaml"
|
|
},
|
|
"CVE-2020-3187": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.96595,
|
|
"epss_pct": 0.99878,
|
|
"name": "Cisco Adaptive Security Appliance Software/Cisco Firepower Threat Defense - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3187.yaml"
|
|
},
|
|
"CVE-2020-3452": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.99992,
|
|
"epss_pct": 0.99986,
|
|
"name": "Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3452.yaml"
|
|
},
|
|
"CVE-2020-35131": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.51299,
|
|
"epss_pct": 0.98855,
|
|
"name": "Cockpit CMS 0.6.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35131.yaml"
|
|
},
|
|
"CVE-2020-35234": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.64603,
|
|
"epss_pct": 0.99179,
|
|
"name": "SMTP WP Plugin Directory Listing",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35234.yaml"
|
|
},
|
|
"CVE-2020-35338": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.12111,
|
|
"epss_pct": 0.95852,
|
|
"name": "Wireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential Detection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35338.yaml"
|
|
},
|
|
"CVE-2020-35359": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-770",
|
|
"epss": 0.04744,
|
|
"epss_pct": 0.91229,
|
|
"name": "Pure-FTPd 1.0.48 - Denial of Service",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-35359.yaml"
|
|
},
|
|
"CVE-2020-35476": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.8533,
|
|
"epss_pct": 0.997,
|
|
"name": "OpenTSDB <=2.4.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35476.yaml"
|
|
},
|
|
"CVE-2020-35580": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13975,
|
|
"epss_pct": 0.96275,
|
|
"name": "SearchBlox <9.2.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35580.yaml"
|
|
},
|
|
"CVE-2020-35598": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.21,
|
|
"epss_pct": 0.9739,
|
|
"name": "Advanced Comment System 1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35598.yaml"
|
|
},
|
|
"CVE-2020-35713": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.32704,
|
|
"epss_pct": 0.9822,
|
|
"name": "Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35713.yaml"
|
|
},
|
|
"CVE-2020-35729": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.88099,
|
|
"epss_pct": 0.99754,
|
|
"name": "Klog Server <=2.41 - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35729.yaml"
|
|
},
|
|
"CVE-2020-35736": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15402,
|
|
"epss_pct": 0.96538,
|
|
"name": "GateOne 1.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35736.yaml"
|
|
},
|
|
"CVE-2020-35749": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.30479,
|
|
"epss_pct": 0.98102,
|
|
"name": "WordPress Simple Job Board <2.9.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35749.yaml"
|
|
},
|
|
"CVE-2020-35774": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.85649,
|
|
"epss_pct": 0.99707,
|
|
"name": "twitter-server Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35774.yaml"
|
|
},
|
|
"CVE-2020-3580": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.85575,
|
|
"epss_pct": 0.99707,
|
|
"name": "Cisco ASA/FTD Software - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3580.yaml"
|
|
},
|
|
"CVE-2020-35846": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.93292,
|
|
"epss_pct": 0.99829,
|
|
"name": "Agentejo Cockpit < 0.11.2 - NoSQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35846.yaml"
|
|
},
|
|
"CVE-2020-35847": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.98165,
|
|
"epss_pct": 0.99909,
|
|
"name": "Agentejo Cockpit <0.11.2 - NoSQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35847.yaml"
|
|
},
|
|
"CVE-2020-35848": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.74591,
|
|
"epss_pct": 0.99459,
|
|
"name": "Agentejo Cockpit <0.12.0 - NoSQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35848.yaml"
|
|
},
|
|
"CVE-2020-35951": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.76328,
|
|
"epss_pct": 0.99499,
|
|
"name": "Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35951.yaml"
|
|
},
|
|
"CVE-2020-35984": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01104,
|
|
"epss_pct": 0.63443,
|
|
"name": "Rukovoditel <= 2.7.2 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35984.yaml"
|
|
},
|
|
"CVE-2020-35985": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01111,
|
|
"epss_pct": 0.63641,
|
|
"name": "Rukovoditel <= 2.7.2 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35985.yaml"
|
|
},
|
|
"CVE-2020-35986": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01109,
|
|
"epss_pct": 0.63579,
|
|
"name": "Rukovoditel <= 2.7.2 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35986.yaml"
|
|
},
|
|
"CVE-2020-35987": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01109,
|
|
"epss_pct": 0.6358,
|
|
"name": "Rukovoditel <= 2.7.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35987.yaml"
|
|
},
|
|
"CVE-2020-36112": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.18052,
|
|
"epss_pct": 0.96979,
|
|
"name": "CSE Bookstore 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36112.yaml"
|
|
},
|
|
"CVE-2020-36155": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.08975,
|
|
"epss_pct": 0.94883,
|
|
"name": "Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36155.yaml"
|
|
},
|
|
"CVE-2020-36289": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.99209,
|
|
"epss_pct": 0.99932,
|
|
"name": "Jira Server and Data Center - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36289.yaml"
|
|
},
|
|
"CVE-2020-36333": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.04105,
|
|
"epss_pct": 0.90038,
|
|
"name": "ThemeGrill Demo Importer < 1.6.2 - Database Reset",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36333.yaml"
|
|
},
|
|
"CVE-2020-36365": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02985,
|
|
"epss_pct": 0.86346,
|
|
"name": "Smartstore <4.1.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36365.yaml"
|
|
},
|
|
"CVE-2020-36510": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0259,
|
|
"epss_pct": 0.84189,
|
|
"name": "WordPress 15Zine <3.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36510.yaml"
|
|
},
|
|
"CVE-2020-36705": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.06944,
|
|
"epss_pct": 0.93642,
|
|
"name": "Adning Advertising <= 1.5.5 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36705.yaml"
|
|
},
|
|
"CVE-2020-36708": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.65342,
|
|
"epss_pct": 0.99199,
|
|
"name": "WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36708.yaml"
|
|
},
|
|
"CVE-2020-36719": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.04304,
|
|
"epss_pct": 0.90447,
|
|
"name": "ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36719.yaml"
|
|
},
|
|
"CVE-2020-36723": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01608,
|
|
"epss_pct": 0.74179,
|
|
"name": "ListingPro < 2.6.1 - Sensitive Data Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36723.yaml"
|
|
},
|
|
"CVE-2020-36728": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"epss": 0.03159,
|
|
"epss_pct": 0.87072,
|
|
"name": "WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36728.yaml"
|
|
},
|
|
"CVE-2020-36731": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01342,
|
|
"epss_pct": 0.69347,
|
|
"name": "Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36731.yaml"
|
|
},
|
|
"CVE-2020-36836": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01407,
|
|
"epss_pct": 0.70706,
|
|
"name": "WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36836.yaml"
|
|
},
|
|
"CVE-2020-36884": {
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01135,
|
|
"epss_pct": 0.64246,
|
|
"name": "BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36884.yaml"
|
|
},
|
|
"CVE-2020-37123": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.03135,
|
|
"epss_pct": 0.86969,
|
|
"name": "Pinger 1.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-37123.yaml"
|
|
},
|
|
"CVE-2020-3952": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.90384,
|
|
"epss_pct": 0.9979,
|
|
"name": "VMware vCenter Server LDAP Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3952.yaml"
|
|
},
|
|
"CVE-2020-4427": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.70031,
|
|
"epss_pct": 0.99325,
|
|
"name": "IBM Data Risk Manager - Authentication Bypass via SAML",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-4427.yaml"
|
|
},
|
|
"CVE-2020-4429": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.71363,
|
|
"epss_pct": 0.99365,
|
|
"name": "IBM Data Risk Manager - Hardcoded Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-4429.yaml"
|
|
},
|
|
"CVE-2020-4463": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.3159,
|
|
"epss_pct": 0.9816,
|
|
"name": "IBM Maximo Asset Management Information Disclosure - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-4463.yaml"
|
|
},
|
|
"CVE-2020-5191": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0552,
|
|
"epss_pct": 0.92247,
|
|
"name": "PHPGurukul Hospital Management System - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5191.yaml"
|
|
},
|
|
"CVE-2020-5192": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.1681,
|
|
"epss_pct": 0.96813,
|
|
"name": "Hospital Management System 4.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5192.yaml"
|
|
},
|
|
"CVE-2020-5284": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.44334,
|
|
"epss_pct": 0.98665,
|
|
"name": "Next.js <9.3.2 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5284.yaml"
|
|
},
|
|
"CVE-2020-5307": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.15652,
|
|
"epss_pct": 0.96599,
|
|
"name": "PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5307.yaml"
|
|
},
|
|
"CVE-2020-5405": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
|
|
"epss": 0.6876,
|
|
"epss_pct": 0.9929,
|
|
"name": "Spring Cloud Config - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5405.yaml"
|
|
},
|
|
"CVE-2020-5410": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.95586,
|
|
"epss_pct": 0.99864,
|
|
"name": "Spring Cloud Config Server - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5410.yaml"
|
|
},
|
|
"CVE-2020-5412": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.10214,
|
|
"epss_pct": 0.95333,
|
|
"name": "Spring Cloud Netflix - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5412.yaml"
|
|
},
|
|
"CVE-2020-5722": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.84406,
|
|
"epss_pct": 0.99681,
|
|
"name": "Grandstream UCM6200 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5722.yaml"
|
|
},
|
|
"CVE-2020-5766": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07233,
|
|
"epss_pct": 0.93874,
|
|
"name": "SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5766.yaml"
|
|
},
|
|
"CVE-2020-5775": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.06531,
|
|
"epss_pct": 0.93299,
|
|
"name": "Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5775.yaml"
|
|
},
|
|
"CVE-2020-5776": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.14725,
|
|
"epss_pct": 0.96424,
|
|
"name": "MAGMI - Cross-Site Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5776.yaml"
|
|
},
|
|
"CVE-2020-5777": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.23303,
|
|
"epss_pct": 0.97609,
|
|
"name": "Magento Mass Importer <0.7.24 - Remote Auth Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5777.yaml"
|
|
},
|
|
"CVE-2020-5847": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.95844,
|
|
"epss_pct": 0.99869,
|
|
"name": "UnRaid <=6.80 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5847.yaml"
|
|
},
|
|
"CVE-2020-5902": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 1.0,
|
|
"name": "F5 BIG-IP TMUI - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5902.yaml"
|
|
},
|
|
"CVE-2020-6171": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04798,
|
|
"epss_pct": 0.91312,
|
|
"name": "CLink Office 2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6171.yaml"
|
|
},
|
|
"CVE-2020-6207": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.98266,
|
|
"epss_pct": 0.99911,
|
|
"name": "SAP Solution Manager 7.2 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6207.yaml"
|
|
},
|
|
"CVE-2020-6287": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.94719,
|
|
"epss_pct": 0.99852,
|
|
"name": "SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6287.yaml"
|
|
},
|
|
"CVE-2020-6308": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.61736,
|
|
"epss_pct": 0.99109,
|
|
"name": "SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6308.yaml"
|
|
},
|
|
"CVE-2020-6637": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.20058,
|
|
"epss_pct": 0.97252,
|
|
"name": "OpenSIS 7.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6637.yaml"
|
|
},
|
|
"CVE-2020-6950": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10124,
|
|
"epss_pct": 0.95308,
|
|
"name": "Eclipse Mojarra - Local File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6950.yaml"
|
|
},
|
|
"CVE-2020-7107": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02195,
|
|
"epss_pct": 0.8123,
|
|
"name": "WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7107.yaml"
|
|
},
|
|
"CVE-2020-7136": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.79522,
|
|
"epss_pct": 0.99573,
|
|
"name": "HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7136.yaml"
|
|
},
|
|
"CVE-2020-7209": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.98751,
|
|
"epss_pct": 0.99923,
|
|
"name": "LinuxKI Toolset <= 6.01 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7209.yaml"
|
|
},
|
|
"CVE-2020-7247": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-755",
|
|
"epss": 0.98972,
|
|
"epss_pct": 0.99927,
|
|
"name": "OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-7247.yaml"
|
|
},
|
|
"CVE-2020-7318": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01024,
|
|
"epss_pct": 0.61143,
|
|
"name": "McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7318.yaml"
|
|
},
|
|
"CVE-2020-7796": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.84418,
|
|
"epss_pct": 0.99682,
|
|
"name": "Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7796.yaml"
|
|
},
|
|
"CVE-2020-7943": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.07884,
|
|
"epss_pct": 0.94291,
|
|
"name": "Puppet Server/PuppetDB - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7943.yaml"
|
|
},
|
|
"CVE-2020-7961": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99905,
|
|
"epss_pct": 0.99964,
|
|
"name": "Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7961.yaml"
|
|
},
|
|
"CVE-2020-7980": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.82544,
|
|
"epss_pct": 0.99641,
|
|
"name": "Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7980.yaml"
|
|
},
|
|
"CVE-2020-8115": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07055,
|
|
"epss_pct": 0.93735,
|
|
"name": "Revive Adserver <=5.0.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8115.yaml"
|
|
},
|
|
"CVE-2020-8163": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.82047,
|
|
"epss_pct": 0.99628,
|
|
"name": "Ruby on Rails <5.0.1 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8163.yaml"
|
|
},
|
|
"CVE-2020-8191": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.26136,
|
|
"epss_pct": 0.97841,
|
|
"name": "Citrix ADC/Gateway - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8191.yaml"
|
|
},
|
|
"CVE-2020-8193": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"epss": 0.88411,
|
|
"epss_pct": 0.99759,
|
|
"name": "Citrix - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8193.yaml"
|
|
},
|
|
"CVE-2020-8194": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.10695,
|
|
"epss_pct": 0.95486,
|
|
"name": "Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8194.yaml"
|
|
},
|
|
"CVE-2020-8209": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.48656,
|
|
"epss_pct": 0.98784,
|
|
"name": "Citrix XenMobile Server - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8209.yaml"
|
|
},
|
|
"CVE-2020-8497": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.05275,
|
|
"epss_pct": 0.91982,
|
|
"name": "Artica Pandora FMS <=7.42 - Arbitrary File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8497.yaml"
|
|
},
|
|
"CVE-2020-8512": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.14834,
|
|
"epss_pct": 0.96442,
|
|
"name": "IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8512.yaml"
|
|
},
|
|
"CVE-2020-8515": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99993,
|
|
"epss_pct": 0.99986,
|
|
"name": "DrayTek - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8515.yaml"
|
|
},
|
|
"CVE-2020-8615": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.0883,
|
|
"epss_pct": 0.94815,
|
|
"name": "Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8615.yaml"
|
|
},
|
|
"CVE-2020-8641": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10808,
|
|
"epss_pct": 0.95521,
|
|
"name": "Lotus Core CMS 1.0.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8641.yaml"
|
|
},
|
|
"CVE-2020-8644": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.86689,
|
|
"epss_pct": 0.99726,
|
|
"name": "playSMS <1.4.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8644.yaml"
|
|
},
|
|
"CVE-2020-8654": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.9118,
|
|
"epss_pct": 0.998,
|
|
"name": "EyesOfNetwork 5.1-5.3 - SQL Injection/Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8654.yaml"
|
|
},
|
|
"CVE-2020-8656": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.846,
|
|
"epss_pct": 0.99686,
|
|
"name": "EyesOfNetwork - Hardcoded API Key & SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8656.yaml"
|
|
},
|
|
"CVE-2020-8657": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.91874,
|
|
"epss_pct": 0.99809,
|
|
"name": "EyesOfNetwork - Hardcoded API Key",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8657.yaml"
|
|
},
|
|
"CVE-2020-8771": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.46454,
|
|
"epss_pct": 0.98731,
|
|
"name": "WordPress Time Capsule < 1.21.16 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8771.yaml"
|
|
},
|
|
"CVE-2020-8772": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.88049,
|
|
"epss_pct": 0.99753,
|
|
"name": "WordPress InfiniteWP <1.9.4.5 - Authorization Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8772.yaml"
|
|
},
|
|
"CVE-2020-8813": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.73779,
|
|
"epss_pct": 0.99436,
|
|
"name": "Cacti v1.2.8 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8813.yaml"
|
|
},
|
|
"CVE-2020-8982": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.27149,
|
|
"epss_pct": 0.97907,
|
|
"name": "Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8982.yaml"
|
|
},
|
|
"CVE-2020-9036": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03587,
|
|
"epss_pct": 0.88591,
|
|
"name": "Jeedom <=4.0.38 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9036.yaml"
|
|
},
|
|
"CVE-2020-9039": {
|
|
"name": "Couchbase Server - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9039.yaml"
|
|
},
|
|
"CVE-2020-9043": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.08173,
|
|
"epss_pct": 0.94455,
|
|
"name": "WordPress wpCentral <1.5.1 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9043.yaml"
|
|
},
|
|
"CVE-2020-9047": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-347",
|
|
"epss": 0.0777,
|
|
"epss_pct": 0.94215,
|
|
"name": "exacqVision Web Service - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9047.yaml"
|
|
},
|
|
"CVE-2020-9054": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99988,
|
|
"epss_pct": 0.99983,
|
|
"name": "Zyxel NAS Firmware 5.21- Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9054.yaml"
|
|
},
|
|
"CVE-2020-9274": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-824",
|
|
"epss": 0.05957,
|
|
"epss_pct": 0.92761,
|
|
"name": "Pure-FTPd \u2264 1.0.49 - DoS via Uninitialized Pointer",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-9274.yaml"
|
|
},
|
|
"CVE-2020-9314": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01282,
|
|
"epss_pct": 0.68041,
|
|
"name": "Oracle iPlanet Web Server 7.0.x - Image Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9314.yaml"
|
|
},
|
|
"CVE-2020-9315": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.81814,
|
|
"epss_pct": 0.9962,
|
|
"name": "Oracle iPlanet Web Server 7.0.x - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9315.yaml"
|
|
},
|
|
"CVE-2020-9344": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05198,
|
|
"epss_pct": 0.91888,
|
|
"name": "Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9344.yaml"
|
|
},
|
|
"CVE-2020-9365": {
|
|
"name": "Pure-FTPd 1.0.24 - Security Vulnerability",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-9365.yaml"
|
|
},
|
|
"CVE-2020-9376": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.16586,
|
|
"epss_pct": 0.96779,
|
|
"name": "D-Link DIR-610 Devices - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9376.yaml"
|
|
},
|
|
"CVE-2020-9402": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.22513,
|
|
"epss_pct": 0.97536,
|
|
"name": "Django SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2020/CVE-2020-9402.yaml"
|
|
},
|
|
"CVE-2020-9425": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-670",
|
|
"epss": 0.19037,
|
|
"epss_pct": 0.97104,
|
|
"name": "rConfig <3.9.4 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9425.yaml"
|
|
},
|
|
"CVE-2020-9480": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.2937,
|
|
"epss_pct": 0.98043,
|
|
"name": "Apache Spark - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9480.yaml"
|
|
},
|
|
"CVE-2020-9483": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.34613,
|
|
"epss_pct": 0.98303,
|
|
"name": "SkyWalking SQLI",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9483.yaml"
|
|
},
|
|
"CVE-2020-9484": {
|
|
"cvss": 7.0,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.56636,
|
|
"epss_pct": 0.98988,
|
|
"name": "Apache Tomcat Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9484.yaml"
|
|
},
|
|
"CVE-2020-9496": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.98926,
|
|
"epss_pct": 0.99925,
|
|
"name": "Apache OFBiz 17.12.03 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9496.yaml"
|
|
},
|
|
"CVE-2020-9547": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.18383,
|
|
"epss_pct": 0.97021,
|
|
"name": "FasterXML jackson-databind - Deserialization Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9547.yaml"
|
|
},
|
|
"CVE-2020-9548": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.18345,
|
|
"epss_pct": 0.97018,
|
|
"name": "FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9548.yaml"
|
|
},
|
|
"CVE-2020-9757": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.72821,
|
|
"epss_pct": 0.99408,
|
|
"name": "Craft CMS < 3.3.0 - Server-Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9757.yaml"
|
|
},
|
|
"CVE-2021-1472": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.71834,
|
|
"epss_pct": 0.99378,
|
|
"name": "Cisco Small Business RV Series - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1472.yaml"
|
|
},
|
|
"CVE-2021-1497": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99928,
|
|
"epss_pct": 0.99968,
|
|
"name": "Cisco HyperFlex HX Data Platform - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1497.yaml"
|
|
},
|
|
"CVE-2021-1498": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.9999,
|
|
"name": "Cisco HyperFlex HX Data Platform - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1498.yaml"
|
|
},
|
|
"CVE-2021-1499": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.80426,
|
|
"epss_pct": 0.99591,
|
|
"name": "Cisco HyperFlex HX Data Platform - Arbitrary File Upload",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-1499.yaml"
|
|
},
|
|
"CVE-2021-20021": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.83425,
|
|
"epss_pct": 0.99659,
|
|
"name": "SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20021.yaml"
|
|
},
|
|
"CVE-2021-20031": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.13041,
|
|
"epss_pct": 0.9606,
|
|
"name": "SonicWall SonicOS 7.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20031.yaml"
|
|
},
|
|
"CVE-2021-20038": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99912,
|
|
"epss_pct": 0.99966,
|
|
"name": "SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20038.yaml"
|
|
},
|
|
"CVE-2021-20086": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1321",
|
|
"epss": 0.06104,
|
|
"epss_pct": 0.92914,
|
|
"name": "Odoo Apps - Cross-Site Scripting via Prototype Pollution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20086.yaml"
|
|
},
|
|
"CVE-2021-20090": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99983,
|
|
"epss_pct": 0.99981,
|
|
"name": "Buffalo WSR-2533DHPL2 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20090.yaml"
|
|
},
|
|
"CVE-2021-20091": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.08796,
|
|
"epss_pct": 0.948,
|
|
"name": "Buffalo WSR-2533DHPL2 - Configuration File Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20091.yaml"
|
|
},
|
|
"CVE-2021-20092": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.0817,
|
|
"epss_pct": 0.94452,
|
|
"name": "Buffalo WSR-2533DHPL2 - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20092.yaml"
|
|
},
|
|
"CVE-2021-20114": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.05973,
|
|
"epss_pct": 0.92775,
|
|
"name": "TCExam <= 14.8.1 - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20114.yaml"
|
|
},
|
|
"CVE-2021-20123": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.90234,
|
|
"epss_pct": 0.99788,
|
|
"name": "Draytek VigorConnect 1.6.0-B - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20123.yaml"
|
|
},
|
|
"CVE-2021-20124": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.96308,
|
|
"epss_pct": 0.99875,
|
|
"name": "Draytek VigorConnect 6.0-B3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20124.yaml"
|
|
},
|
|
"CVE-2021-20137": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02557,
|
|
"epss_pct": 0.83958,
|
|
"name": "Gryphon Tower - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20137.yaml"
|
|
},
|
|
"CVE-2021-20150": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.4006,
|
|
"epss_pct": 0.98528,
|
|
"name": "Trendnet AC2600 TEW-827DRU - Credentials Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20150.yaml"
|
|
},
|
|
"CVE-2021-20158": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.10861,
|
|
"epss_pct": 0.95537,
|
|
"name": "Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20158.yaml"
|
|
},
|
|
"CVE-2021-20167": {
|
|
"cvss": 8.0,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.07783,
|
|
"epss_pct": 0.94221,
|
|
"name": "Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20167.yaml"
|
|
},
|
|
"CVE-2021-20323": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.37246,
|
|
"epss_pct": 0.98414,
|
|
"name": "Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20323.yaml"
|
|
},
|
|
"CVE-2021-20617": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.07871,
|
|
"epss_pct": 0.94276,
|
|
"name": "Acmailer - Improper Access Control to OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20617.yaml"
|
|
},
|
|
"CVE-2021-20792": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03378,
|
|
"epss_pct": 0.87921,
|
|
"name": "WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20792.yaml"
|
|
},
|
|
"CVE-2021-20837": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.88144,
|
|
"epss_pct": 0.99755,
|
|
"name": "MovableType - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20837.yaml"
|
|
},
|
|
"CVE-2021-21087": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.37095,
|
|
"epss_pct": 0.98409,
|
|
"name": "Adobe ColdFusion - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21087.yaml"
|
|
},
|
|
"CVE-2021-21234": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.21173,
|
|
"epss_pct": 0.97407,
|
|
"name": "Spring Boot Actuator Logview Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21234.yaml"
|
|
},
|
|
"CVE-2021-21246": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.49051,
|
|
"epss_pct": 0.98794,
|
|
"name": "OneDev < 4.0.3 - User Access Token Leak",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21246.yaml"
|
|
},
|
|
"CVE-2021-21287": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.24784,
|
|
"epss_pct": 0.9774,
|
|
"name": "MinIO Browser API - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21287.yaml"
|
|
},
|
|
"CVE-2021-21307": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.89189,
|
|
"epss_pct": 0.99769,
|
|
"name": "Lucee Admin - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21307.yaml"
|
|
},
|
|
"CVE-2021-21311": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.90461,
|
|
"epss_pct": 0.99792,
|
|
"name": "Adminer <4.7.9 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21311.yaml"
|
|
},
|
|
"CVE-2021-21315": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.90675,
|
|
"epss_pct": 0.99794,
|
|
"name": "Node.JS System Information Library <5.3.1 - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21315.yaml"
|
|
},
|
|
"CVE-2021-21345": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.72324,
|
|
"epss_pct": 0.99393,
|
|
"name": "XStream < 1.4.16 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21345.yaml"
|
|
},
|
|
"CVE-2021-2135": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.0837,
|
|
"epss_pct": 0.94559,
|
|
"name": "Oracle WebLogic Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-2135.yaml"
|
|
},
|
|
"CVE-2021-21351": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.82136,
|
|
"epss_pct": 0.9963,
|
|
"name": "XStream <1.4.16 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21351.yaml"
|
|
},
|
|
"CVE-2021-21389": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.13521,
|
|
"epss_pct": 0.96169,
|
|
"name": "BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21389.yaml"
|
|
},
|
|
"CVE-2021-21402": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.79855,
|
|
"epss_pct": 0.9958,
|
|
"name": "Jellyfin <10.7.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21402.yaml"
|
|
},
|
|
"CVE-2021-21479": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.10116,
|
|
"epss_pct": 0.95305,
|
|
"name": "SCIMono <0.0.19 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21479.yaml"
|
|
},
|
|
"CVE-2021-21745": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.55709,
|
|
"epss_pct": 0.98965,
|
|
"name": "ZTE MF971R - Referer authentication bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21745.yaml"
|
|
},
|
|
"CVE-2021-21799": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12293,
|
|
"epss_pct": 0.95894,
|
|
"name": "Advantech R-SeeNet 2.4.12 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21799.yaml"
|
|
},
|
|
"CVE-2021-21800": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.14115,
|
|
"epss_pct": 0.963,
|
|
"name": "Advantech R-SeeNet 2.4.12 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21800.yaml"
|
|
},
|
|
"CVE-2021-21801": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.63415,
|
|
"epss_pct": 0.99148,
|
|
"name": "Advantech R-SeeNet - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21801.yaml"
|
|
},
|
|
"CVE-2021-21802": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.099,
|
|
"epss_pct": 0.95228,
|
|
"name": "Advantech R-SeeNet - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21802.yaml"
|
|
},
|
|
"CVE-2021-21803": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07902,
|
|
"epss_pct": 0.94296,
|
|
"name": "Advantech R-SeeNet - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21803.yaml"
|
|
},
|
|
"CVE-2021-21805": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.69842,
|
|
"epss_pct": 0.9932,
|
|
"name": "Advantech R-SeeNet 2.4.12 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21805.yaml"
|
|
},
|
|
"CVE-2021-21816": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.32385,
|
|
"epss_pct": 0.98204,
|
|
"name": "D-Link DIR-3040 1.13B03 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21816.yaml"
|
|
},
|
|
"CVE-2021-21881": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.36234,
|
|
"epss_pct": 0.98365,
|
|
"name": "Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21881.yaml"
|
|
},
|
|
"CVE-2021-21972": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99865,
|
|
"epss_pct": 0.99961,
|
|
"name": "VMware vSphere Client (HTML5) - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21972.yaml"
|
|
},
|
|
"CVE-2021-21973": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.8764,
|
|
"epss_pct": 0.99746,
|
|
"name": "VMware vSphere - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21973.yaml"
|
|
},
|
|
"CVE-2021-21975": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.7829,
|
|
"epss_pct": 0.99546,
|
|
"name": "vRealize Operations Manager API - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21975.yaml"
|
|
},
|
|
"CVE-2021-21978": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99005,
|
|
"epss_pct": 0.99928,
|
|
"name": "VMware View Planner <4.6 SP1- Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21978.yaml"
|
|
},
|
|
"CVE-2021-21985": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99992,
|
|
"name": "VMware vSphere Client (HTML5) - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21985.yaml"
|
|
},
|
|
"CVE-2021-22005": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99998,
|
|
"name": "VMware vCenter Server - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22005.yaml"
|
|
},
|
|
"CVE-2021-22017": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.49177,
|
|
"epss_pct": 0.98797,
|
|
"name": "vCenter Server - Improper Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22017.yaml"
|
|
},
|
|
"CVE-2021-22053": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.13035,
|
|
"epss_pct": 0.96061,
|
|
"name": "Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22053.yaml"
|
|
},
|
|
"CVE-2021-22054": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.97369,
|
|
"epss_pct": 0.99893,
|
|
"name": "VMWare Workspace ONE UEM - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22054.yaml"
|
|
},
|
|
"CVE-2021-22122": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.1052,
|
|
"epss_pct": 0.95431,
|
|
"name": "FortiWeb - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22122.yaml"
|
|
},
|
|
"CVE-2021-22145": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.76249,
|
|
"epss_pct": 0.99498,
|
|
"name": "Elasticsearch 7.10.0-7.13.3 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22145.yaml"
|
|
},
|
|
"CVE-2021-22175": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.53372,
|
|
"epss_pct": 0.98909,
|
|
"name": "GitLab CI Lint API - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22175.yaml"
|
|
},
|
|
"CVE-2021-22205": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99731,
|
|
"epss_pct": 0.99952,
|
|
"name": "GitLab CE/EE - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22205.yaml"
|
|
},
|
|
"CVE-2021-22214": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.27806,
|
|
"epss_pct": 0.9795,
|
|
"name": "Gitlab CE/EE 10.5 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22214.yaml"
|
|
},
|
|
"CVE-2021-22502": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.9674,
|
|
"epss_pct": 0.99882,
|
|
"name": "Micro Focus Operations Bridge Reporter - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22502.yaml"
|
|
},
|
|
"CVE-2021-22707": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.64612,
|
|
"epss_pct": 0.9918,
|
|
"name": "EVlink City < R8 V3.4.0.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22707.yaml"
|
|
},
|
|
"CVE-2021-22873": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.69561,
|
|
"epss_pct": 0.99312,
|
|
"name": "Revive Adserver <5.1.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22873.yaml"
|
|
},
|
|
"CVE-2021-22881": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.87301,
|
|
"epss_pct": 0.9974,
|
|
"name": "Ruby on Rails - Open Redirect via Host Header Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22881.yaml"
|
|
},
|
|
"CVE-2021-22911": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.95242,
|
|
"epss_pct": 0.99859,
|
|
"name": "Rocket.Chat <=3.13 - NoSQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22911.yaml"
|
|
},
|
|
"CVE-2021-22986": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.99898,
|
|
"epss_pct": 0.99964,
|
|
"name": "F5 iControl REST - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22986.yaml"
|
|
},
|
|
"CVE-2021-23241": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13436,
|
|
"epss_pct": 0.96149,
|
|
"name": "MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23241.yaml"
|
|
},
|
|
"CVE-2021-23337": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.21333,
|
|
"epss_pct": 0.97423,
|
|
"name": "Lodash Template - Server-Side Template Injection (RCE)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23337.yaml"
|
|
},
|
|
"CVE-2021-23394": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.19083,
|
|
"epss_pct": 0.97113,
|
|
"name": "elFinder < 2.1.58 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23394.yaml"
|
|
},
|
|
"CVE-2021-24139": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05547,
|
|
"epss_pct": 0.92281,
|
|
"name": "10Web Photo Gallery < 1.5.55 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24139.yaml"
|
|
},
|
|
"CVE-2021-24145": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.87314,
|
|
"epss_pct": 0.9974,
|
|
"name": "WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24145.yaml"
|
|
},
|
|
"CVE-2021-24146": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"epss": 0.31043,
|
|
"epss_pct": 0.98131,
|
|
"name": "WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24146.yaml"
|
|
},
|
|
"CVE-2021-24150": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.04337,
|
|
"epss_pct": 0.90507,
|
|
"name": "WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24150.yaml"
|
|
},
|
|
"CVE-2021-24155": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.84112,
|
|
"epss_pct": 0.99675,
|
|
"name": "WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24155.yaml"
|
|
},
|
|
"CVE-2021-24165": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01643,
|
|
"epss_pct": 0.74725,
|
|
"name": "WordPress Ninja Forms <3.4.34 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24165.yaml"
|
|
},
|
|
"CVE-2021-24169": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10348,
|
|
"epss_pct": 0.95377,
|
|
"name": "WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24169.yaml"
|
|
},
|
|
"CVE-2021-24170": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.04788,
|
|
"epss_pct": 0.91298,
|
|
"name": "User Profile Picture < 2.5.0 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24170.yaml"
|
|
},
|
|
"CVE-2021-24175": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.14462,
|
|
"epss_pct": 0.9637,
|
|
"name": "The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24175.yaml"
|
|
},
|
|
"CVE-2021-24176": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02044,
|
|
"epss_pct": 0.79815,
|
|
"name": "WordPress JH 404 Logger <=1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24176.yaml"
|
|
},
|
|
"CVE-2021-24210": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03066,
|
|
"epss_pct": 0.86691,
|
|
"name": "WordPress PhastPress <1.111 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24210.yaml"
|
|
},
|
|
"CVE-2021-24212": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.07908,
|
|
"epss_pct": 0.94299,
|
|
"name": "WooCommerce Help Scout - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24212.yaml"
|
|
},
|
|
"CVE-2021-24213": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0137,
|
|
"epss_pct": 0.69983,
|
|
"name": "GiveWP <= 2.9.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24213.yaml"
|
|
},
|
|
"CVE-2021-24214": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0163,
|
|
"epss_pct": 0.74514,
|
|
"name": "WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24214.yaml"
|
|
},
|
|
"CVE-2021-24215": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.09733,
|
|
"epss_pct": 0.95171,
|
|
"name": "Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24215.yaml"
|
|
},
|
|
"CVE-2021-24219": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"epss": 0.02059,
|
|
"epss_pct": 0.79964,
|
|
"name": "All Thrive Themes and Plugins - Unauthenticated Option Update",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24219.yaml"
|
|
},
|
|
"CVE-2021-24220": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.03946,
|
|
"epss_pct": 0.89663,
|
|
"name": "Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24220.yaml"
|
|
},
|
|
"CVE-2021-24226": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.05404,
|
|
"epss_pct": 0.92118,
|
|
"name": "AccessAlly <3.5.7 - Sensitive Information Leakage",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24226.yaml"
|
|
},
|
|
"CVE-2021-24227": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.05927,
|
|
"epss_pct": 0.92727,
|
|
"name": "Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24227.yaml"
|
|
},
|
|
"CVE-2021-24235": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02927,
|
|
"epss_pct": 0.86091,
|
|
"name": "WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24235.yaml"
|
|
},
|
|
"CVE-2021-24236": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.0714,
|
|
"epss_pct": 0.93807,
|
|
"name": "WordPress Imagements <=1.2.5 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24236.yaml"
|
|
},
|
|
"CVE-2021-24237": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06275,
|
|
"epss_pct": 0.93075,
|
|
"name": "WordPress Realteo <=1.2.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24237.yaml"
|
|
},
|
|
"CVE-2021-24239": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01602,
|
|
"epss_pct": 0.74085,
|
|
"name": "WordPress Pie Register <3.7.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24239.yaml"
|
|
},
|
|
"CVE-2021-24245": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05721,
|
|
"epss_pct": 0.92497,
|
|
"name": "WordPress Stop Spammers <2021.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24245.yaml"
|
|
},
|
|
"CVE-2021-24274": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.17638,
|
|
"epss_pct": 0.96928,
|
|
"name": "WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24274.yaml"
|
|
},
|
|
"CVE-2021-24275": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.18165,
|
|
"epss_pct": 0.96991,
|
|
"name": "Popup by Supsystic <1.10.5 - Cross-Site scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24275.yaml"
|
|
},
|
|
"CVE-2021-24276": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.16044,
|
|
"epss_pct": 0.96679,
|
|
"name": "WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24276.yaml"
|
|
},
|
|
"CVE-2021-24278": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.07359,
|
|
"epss_pct": 0.93958,
|
|
"name": "WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24278.yaml"
|
|
},
|
|
"CVE-2021-24284": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.4214,
|
|
"epss_pct": 0.98594,
|
|
"name": "WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24284.yaml"
|
|
},
|
|
"CVE-2021-24285": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.14697,
|
|
"epss_pct": 0.96418,
|
|
"name": "WordPress Car Seller - Auto Classifieds Script - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24285.yaml"
|
|
},
|
|
"CVE-2021-24286": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.13942,
|
|
"epss_pct": 0.96271,
|
|
"name": "WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24286.yaml"
|
|
},
|
|
"CVE-2021-24287": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10358,
|
|
"epss_pct": 0.95382,
|
|
"name": "WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24287.yaml"
|
|
},
|
|
"CVE-2021-24288": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01939,
|
|
"epss_pct": 0.78672,
|
|
"name": "WordPress AcyMailing <7.5.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24288.yaml"
|
|
},
|
|
"CVE-2021-24291": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.1445,
|
|
"epss_pct": 0.96369,
|
|
"name": "WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24291.yaml"
|
|
},
|
|
"CVE-2021-24295": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04691,
|
|
"epss_pct": 0.91144,
|
|
"name": "Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24295.yaml"
|
|
},
|
|
"CVE-2021-24298": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03451,
|
|
"epss_pct": 0.88169,
|
|
"name": "WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24298.yaml"
|
|
},
|
|
"CVE-2021-24300": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10587,
|
|
"epss_pct": 0.95452,
|
|
"name": "WordPress WooCommerce <1.13.22 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24300.yaml"
|
|
},
|
|
"CVE-2021-24316": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06442,
|
|
"epss_pct": 0.93229,
|
|
"name": "WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24316.yaml"
|
|
},
|
|
"CVE-2021-24320": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10769,
|
|
"epss_pct": 0.95509,
|
|
"name": "WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24320.yaml"
|
|
},
|
|
"CVE-2021-24335": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03884,
|
|
"epss_pct": 0.89482,
|
|
"name": "WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24335.yaml"
|
|
},
|
|
"CVE-2021-24340": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.29776,
|
|
"epss_pct": 0.98064,
|
|
"name": "WordPress Statistics <13.0.8 - Blind SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24340.yaml"
|
|
},
|
|
"CVE-2021-24342": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01975,
|
|
"epss_pct": 0.7905,
|
|
"name": "WordPress JNews Theme <8.0.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24342.yaml"
|
|
},
|
|
"CVE-2021-24347": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-178",
|
|
"epss": 0.5408,
|
|
"epss_pct": 0.98929,
|
|
"name": "WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24347.yaml"
|
|
},
|
|
"CVE-2021-24351": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02483,
|
|
"epss_pct": 0.83449,
|
|
"name": "WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24351.yaml"
|
|
},
|
|
"CVE-2021-24358": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02295,
|
|
"epss_pct": 0.82045,
|
|
"name": "Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24358.yaml"
|
|
},
|
|
"CVE-2021-24364": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01975,
|
|
"epss_pct": 0.7905,
|
|
"name": "WordPress Jannah Theme <5.4.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24364.yaml"
|
|
},
|
|
"CVE-2021-24370": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.47091,
|
|
"epss_pct": 0.98747,
|
|
"name": "WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24370.yaml"
|
|
},
|
|
"CVE-2021-24387": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03677,
|
|
"epss_pct": 0.88876,
|
|
"name": "WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24387.yaml"
|
|
},
|
|
"CVE-2021-24389": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03753,
|
|
"epss_pct": 0.89099,
|
|
"name": "WordPress FoodBakery <2.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24389.yaml"
|
|
},
|
|
"CVE-2021-24406": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02915,
|
|
"epss_pct": 0.86041,
|
|
"name": "WordPress wpForo Forum < 1.9.7 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24406.yaml"
|
|
},
|
|
"CVE-2021-24407": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02591,
|
|
"epss_pct": 0.84196,
|
|
"name": "WordPress Jannah Theme <5.4.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24407.yaml"
|
|
},
|
|
"CVE-2021-24409": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01793,
|
|
"epss_pct": 0.76842,
|
|
"name": "Prismatic < 2.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24409.yaml"
|
|
},
|
|
"CVE-2021-24435": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01714,
|
|
"epss_pct": 0.75781,
|
|
"name": "WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24435.yaml"
|
|
},
|
|
"CVE-2021-24436": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01905,
|
|
"epss_pct": 0.78263,
|
|
"name": "WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24436.yaml"
|
|
},
|
|
"CVE-2021-24442": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.45996,
|
|
"epss_pct": 0.98717,
|
|
"name": "Wordpress Polls Widget < 1.5.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24442.yaml"
|
|
},
|
|
"CVE-2021-24452": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01917,
|
|
"epss_pct": 0.78417,
|
|
"name": "WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24452.yaml"
|
|
},
|
|
"CVE-2021-24472": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.56614,
|
|
"epss_pct": 0.98987,
|
|
"name": "Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24472.yaml"
|
|
},
|
|
"CVE-2021-24488": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.11241,
|
|
"epss_pct": 0.95647,
|
|
"name": "WordPress Post Grid <2.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24488.yaml"
|
|
},
|
|
"CVE-2021-24495": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03343,
|
|
"epss_pct": 0.87802,
|
|
"name": "Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24495.yaml"
|
|
},
|
|
"CVE-2021-24498": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03536,
|
|
"epss_pct": 0.88438,
|
|
"name": "WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24498.yaml"
|
|
},
|
|
"CVE-2021-24499": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.60113,
|
|
"epss_pct": 0.99067,
|
|
"name": "WordPress Workreap - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24499.yaml"
|
|
},
|
|
"CVE-2021-24510": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02721,
|
|
"epss_pct": 0.84986,
|
|
"name": "WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24510.yaml"
|
|
},
|
|
"CVE-2021-24522": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01552,
|
|
"epss_pct": 0.73345,
|
|
"name": "ProfilePress < 3.1.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24522.yaml"
|
|
},
|
|
"CVE-2021-24527": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.07634,
|
|
"epss_pct": 0.94132,
|
|
"name": "Profile Builder < 3.4.9 - Improper Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24527.yaml"
|
|
},
|
|
"CVE-2021-24554": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0654,
|
|
"epss_pct": 0.9331,
|
|
"name": "WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24554.yaml"
|
|
},
|
|
"CVE-2021-24627": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06561,
|
|
"epss_pct": 0.93326,
|
|
"name": "G Auto-Hyperlink <= 1.0.1 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24627.yaml"
|
|
},
|
|
"CVE-2021-24644": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05028,
|
|
"epss_pct": 0.91655,
|
|
"name": "Images to WebP < 1.9 - Authenticated Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24644.yaml"
|
|
},
|
|
"CVE-2021-24647": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.0968,
|
|
"epss_pct": 0.95149,
|
|
"name": "Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24647.yaml"
|
|
},
|
|
"CVE-2021-24657": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01582,
|
|
"epss_pct": 0.73786,
|
|
"name": "Limit Login Attempts WordPress - Stored Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24657.yaml"
|
|
},
|
|
"CVE-2021-24666": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08883,
|
|
"epss_pct": 0.94844,
|
|
"name": "WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24666.yaml"
|
|
},
|
|
"CVE-2021-24681": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00893,
|
|
"epss_pct": 0.56981,
|
|
"name": "Duplicate Page WordPress - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24681.yaml"
|
|
},
|
|
"CVE-2021-24731": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06566,
|
|
"epss_pct": 0.93331,
|
|
"name": "Pie Register < 3.7.1.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24731.yaml"
|
|
},
|
|
"CVE-2021-24746": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02244,
|
|
"epss_pct": 0.81634,
|
|
"name": "WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24746.yaml"
|
|
},
|
|
"CVE-2021-24750": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.38298,
|
|
"epss_pct": 0.98456,
|
|
"name": "WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24750.yaml"
|
|
},
|
|
"CVE-2021-24762": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.86782,
|
|
"epss_pct": 0.99729,
|
|
"name": "WordPress Perfect Survey <1.5.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24762.yaml"
|
|
},
|
|
"CVE-2021-24786": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.17348,
|
|
"epss_pct": 0.96889,
|
|
"name": "Download Monitor < 4.4.5 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24786.yaml"
|
|
},
|
|
"CVE-2021-24791": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05124,
|
|
"epss_pct": 0.91789,
|
|
"name": "Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24791.yaml"
|
|
},
|
|
"CVE-2021-24827": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13285,
|
|
"epss_pct": 0.9611,
|
|
"name": "WordPress Asgaros Forum <1.15.13 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24827.yaml"
|
|
},
|
|
"CVE-2021-24838": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02208,
|
|
"epss_pct": 0.81337,
|
|
"name": "WordPress AnyComment <0.3.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24838.yaml"
|
|
},
|
|
"CVE-2021-24849": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0848,
|
|
"epss_pct": 0.94628,
|
|
"name": "WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24849.yaml"
|
|
},
|
|
"CVE-2021-24862": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.73293,
|
|
"epss_pct": 0.99419,
|
|
"name": "WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24862.yaml"
|
|
},
|
|
"CVE-2021-24875": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01555,
|
|
"epss_pct": 0.73406,
|
|
"name": "WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24875.yaml"
|
|
},
|
|
"CVE-2021-24876": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01165,
|
|
"epss_pct": 0.65078,
|
|
"name": "Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24876.yaml"
|
|
},
|
|
"CVE-2021-24878": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01165,
|
|
"epss_pct": 0.65079,
|
|
"name": "SupportCandy < 2.2.7 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24878.yaml"
|
|
},
|
|
"CVE-2021-24891": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.25136,
|
|
"epss_pct": 0.97772,
|
|
"name": "WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24891.yaml"
|
|
},
|
|
"CVE-2021-24910": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01567,
|
|
"epss_pct": 0.73566,
|
|
"name": "WordPress Transposh Translation <1.0.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24910.yaml"
|
|
},
|
|
"CVE-2021-24915": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.127,
|
|
"epss_pct": 0.95974,
|
|
"name": "Contest Gallery < 13.1.0.6 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24915.yaml"
|
|
},
|
|
"CVE-2021-24916": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.01729,
|
|
"epss_pct": 0.75957,
|
|
"name": "WordPress Qubely < 1.8.6 - Unauthenticated Email Sending",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24916.yaml"
|
|
},
|
|
"CVE-2021-24917": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.71532,
|
|
"epss_pct": 0.99371,
|
|
"name": "WordPress WPS Hide Login <1.9.1 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24917.yaml"
|
|
},
|
|
"CVE-2021-24926": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12857,
|
|
"epss_pct": 0.96013,
|
|
"name": "WordPress Domain Check <1.0.17 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24926.yaml"
|
|
},
|
|
"CVE-2021-24931": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.78812,
|
|
"epss_pct": 0.9956,
|
|
"name": "WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24931.yaml"
|
|
},
|
|
"CVE-2021-24934": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01397,
|
|
"epss_pct": 0.70508,
|
|
"name": "Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24934.yaml"
|
|
},
|
|
"CVE-2021-24940": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01439,
|
|
"epss_pct": 0.71305,
|
|
"name": "WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24940.yaml"
|
|
},
|
|
"CVE-2021-24943": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07474,
|
|
"epss_pct": 0.94027,
|
|
"name": "Registrations for the Events Calendar < 2.7.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24943.yaml"
|
|
},
|
|
"CVE-2021-24946": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.728,
|
|
"epss_pct": 0.99407,
|
|
"name": "WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24946.yaml"
|
|
},
|
|
"CVE-2021-24947": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.03089,
|
|
"epss_pct": 0.86776,
|
|
"name": "WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24947.yaml"
|
|
},
|
|
"CVE-2021-24956": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01439,
|
|
"epss_pct": 0.71305,
|
|
"name": "Blog2Social < 6.8.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24956.yaml"
|
|
},
|
|
"CVE-2021-24970": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05898,
|
|
"epss_pct": 0.92697,
|
|
"name": "WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24970.yaml"
|
|
},
|
|
"CVE-2021-24979": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01868,
|
|
"epss_pct": 0.7783,
|
|
"name": "Paid Memberships Pro < 2.6.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24979.yaml"
|
|
},
|
|
"CVE-2021-24987": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01938,
|
|
"epss_pct": 0.78654,
|
|
"name": "WordPress Super Socializer <7.13.30 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24987.yaml"
|
|
},
|
|
"CVE-2021-24991": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01188,
|
|
"epss_pct": 0.657,
|
|
"name": "WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24991.yaml"
|
|
},
|
|
"CVE-2021-24997": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02753,
|
|
"epss_pct": 0.85188,
|
|
"name": "WordPress Guppy <=1.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24997.yaml"
|
|
},
|
|
"CVE-2021-25003": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.56148,
|
|
"epss_pct": 0.98975,
|
|
"name": "WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25003.yaml"
|
|
},
|
|
"CVE-2021-25008": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02258,
|
|
"epss_pct": 0.8174,
|
|
"name": "The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25008.yaml"
|
|
},
|
|
"CVE-2021-25016": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01798,
|
|
"epss_pct": 0.76903,
|
|
"name": "Chaty < 2.8.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25016.yaml"
|
|
},
|
|
"CVE-2021-25028": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01932,
|
|
"epss_pct": 0.78581,
|
|
"name": "WordPress Event Tickets < 5.2.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25028.yaml"
|
|
},
|
|
"CVE-2021-25032": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.06691,
|
|
"epss_pct": 0.93426,
|
|
"name": "PublishPress Capabilities < 2.3.1 - Missing Authorization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25032.yaml"
|
|
},
|
|
"CVE-2021-25033": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02303,
|
|
"epss_pct": 0.82117,
|
|
"name": "Noptin < 1.6.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25033.yaml"
|
|
},
|
|
"CVE-2021-25052": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.02985,
|
|
"epss_pct": 0.86346,
|
|
"name": "WordPress Button Generator <2.3.3 - Remote File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25052.yaml"
|
|
},
|
|
"CVE-2021-25055": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0201,
|
|
"epss_pct": 0.7948,
|
|
"name": "WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25055.yaml"
|
|
},
|
|
"CVE-2021-25063": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0208,
|
|
"epss_pct": 0.8018,
|
|
"name": "WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25063.yaml"
|
|
},
|
|
"CVE-2021-25065": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01217,
|
|
"epss_pct": 0.66468,
|
|
"name": "Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25065.yaml"
|
|
},
|
|
"CVE-2021-25067": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01096,
|
|
"epss_pct": 0.63218,
|
|
"name": "Landing Page Builder < 1.4.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25067.yaml"
|
|
},
|
|
"CVE-2021-25074": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02161,
|
|
"epss_pct": 0.80925,
|
|
"name": "WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25074.yaml"
|
|
},
|
|
"CVE-2021-25075": {
|
|
"cvss": 3.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01364,
|
|
"epss_pct": 0.69845,
|
|
"name": "WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25075.yaml"
|
|
},
|
|
"CVE-2021-25078": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02288,
|
|
"epss_pct": 0.81982,
|
|
"name": "Affiliates Manager < 2.9.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25078.yaml"
|
|
},
|
|
"CVE-2021-25079": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0682,
|
|
"epss_pct": 0.93539,
|
|
"name": "Contact Form Entries < 1.2.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25079.yaml"
|
|
},
|
|
"CVE-2021-25082": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.05229,
|
|
"epss_pct": 0.91929,
|
|
"name": "WordPress Popup Builder < 4.0.7 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25082.yaml"
|
|
},
|
|
"CVE-2021-25085": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01651,
|
|
"epss_pct": 0.74844,
|
|
"name": "WOOF WordPress plugin - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25085.yaml"
|
|
},
|
|
"CVE-2021-25094": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.83354,
|
|
"epss_pct": 0.99656,
|
|
"name": "Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25094.yaml"
|
|
},
|
|
"CVE-2021-25099": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02145,
|
|
"epss_pct": 0.80784,
|
|
"name": "WordPress GiveWP <2.17.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25099.yaml"
|
|
},
|
|
"CVE-2021-25104": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01418,
|
|
"epss_pct": 0.70915,
|
|
"name": "WordPress Ocean Extra <1.9.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25104.yaml"
|
|
},
|
|
"CVE-2021-25111": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01908,
|
|
"epss_pct": 0.78309,
|
|
"name": "WordPress English Admin <1.5.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25111.yaml"
|
|
},
|
|
"CVE-2021-25112": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02187,
|
|
"epss_pct": 0.81143,
|
|
"name": "WordPress WHMCS Bridge <6.4b - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25112.yaml"
|
|
},
|
|
"CVE-2021-25114": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.81828,
|
|
"epss_pct": 0.99621,
|
|
"name": "WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25114.yaml"
|
|
},
|
|
"CVE-2021-25118": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.05632,
|
|
"epss_pct": 0.92401,
|
|
"name": "Yoast SEO 16.7-17.2 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25118.yaml"
|
|
},
|
|
"CVE-2021-25120": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02909,
|
|
"epss_pct": 0.86014,
|
|
"name": "Easy Social Feed < 6.2.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25120.yaml"
|
|
},
|
|
"CVE-2021-25161": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.16372,
|
|
"epss_pct": 0.96733,
|
|
"name": "Aruba Instant Access Point (IAP) - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25161.yaml"
|
|
},
|
|
"CVE-2021-25281": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.7313,
|
|
"epss_pct": 0.99416,
|
|
"name": "SaltStack Salt <3002.5 - Auth Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25281.yaml"
|
|
},
|
|
"CVE-2021-25296": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.72182,
|
|
"epss_pct": 0.99389,
|
|
"name": "Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25296.yaml"
|
|
},
|
|
"CVE-2021-25297": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.56659,
|
|
"epss_pct": 0.98989,
|
|
"name": "Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25297.yaml"
|
|
},
|
|
"CVE-2021-25298": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.75148,
|
|
"epss_pct": 0.99473,
|
|
"name": "Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25298.yaml"
|
|
},
|
|
"CVE-2021-25299": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.9776,
|
|
"epss_pct": 0.99901,
|
|
"name": "Nagios XI 5.7.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25299.yaml"
|
|
},
|
|
"CVE-2021-25646": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.99001,
|
|
"epss_pct": 0.99928,
|
|
"name": "Apache Druid - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25646.yaml"
|
|
},
|
|
"CVE-2021-25864": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09331,
|
|
"epss_pct": 0.95018,
|
|
"name": "Hue Magic 3.0.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25864.yaml"
|
|
},
|
|
"CVE-2021-25899": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12245,
|
|
"epss_pct": 0.95883,
|
|
"name": "Void Aural Rec Monitor 9.0.0.1 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25899.yaml"
|
|
},
|
|
"CVE-2021-26072": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.38845,
|
|
"epss_pct": 0.98479,
|
|
"name": "Atlassian Confluence < 5.8.6 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26072.yaml"
|
|
},
|
|
"CVE-2021-26084": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99992,
|
|
"name": "Confluence Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26084.yaml"
|
|
},
|
|
"CVE-2021-26085": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.99937,
|
|
"epss_pct": 0.9997,
|
|
"name": "Atlassian Confluence Server - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26085.yaml"
|
|
},
|
|
"CVE-2021-26086": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99991,
|
|
"name": "Atlassian Jira Limited - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26086.yaml"
|
|
},
|
|
"CVE-2021-26247": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07124,
|
|
"epss_pct": 0.93791,
|
|
"name": "Cacti - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26247.yaml"
|
|
},
|
|
"CVE-2021-26294": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16899,
|
|
"epss_pct": 0.96826,
|
|
"name": "AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26294.yaml"
|
|
},
|
|
"CVE-2021-26295": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.97822,
|
|
"epss_pct": 0.99901,
|
|
"name": "Apache OFBiz <17.12.06 - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yaml"
|
|
},
|
|
"CVE-2021-26475": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07326,
|
|
"epss_pct": 0.93938,
|
|
"name": "EPrints 3.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26475.yaml"
|
|
},
|
|
"CVE-2021-26598": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.10528,
|
|
"epss_pct": 0.95435,
|
|
"name": "ImpressCMS <1.4.3 - Incorrect Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26598.yaml"
|
|
},
|
|
"CVE-2021-26599": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.20968,
|
|
"epss_pct": 0.97386,
|
|
"name": "ImpressCMS < 1.4.3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26599.yaml"
|
|
},
|
|
"CVE-2021-26702": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03072,
|
|
"epss_pct": 0.86713,
|
|
"name": "EPrints 3.4.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26702.yaml"
|
|
},
|
|
"CVE-2021-26710": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.075,
|
|
"epss_pct": 0.94045,
|
|
"name": "Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26710.yaml"
|
|
},
|
|
"CVE-2021-26723": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12578,
|
|
"epss_pct": 0.95947,
|
|
"name": "Jenzabar 9.2x-9.2.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26723.yaml"
|
|
},
|
|
"CVE-2021-26812": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.97461,
|
|
"epss_pct": 0.99896,
|
|
"name": "Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26812.yaml"
|
|
},
|
|
"CVE-2021-26855": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.99996,
|
|
"epss_pct": 0.99989,
|
|
"name": "Microsoft Exchange Server SSRF Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml"
|
|
},
|
|
"CVE-2021-26947": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0141,
|
|
"epss_pct": 0.70768,
|
|
"name": "Odoo <= 15.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26947.yaml"
|
|
},
|
|
"CVE-2021-27124": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05721,
|
|
"epss_pct": 0.92497,
|
|
"name": "Doctor Appointment System 1.0 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27124.yaml"
|
|
},
|
|
"CVE-2021-27132": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.16062,
|
|
"epss_pct": 0.96682,
|
|
"name": "Sercomm VD625 Smart Modems - CRLF Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27132.yaml"
|
|
},
|
|
"CVE-2021-27309": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01977,
|
|
"epss_pct": 0.79069,
|
|
"name": "Clansphere CMS 2011.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27309.yaml"
|
|
},
|
|
"CVE-2021-27310": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02816,
|
|
"epss_pct": 0.85548,
|
|
"name": "Clansphere CMS 2011.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27310.yaml"
|
|
},
|
|
"CVE-2021-27314": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12394,
|
|
"epss_pct": 0.95911,
|
|
"name": "Doctor Appointment System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27314.yaml"
|
|
},
|
|
"CVE-2021-27315": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07826,
|
|
"epss_pct": 0.94244,
|
|
"name": "Doctor Appointment System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27315.yaml"
|
|
},
|
|
"CVE-2021-27316": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07826,
|
|
"epss_pct": 0.94245,
|
|
"name": "Doctor Appointment System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27316.yaml"
|
|
},
|
|
"CVE-2021-27319": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07826,
|
|
"epss_pct": 0.94245,
|
|
"name": "Doctor Appointment System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27319.yaml"
|
|
},
|
|
"CVE-2021-27320": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09299,
|
|
"epss_pct": 0.95007,
|
|
"name": "Doctor Appointment System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27320.yaml"
|
|
},
|
|
"CVE-2021-27330": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06196,
|
|
"epss_pct": 0.92996,
|
|
"name": "Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27330.yaml"
|
|
},
|
|
"CVE-2021-27358": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.83042,
|
|
"epss_pct": 0.99651,
|
|
"name": "Grafana Unauthenticated Snapshot Creation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27358.yaml"
|
|
},
|
|
"CVE-2021-27519": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07604,
|
|
"epss_pct": 0.94113,
|
|
"name": "FUDForum 3.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27519.yaml"
|
|
},
|
|
"CVE-2021-27520": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06396,
|
|
"epss_pct": 0.93176,
|
|
"name": "FUDForum 3.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27520.yaml"
|
|
},
|
|
"CVE-2021-27561": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.82865,
|
|
"epss_pct": 0.99647,
|
|
"name": "YeaLink DM 3.6.0.20 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27561.yaml"
|
|
},
|
|
"CVE-2021-27651": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.53841,
|
|
"epss_pct": 0.98923,
|
|
"name": "Pega Infinity - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27651.yaml"
|
|
},
|
|
"CVE-2021-27670": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.61274,
|
|
"epss_pct": 0.99097,
|
|
"name": "Appspace 6.2.4 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27670.yaml"
|
|
},
|
|
"CVE-2021-27850": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.93471,
|
|
"epss_pct": 0.99834,
|
|
"name": "Apache Tapestry - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27850.yaml"
|
|
},
|
|
"CVE-2021-27856": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.05598,
|
|
"epss_pct": 0.92352,
|
|
"name": "FatPipe WARP/IPVPN/MPVPN - Backdoor Account",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27856.yaml"
|
|
},
|
|
"CVE-2021-27858": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02703,
|
|
"epss_pct": 0.84889,
|
|
"name": "FatPipe WARP/IPVPN/MPVPN - Authorization Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27858.yaml"
|
|
},
|
|
"CVE-2021-27877": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"epss": 0.6491,
|
|
"epss_pct": 0.99188,
|
|
"name": "Veritas Backup Exec - Broken Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-27877.yaml"
|
|
},
|
|
"CVE-2021-27905": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.93053,
|
|
"epss_pct": 0.99826,
|
|
"name": "Apache Solr <=8.8.1 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27905.yaml"
|
|
},
|
|
"CVE-2021-27909": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04067,
|
|
"epss_pct": 0.89947,
|
|
"name": "Mautic <3.3.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27909.yaml"
|
|
},
|
|
"CVE-2021-27931": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.18132,
|
|
"epss_pct": 0.9699,
|
|
"name": "LumisXP <10.0.0 - Blind XML External Entity Attack",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27931.yaml"
|
|
},
|
|
"CVE-2021-27964": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.47519,
|
|
"epss_pct": 0.98756,
|
|
"name": "SonLogger - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27964.yaml"
|
|
},
|
|
"CVE-2021-28149": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1592,
|
|
"epss_pct": 0.96654,
|
|
"name": "Hongdian H8922 3.0.5 Devices - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28149.yaml"
|
|
},
|
|
"CVE-2021-28150": {
|
|
"cvss": 5.5,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.02794,
|
|
"epss_pct": 0.85428,
|
|
"name": "Hongdian H8922 3.0.5 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28150.yaml"
|
|
},
|
|
"CVE-2021-28151": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.27912,
|
|
"epss_pct": 0.97957,
|
|
"name": "Hongdian H8922 3.0.5 - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28151.yaml"
|
|
},
|
|
"CVE-2021-28164": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.82371,
|
|
"epss_pct": 0.99637,
|
|
"name": "Eclipse Jetty - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28164.yaml"
|
|
},
|
|
"CVE-2021-28169": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.7848,
|
|
"epss_pct": 0.99551,
|
|
"name": "Eclipse Jetty ConcatServlet - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28169.yaml"
|
|
},
|
|
"CVE-2021-28377": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08389,
|
|
"epss_pct": 0.94572,
|
|
"name": "Joomla! ChronoForums 2.0.11 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28377.yaml"
|
|
},
|
|
"CVE-2021-28480": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.71425,
|
|
"epss_pct": 0.99367,
|
|
"name": "Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28480.yaml"
|
|
},
|
|
"CVE-2021-28481": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.36486,
|
|
"epss_pct": 0.98377,
|
|
"name": "Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28481.yaml"
|
|
},
|
|
"CVE-2021-28799": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.7825,
|
|
"epss_pct": 0.99544,
|
|
"name": "QNAP HBS 3 - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28799.yaml"
|
|
},
|
|
"CVE-2021-28918": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-704",
|
|
"epss": 0.16657,
|
|
"epss_pct": 0.96791,
|
|
"name": "Netmask NPM Package - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28918.yaml"
|
|
},
|
|
"CVE-2021-28937": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-312",
|
|
"epss": 0.04155,
|
|
"epss_pct": 0.90146,
|
|
"name": "Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28937.yaml"
|
|
},
|
|
"CVE-2021-29006": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05603,
|
|
"epss_pct": 0.92359,
|
|
"name": "rConfig 3.9.6 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29006.yaml"
|
|
},
|
|
"CVE-2021-29156": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.76385,
|
|
"epss_pct": 0.995,
|
|
"name": "LDAP Injection In OpenAM",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29156.yaml"
|
|
},
|
|
"CVE-2021-29200": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.5537,
|
|
"epss_pct": 0.9896,
|
|
"name": "Apache OFBiz < 17.12.07 - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29200.yaml"
|
|
},
|
|
"CVE-2021-29203": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.68293,
|
|
"epss_pct": 0.99277,
|
|
"name": "HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29203.yaml"
|
|
},
|
|
"CVE-2021-29441": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-290",
|
|
"epss": 0.87747,
|
|
"epss_pct": 0.99748,
|
|
"name": "Nacos <1.4.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29441.yaml"
|
|
},
|
|
"CVE-2021-29442": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.6663,
|
|
"epss_pct": 0.99231,
|
|
"name": "Nacos <1.4.1 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29442.yaml"
|
|
},
|
|
"CVE-2021-29484": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07935,
|
|
"epss_pct": 0.94315,
|
|
"name": "Ghost CMS <=4.32 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29484.yaml"
|
|
},
|
|
"CVE-2021-29490": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.69856,
|
|
"epss_pct": 0.9932,
|
|
"name": "Jellyfin 10.7.2 - Server Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29490.yaml"
|
|
},
|
|
"CVE-2021-29505": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.77232,
|
|
"epss_pct": 0.99518,
|
|
"name": "XStream <1.4.17 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29505.yaml"
|
|
},
|
|
"CVE-2021-29622": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.1956,
|
|
"epss_pct": 0.97187,
|
|
"name": "Prometheus - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29622.yaml"
|
|
},
|
|
"CVE-2021-29625": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09572,
|
|
"epss_pct": 0.95113,
|
|
"name": "Adminer <=4.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29625.yaml"
|
|
},
|
|
"CVE-2021-3002": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04278,
|
|
"epss_pct": 0.90401,
|
|
"name": "Seo Panel 4.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3002.yaml"
|
|
},
|
|
"CVE-2021-30047": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.03213,
|
|
"epss_pct": 0.87296,
|
|
"name": "vsftpd < 3.0.3 - DoS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-30047.yaml"
|
|
},
|
|
"CVE-2021-30049": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0247,
|
|
"epss_pct": 0.83368,
|
|
"name": "SysAid Technologies 20.3.64 b14 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30049.yaml"
|
|
},
|
|
"CVE-2021-3007": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.75313,
|
|
"epss_pct": 0.99476,
|
|
"name": "Laminas Project laminas-http - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3007.yaml"
|
|
},
|
|
"CVE-2021-30116": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.85735,
|
|
"epss_pct": 0.9971,
|
|
"name": "Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30116.yaml"
|
|
},
|
|
"CVE-2021-30118": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.60348,
|
|
"epss_pct": 0.99074,
|
|
"name": "Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30118.yaml"
|
|
},
|
|
"CVE-2021-30128": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.81209,
|
|
"epss_pct": 0.99607,
|
|
"name": "Apache OFBiz <17.12.07 - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30128.yaml"
|
|
},
|
|
"CVE-2021-30134": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01261,
|
|
"epss_pct": 0.67554,
|
|
"name": "Php-mod/curl Library <2.3.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30134.yaml"
|
|
},
|
|
"CVE-2021-30151": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04158,
|
|
"epss_pct": 0.90153,
|
|
"name": "Sidekiq <=6.2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30151.yaml"
|
|
},
|
|
"CVE-2021-3017": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.63023,
|
|
"epss_pct": 0.99138,
|
|
"name": "Intelbras WIN 300/WRN 342 - Credentials Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3017.yaml"
|
|
},
|
|
"CVE-2021-30175": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08548,
|
|
"epss_pct": 0.94666,
|
|
"name": "ZEROF Web Server 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30175.yaml"
|
|
},
|
|
"CVE-2021-3018": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.19506,
|
|
"epss_pct": 0.97179,
|
|
"name": "IPeakCMS 3.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3018.yaml"
|
|
},
|
|
"CVE-2021-3019": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16622,
|
|
"epss_pct": 0.96786,
|
|
"name": "ffay lanproxy Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3019.yaml"
|
|
},
|
|
"CVE-2021-30203": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00596,
|
|
"epss_pct": 0.46104,
|
|
"name": "Dzzoffice 2.02.1 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30203.yaml"
|
|
},
|
|
"CVE-2021-30213": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02721,
|
|
"epss_pct": 0.8499,
|
|
"name": "Knowage Suite 7.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30213.yaml"
|
|
},
|
|
"CVE-2021-30461": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.36632,
|
|
"epss_pct": 0.98384,
|
|
"name": "VoipMonitor <24.61 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30461.yaml"
|
|
},
|
|
"CVE-2021-30497": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.9658,
|
|
"epss_pct": 0.99879,
|
|
"name": "Ivanti Avalanche 6.3.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30497.yaml"
|
|
},
|
|
"CVE-2021-3110": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.20695,
|
|
"epss_pct": 0.97352,
|
|
"name": "PrestaShop 1.7.7.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3110.yaml"
|
|
},
|
|
"CVE-2021-31195": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.73676,
|
|
"epss_pct": 0.99432,
|
|
"name": "Microsoft Exchange Server - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31195.yaml"
|
|
},
|
|
"CVE-2021-3122": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.8727,
|
|
"epss_pct": 0.99738,
|
|
"name": "NCR Command Center Agent 16.3 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-3122.yaml"
|
|
},
|
|
"CVE-2021-31249": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.18003,
|
|
"epss_pct": 0.96976,
|
|
"name": "CHIYU TCP/IP Converter - Carriage Return Line Feed Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31249.yaml"
|
|
},
|
|
"CVE-2021-31250": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.79605,
|
|
"epss_pct": 0.99575,
|
|
"name": "CHIYU TCP/IP Converter - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31250.yaml"
|
|
},
|
|
"CVE-2021-3129": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99943,
|
|
"epss_pct": 0.99972,
|
|
"name": "Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3129.yaml"
|
|
},
|
|
"CVE-2021-31316": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13029,
|
|
"epss_pct": 0.96059,
|
|
"name": "CentOS Web Panel - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31316.yaml"
|
|
},
|
|
"CVE-2021-31324": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.34062,
|
|
"epss_pct": 0.98281,
|
|
"name": "CentOS Web Panel - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31324.yaml"
|
|
},
|
|
"CVE-2021-3152": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02231,
|
|
"epss_pct": 0.81525,
|
|
"name": "Home Assistant HACS - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3152.yaml"
|
|
},
|
|
"CVE-2021-31537": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07781,
|
|
"epss_pct": 0.94221,
|
|
"name": "SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31537.yaml"
|
|
},
|
|
"CVE-2021-3156": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-193",
|
|
"epss": 0.99969,
|
|
"epss_pct": 0.99977,
|
|
"name": "Sudo Baron Samedit - Local Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2021/CVE-2021-3156.yaml"
|
|
},
|
|
"CVE-2021-31581": {
|
|
"cvss": 4.4,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.01217,
|
|
"epss_pct": 0.66467,
|
|
"name": "Akkadian Provisioning Manager - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31581.yaml"
|
|
},
|
|
"CVE-2021-31589": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.28207,
|
|
"epss_pct": 0.97974,
|
|
"name": "BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31589.yaml"
|
|
},
|
|
"CVE-2021-31602": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.51653,
|
|
"epss_pct": 0.98863,
|
|
"name": "Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31602.yaml"
|
|
},
|
|
"CVE-2021-31682": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.10509,
|
|
"epss_pct": 0.95429,
|
|
"name": "WebCTRL OEM <= 6.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31682.yaml"
|
|
},
|
|
"CVE-2021-31755": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-787",
|
|
"epss": 0.86777,
|
|
"epss_pct": 0.99729,
|
|
"name": "Tenda Router AC11 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31755.yaml"
|
|
},
|
|
"CVE-2021-31805": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.85433,
|
|
"epss_pct": 0.99704,
|
|
"name": "Apache Struts2 S2-062 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31805.yaml"
|
|
},
|
|
"CVE-2021-31856": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.75384,
|
|
"epss_pct": 0.99478,
|
|
"name": "Layer5 Meshery 0.5.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31856.yaml"
|
|
},
|
|
"CVE-2021-31862": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03985,
|
|
"epss_pct": 0.89765,
|
|
"name": "SysAid 20.4.74 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31862.yaml"
|
|
},
|
|
"CVE-2021-32030": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99393,
|
|
"epss_pct": 0.99938,
|
|
"name": "ASUS GT-AC2900 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32030.yaml"
|
|
},
|
|
"CVE-2021-32172": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.66433,
|
|
"epss_pct": 0.99224,
|
|
"name": "Maian Cart <=3.8 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32172.yaml"
|
|
},
|
|
"CVE-2021-3223": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18512,
|
|
"epss_pct": 0.9704,
|
|
"name": "Node RED Dashboard <2.26.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3223.yaml"
|
|
},
|
|
"CVE-2021-32305": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.8719,
|
|
"epss_pct": 0.99736,
|
|
"name": "Websvn <2.6.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32305.yaml"
|
|
},
|
|
"CVE-2021-3239": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"name": "E-Learning System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3239.yaml"
|
|
},
|
|
"CVE-2021-32478": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01128,
|
|
"epss_pct": 0.64055,
|
|
"name": "Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32478.yaml"
|
|
},
|
|
"CVE-2021-32618": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03289,
|
|
"epss_pct": 0.87608,
|
|
"name": "Python Flask-Security - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32618.yaml"
|
|
},
|
|
"CVE-2021-32648": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"epss": 0.90418,
|
|
"epss_pct": 0.99791,
|
|
"name": "OctoberCMS - Account Takeover",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32648.yaml"
|
|
},
|
|
"CVE-2021-32682": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.69934,
|
|
"epss_pct": 0.99322,
|
|
"name": "elFinder 2.1.58 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32682.yaml"
|
|
},
|
|
"CVE-2021-32789": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.17227,
|
|
"epss_pct": 0.96875,
|
|
"name": "WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32789.yaml"
|
|
},
|
|
"CVE-2021-32819": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"epss": 0.59844,
|
|
"epss_pct": 0.99063,
|
|
"name": "Nodejs Squirrelly - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32819.yaml"
|
|
},
|
|
"CVE-2021-32820": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"epss": 0.17988,
|
|
"epss_pct": 0.96972,
|
|
"name": "Express-handlebars - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32820.yaml"
|
|
},
|
|
"CVE-2021-32853": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03125,
|
|
"epss_pct": 0.86931,
|
|
"name": "Erxes <0.23.0 - Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32853.yaml"
|
|
},
|
|
"CVE-2021-3287": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.51332,
|
|
"epss_pct": 0.98855,
|
|
"name": "Zoho ManageEngine OpManager < 12.5.329 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3287.yaml"
|
|
},
|
|
"CVE-2021-3293": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20658,
|
|
"epss_pct": 0.97345,
|
|
"name": "emlog 5.3.1 Path Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3293.yaml"
|
|
},
|
|
"CVE-2021-3297": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.20514,
|
|
"epss_pct": 0.97328,
|
|
"name": "Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3297.yaml"
|
|
},
|
|
"CVE-2021-33044": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99871,
|
|
"epss_pct": 0.99961,
|
|
"name": "Dahua IPC/VTH/VTO - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33044.yaml"
|
|
},
|
|
"CVE-2021-33045": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99556,
|
|
"epss_pct": 0.99944,
|
|
"name": "Dahua IPC/VTH/VTO - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33045.yaml"
|
|
},
|
|
"CVE-2021-33221": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.56076,
|
|
"epss_pct": 0.98974,
|
|
"name": "CommScope Ruckus IoT Controller - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33221.yaml"
|
|
},
|
|
"CVE-2021-33357": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.17446,
|
|
"epss_pct": 0.96904,
|
|
"name": "RaspAP <=2.6.5 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33357.yaml"
|
|
},
|
|
"CVE-2021-33544": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.953,
|
|
"epss_pct": 0.99859,
|
|
"name": "Geutebruck - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33544.yaml"
|
|
},
|
|
"CVE-2021-33558": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.12307,
|
|
"epss_pct": 0.95898,
|
|
"name": "Boa 0.94.13 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33558.yaml"
|
|
},
|
|
"CVE-2021-33564": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-88",
|
|
"epss": 0.72143,
|
|
"epss_pct": 0.99387,
|
|
"name": "Ruby Dragonfly <1.4.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33564.yaml"
|
|
},
|
|
"CVE-2021-33690": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.69075,
|
|
"epss_pct": 0.993,
|
|
"name": "SAP NetWeaver Development Infrastructure - Server Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33690.yaml"
|
|
},
|
|
"CVE-2021-3374": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14424,
|
|
"epss_pct": 0.96364,
|
|
"name": "Rstudio Shiny Server <1.5.16 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3374.yaml"
|
|
},
|
|
"CVE-2021-33766": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"epss": 0.98136,
|
|
"epss_pct": 0.9991,
|
|
"name": "Microsoft Exchange - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33766.yaml"
|
|
},
|
|
"CVE-2021-3377": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08,
|
|
"epss_pct": 0.94347,
|
|
"name": "npm ansi_up v4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3377.yaml"
|
|
},
|
|
"CVE-2021-3378": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.97512,
|
|
"epss_pct": 0.99896,
|
|
"name": "FortiLogger 4.4.2.2 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3378.yaml"
|
|
},
|
|
"CVE-2021-33807": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16139,
|
|
"epss_pct": 0.96694,
|
|
"name": "Cartadis Gespage 8.2.1 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33807.yaml"
|
|
},
|
|
"CVE-2021-33829": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03189,
|
|
"epss_pct": 0.87184,
|
|
"name": "Drupal 7 CKEditor XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33829.yaml"
|
|
},
|
|
"CVE-2021-33851": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01318,
|
|
"epss_pct": 0.68813,
|
|
"name": "WordPress Customize Login Image <3.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33851.yaml"
|
|
},
|
|
"CVE-2021-33904": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09972,
|
|
"epss_pct": 0.95258,
|
|
"name": "Accela Civic Platform <=21.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33904.yaml"
|
|
},
|
|
"CVE-2021-34187": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.16181,
|
|
"epss_pct": 0.96702,
|
|
"name": "Chamilo model.ajax.php - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34187.yaml"
|
|
},
|
|
"CVE-2021-34370": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09996,
|
|
"epss_pct": 0.95265,
|
|
"name": "Accela Civic Platform <=21.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34370.yaml"
|
|
},
|
|
"CVE-2021-34427": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.57982,
|
|
"epss_pct": 0.99019,
|
|
"name": "Eclipse BIRT Viewer - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34427.yaml"
|
|
},
|
|
"CVE-2021-34429": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.99298,
|
|
"epss_pct": 0.99936,
|
|
"name": "Eclipse Jetty - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34429.yaml"
|
|
},
|
|
"CVE-2021-34473": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99997,
|
|
"name": "Exchange Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml"
|
|
},
|
|
"CVE-2021-34621": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.68862,
|
|
"epss_pct": 0.99293,
|
|
"name": "WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34621.yaml"
|
|
},
|
|
"CVE-2021-34622": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.0412,
|
|
"epss_pct": 0.90065,
|
|
"name": "WordPress ProfilePress <= 3.1.3 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34622.yaml"
|
|
},
|
|
"CVE-2021-34624": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.06744,
|
|
"epss_pct": 0.93484,
|
|
"name": "WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34624.yaml"
|
|
},
|
|
"CVE-2021-34630": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01572,
|
|
"epss_pct": 0.7365,
|
|
"name": "GTranslate < 2.8.65 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34630.yaml"
|
|
},
|
|
"CVE-2021-34640": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02313,
|
|
"epss_pct": 0.82199,
|
|
"name": "WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34640.yaml"
|
|
},
|
|
"CVE-2021-34643": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0235,
|
|
"epss_pct": 0.82497,
|
|
"name": "WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34643.yaml"
|
|
},
|
|
"CVE-2021-34805": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.26823,
|
|
"epss_pct": 0.97885,
|
|
"name": "FAUST iServer 9.0.018.018.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34805.yaml"
|
|
},
|
|
"CVE-2021-35042": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.44369,
|
|
"epss_pct": 0.98667,
|
|
"name": "Django QuerySet.order_by - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2021/CVE-2021-35042.yaml"
|
|
},
|
|
"CVE-2021-35064": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.70753,
|
|
"epss_pct": 0.99349,
|
|
"name": "Kramer VIAware - Privilege Escalation and Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35064.yaml"
|
|
},
|
|
"CVE-2021-35211": {
|
|
"name": "SolarWinds Serv-U FTP - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35211.yaml"
|
|
},
|
|
"CVE-2021-35250": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12804,
|
|
"epss_pct": 0.95998,
|
|
"name": "SolarWinds Serv-U 15.3 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35250.yaml"
|
|
},
|
|
"CVE-2021-35265": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03436,
|
|
"epss_pct": 0.88119,
|
|
"name": "MaxSite CMS > V106 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35265.yaml"
|
|
},
|
|
"CVE-2021-35323": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05621,
|
|
"epss_pct": 0.92393,
|
|
"name": "Bludit 3.13.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35323.yaml"
|
|
},
|
|
"CVE-2021-35336": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.10107,
|
|
"epss_pct": 0.95302,
|
|
"name": "Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35336.yaml"
|
|
},
|
|
"CVE-2021-35380": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.38954,
|
|
"epss_pct": 0.98482,
|
|
"name": "TermTalk Server 3.24.0.2 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35380.yaml"
|
|
},
|
|
"CVE-2021-35394": {
|
|
"epss": 0.99861,
|
|
"epss_pct": 0.9996,
|
|
"name": "RealTek AP Router SDK - Arbitrary Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35394.yaml"
|
|
},
|
|
"CVE-2021-35395": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.97961,
|
|
"epss_pct": 0.99906,
|
|
"name": "RealTek Jungle SDK - Arbitrary Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35395.yaml"
|
|
},
|
|
"CVE-2021-35464": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99993,
|
|
"name": "ForgeRock OpenAM <7.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35464.yaml"
|
|
},
|
|
"CVE-2021-35488": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02628,
|
|
"epss_pct": 0.84417,
|
|
"name": "Thruk 2.40-2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35488.yaml"
|
|
},
|
|
"CVE-2021-35587": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.96284,
|
|
"epss_pct": 0.99875,
|
|
"name": "Oracle Access Manager - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35587.yaml"
|
|
},
|
|
"CVE-2021-3577": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.60158,
|
|
"epss_pct": 0.99068,
|
|
"name": "Motorola Baby Monitors - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3577.yaml"
|
|
},
|
|
"CVE-2021-36260": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99869,
|
|
"epss_pct": 0.99961,
|
|
"name": "Hikvision IP camera/NVR - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36260.yaml"
|
|
},
|
|
"CVE-2021-36356": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.54393,
|
|
"epss_pct": 0.98936,
|
|
"name": "Kramer VIAware - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36356.yaml"
|
|
},
|
|
"CVE-2021-36380": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97599,
|
|
"epss_pct": 0.99897,
|
|
"name": "Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36380.yaml"
|
|
},
|
|
"CVE-2021-36450": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.64294,
|
|
"epss_pct": 0.99171,
|
|
"name": "Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36450.yaml"
|
|
},
|
|
"CVE-2021-3654": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.26792,
|
|
"epss_pct": 0.97884,
|
|
"name": "Nova noVNC - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3654.yaml"
|
|
},
|
|
"CVE-2021-36580": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01588,
|
|
"epss_pct": 0.7387,
|
|
"name": "IceWarp Mail Server - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36580.yaml"
|
|
},
|
|
"CVE-2021-36646": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00705,
|
|
"epss_pct": 0.50814,
|
|
"name": "KodExplorer - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36646.yaml"
|
|
},
|
|
"CVE-2021-36748": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.15415,
|
|
"epss_pct": 0.96538,
|
|
"name": "PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36748.yaml"
|
|
},
|
|
"CVE-2021-36749": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.81038,
|
|
"epss_pct": 0.99602,
|
|
"name": "Apache Druid - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36749.yaml"
|
|
},
|
|
"CVE-2021-36754": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-119",
|
|
"epss": 0.64857,
|
|
"epss_pct": 0.99187,
|
|
"name": "PowerDNS Authoritative Server - Denial of Service",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-36754.yaml"
|
|
},
|
|
"CVE-2021-36873": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01225,
|
|
"epss_pct": 0.66714,
|
|
"name": "WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36873.yaml"
|
|
},
|
|
"CVE-2021-36888": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.0674,
|
|
"epss_pct": 0.93477,
|
|
"name": "WordPress Image Hover Ultimate - Unauthenticated Settings Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36888.yaml"
|
|
},
|
|
"CVE-2021-37216": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03186,
|
|
"epss_pct": 0.87176,
|
|
"name": "QSAN Storage Manager <3.3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37216.yaml"
|
|
},
|
|
"CVE-2021-37291": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06535,
|
|
"epss_pct": 0.93305,
|
|
"name": "KevinLAB BEMS 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37291.yaml"
|
|
},
|
|
"CVE-2021-37292": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.0655,
|
|
"epss_pct": 0.93319,
|
|
"name": "KevinLAB BEMS (Building Energy Management System) - Backdoor Account",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37292.yaml"
|
|
},
|
|
"CVE-2021-37304": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.04013,
|
|
"epss_pct": 0.89833,
|
|
"name": "Jeecg Boot <= 2.4.5 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37304.yaml"
|
|
},
|
|
"CVE-2021-37305": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.0352,
|
|
"epss_pct": 0.88392,
|
|
"name": "Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37305.yaml"
|
|
},
|
|
"CVE-2021-37415": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.99825,
|
|
"epss_pct": 0.99958,
|
|
"name": "Zoho ManageEngine ServiceDesk Plus - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37415.yaml"
|
|
},
|
|
"CVE-2021-37416": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02934,
|
|
"epss_pct": 0.86122,
|
|
"name": "Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37416.yaml"
|
|
},
|
|
"CVE-2021-37538": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.74489,
|
|
"epss_pct": 0.99455,
|
|
"name": "PrestaShop SmartBlog <4.0.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37538.yaml"
|
|
},
|
|
"CVE-2021-37573": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03398,
|
|
"epss_pct": 0.87987,
|
|
"name": "Tiny Java Web Server - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37573.yaml"
|
|
},
|
|
"CVE-2021-37580": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.40058,
|
|
"epss_pct": 0.98527,
|
|
"name": "Apache ShenYu Admin JWT - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37580.yaml"
|
|
},
|
|
"CVE-2021-37589": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.32662,
|
|
"epss_pct": 0.98217,
|
|
"name": "Virtua Software Cobranca <12R - Blind SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37589.yaml"
|
|
},
|
|
"CVE-2021-37598": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.0235,
|
|
"epss_pct": 0.82493,
|
|
"name": "WP Cerber < 8.9.3 - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37598.yaml"
|
|
},
|
|
"CVE-2021-37704": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.06132,
|
|
"epss_pct": 0.92937,
|
|
"name": "phpfastcache - phpinfo Resource Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37704.yaml"
|
|
},
|
|
"CVE-2021-37833": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04878,
|
|
"epss_pct": 0.91434,
|
|
"name": "Hotel Druid 3.0.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37833.yaml"
|
|
},
|
|
"CVE-2021-38146": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11733,
|
|
"epss_pct": 0.95761,
|
|
"name": "Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38146.yaml"
|
|
},
|
|
"CVE-2021-38147": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.53008,
|
|
"epss_pct": 0.98897,
|
|
"name": "Wipro Holmes Orchestrator 20.4.1 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38147.yaml"
|
|
},
|
|
"CVE-2021-38154": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.04,
|
|
"epss_pct": 0.89802,
|
|
"name": "Canon Devices - Authentication Bypass in Catwalk Server",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38154.yaml"
|
|
},
|
|
"CVE-2021-38156": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.88939,
|
|
"epss_pct": 0.99767,
|
|
"name": "Nagios XI < 5.8.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38156.yaml"
|
|
},
|
|
"CVE-2021-3831": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.01812,
|
|
"epss_pct": 0.7709,
|
|
"name": "Gnuboard 5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3831.yaml"
|
|
},
|
|
"CVE-2021-38314": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.28961,
|
|
"epss_pct": 0.98021,
|
|
"name": "WordPress Redux Framework <=4.2.11 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38314.yaml"
|
|
},
|
|
"CVE-2021-38540": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.80938,
|
|
"epss_pct": 0.996,
|
|
"name": "Apache Airflow - Unauthenticated Variable Import",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38540.yaml"
|
|
},
|
|
"CVE-2021-38647": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99933,
|
|
"epss_pct": 0.99969,
|
|
"name": "Microsoft Open Management Infrastructure - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38647.yaml"
|
|
},
|
|
"CVE-2021-38702": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06929,
|
|
"epss_pct": 0.93631,
|
|
"name": "Cyberoam NetGenie Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38702.yaml"
|
|
},
|
|
"CVE-2021-38704": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03521,
|
|
"epss_pct": 0.88394,
|
|
"name": "ClinicCases 7.3.3 Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38704.yaml"
|
|
},
|
|
"CVE-2021-38751": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-116",
|
|
"epss": 0.02468,
|
|
"epss_pct": 0.83348,
|
|
"name": "ExponentCMS <= 2.6 - Host Header Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38751.yaml"
|
|
},
|
|
"CVE-2021-39141": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.16118,
|
|
"epss_pct": 0.96689,
|
|
"name": "XStream 1.4.18 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39141.yaml"
|
|
},
|
|
"CVE-2021-39144": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.98124,
|
|
"epss_pct": 0.99909,
|
|
"name": "XStream 1.4.18 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39144.yaml"
|
|
},
|
|
"CVE-2021-39146": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.143,
|
|
"epss_pct": 0.96338,
|
|
"name": "XStream 1.4.18 - Arbitrary Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39146.yaml"
|
|
},
|
|
"CVE-2021-39152": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.11377,
|
|
"epss_pct": 0.95679,
|
|
"name": "XStream <1.4.18 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39152.yaml"
|
|
},
|
|
"CVE-2021-39165": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.09752,
|
|
"epss_pct": 0.95176,
|
|
"name": "Cachet <=2.3.18 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39165.yaml"
|
|
},
|
|
"CVE-2021-39211": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.04699,
|
|
"epss_pct": 0.91158,
|
|
"name": "GLPI 9.2/<9.5.6 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39211.yaml"
|
|
},
|
|
"CVE-2021-39226": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99933,
|
|
"epss_pct": 0.99969,
|
|
"name": "Grafana Snapshot - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39226.yaml"
|
|
},
|
|
"CVE-2021-39312": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.77944,
|
|
"epss_pct": 0.99538,
|
|
"name": "WordPress True Ranker <2.2.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39312.yaml"
|
|
},
|
|
"CVE-2021-39316": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.65763,
|
|
"epss_pct": 0.99209,
|
|
"name": "WordPress DZS Zoomsounds <=6.50 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39316.yaml"
|
|
},
|
|
"CVE-2021-39320": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02324,
|
|
"epss_pct": 0.82285,
|
|
"name": "WordPress Under Construction <1.19 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39320.yaml"
|
|
},
|
|
"CVE-2021-39322": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02349,
|
|
"epss_pct": 0.82487,
|
|
"name": "WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39322.yaml"
|
|
},
|
|
"CVE-2021-39327": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.71688,
|
|
"epss_pct": 0.99375,
|
|
"name": "WordPress BulletProof Security 5.1 Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39327.yaml"
|
|
},
|
|
"CVE-2021-39341": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"epss": 0.21929,
|
|
"epss_pct": 0.97479,
|
|
"name": "OptinMonster Plugin < 2.6.5 - Unprotected REST-API",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39341.yaml"
|
|
},
|
|
"CVE-2021-39350": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02248,
|
|
"epss_pct": 0.81659,
|
|
"name": "FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39350.yaml"
|
|
},
|
|
"CVE-2021-39411": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00914,
|
|
"epss_pct": 0.57625,
|
|
"name": "Hospital Management System 1.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39411.yaml"
|
|
},
|
|
"CVE-2021-39433": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.08687,
|
|
"epss_pct": 0.94741,
|
|
"name": "BIQS IT Biqs-drive v1.83 Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39433.yaml"
|
|
},
|
|
"CVE-2021-39501": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03588,
|
|
"epss_pct": 0.88593,
|
|
"name": "EyouCMS 1.5.4 Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39501.yaml"
|
|
},
|
|
"CVE-2021-40149": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.07443,
|
|
"epss_pct": 0.94011,
|
|
"name": "Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40149.yaml"
|
|
},
|
|
"CVE-2021-40150": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.03729,
|
|
"epss_pct": 0.89031,
|
|
"name": "Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40150.yaml"
|
|
},
|
|
"CVE-2021-40272": {
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01047,
|
|
"epss_pct": 0.61814,
|
|
"name": "IRTS OP5 Monitor - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40272.yaml"
|
|
},
|
|
"CVE-2021-40323": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.86829,
|
|
"epss_pct": 0.9973,
|
|
"name": "Cobbler <3.3.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40323.yaml"
|
|
},
|
|
"CVE-2021-40438": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99997,
|
|
"name": "Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40438.yaml"
|
|
},
|
|
"CVE-2021-40524": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04285,
|
|
"epss_pct": 0.90411,
|
|
"name": "Pure-FTPd 1.0.23 < 1.0.50 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-40524.yaml"
|
|
},
|
|
"CVE-2021-40539": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-706",
|
|
"epss": 0.9896,
|
|
"epss_pct": 0.99926,
|
|
"name": "Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40539.yaml"
|
|
},
|
|
"CVE-2021-40542": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03156,
|
|
"epss_pct": 0.87057,
|
|
"name": "Opensis-Classic 8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40542.yaml"
|
|
},
|
|
"CVE-2021-40651": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17945,
|
|
"epss_pct": 0.96965,
|
|
"name": "OS4Ed OpenSIS Community 8.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40651.yaml"
|
|
},
|
|
"CVE-2021-40655": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.86659,
|
|
"epss_pct": 0.99726,
|
|
"name": "D-Link DIR-605 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40655.yaml"
|
|
},
|
|
"CVE-2021-40661": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05063,
|
|
"epss_pct": 0.91711,
|
|
"name": "IND780 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40661.yaml"
|
|
},
|
|
"CVE-2021-4073": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.07,
|
|
"epss_pct": 0.93695,
|
|
"name": "RegistrationMagic <= 5.0.1.7 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4073.yaml"
|
|
},
|
|
"CVE-2021-40822": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.19259,
|
|
"epss_pct": 0.97138,
|
|
"name": "Geoserver - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40822.yaml"
|
|
},
|
|
"CVE-2021-40856": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-706",
|
|
"epss": 0.50125,
|
|
"epss_pct": 0.98819,
|
|
"name": "Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40856.yaml"
|
|
},
|
|
"CVE-2021-40859": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.71979,
|
|
"epss_pct": 0.99382,
|
|
"name": "Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40859.yaml"
|
|
},
|
|
"CVE-2021-40868": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09071,
|
|
"epss_pct": 0.94917,
|
|
"name": "Cloudron 6.2 Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40868.yaml"
|
|
},
|
|
"CVE-2021-40870": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.93019,
|
|
"epss_pct": 0.99824,
|
|
"name": "Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40870.yaml"
|
|
},
|
|
"CVE-2021-40875": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.48417,
|
|
"epss_pct": 0.98777,
|
|
"name": "Gurock TestRail Application files.md5 Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40875.yaml"
|
|
},
|
|
"CVE-2021-40960": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0992,
|
|
"epss_pct": 0.95243,
|
|
"name": "Galera WebTemplate 1.0 Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40960.yaml"
|
|
},
|
|
"CVE-2021-40968": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02239,
|
|
"epss_pct": 0.81598,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40968.yaml"
|
|
},
|
|
"CVE-2021-40969": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02239,
|
|
"epss_pct": 0.81599,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40969.yaml"
|
|
},
|
|
"CVE-2021-40970": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02239,
|
|
"epss_pct": 0.81598,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40970.yaml"
|
|
},
|
|
"CVE-2021-40971": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02239,
|
|
"epss_pct": 0.81599,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40971.yaml"
|
|
},
|
|
"CVE-2021-40972": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0225,
|
|
"epss_pct": 0.81672,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40972.yaml"
|
|
},
|
|
"CVE-2021-40973": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0225,
|
|
"epss_pct": 0.81672,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40973.yaml"
|
|
},
|
|
"CVE-2021-40978": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15103,
|
|
"epss_pct": 0.96482,
|
|
"name": "MKdocs 1.2.2 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40978.yaml"
|
|
},
|
|
"CVE-2021-41097": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-1321",
|
|
"name": "Aurelia-Path < 1.1.7 - Prototype Pollution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41097.yaml"
|
|
},
|
|
"CVE-2021-41174": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.85404,
|
|
"epss_pct": 0.99704,
|
|
"name": "Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41174.yaml"
|
|
},
|
|
"CVE-2021-41192": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.08017,
|
|
"epss_pct": 0.94355,
|
|
"name": "Redash Setup Configuration - Default Secrets Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41192.yaml"
|
|
},
|
|
"CVE-2021-41266": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.48414,
|
|
"epss_pct": 0.98777,
|
|
"name": "MinIO Operator Console Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41266.yaml"
|
|
},
|
|
"CVE-2021-41277": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.97178,
|
|
"epss_pct": 0.99889,
|
|
"name": "Metabase - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41277.yaml"
|
|
},
|
|
"CVE-2021-41282": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.87113,
|
|
"epss_pct": 0.99735,
|
|
"name": "pfSense - Arbitrary File Write",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41282.yaml"
|
|
},
|
|
"CVE-2021-41291": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.82689,
|
|
"epss_pct": 0.99642,
|
|
"name": "ECOA Building Automation System - Directory Traversal Content Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41291.yaml"
|
|
},
|
|
"CVE-2021-41293": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20623,
|
|
"epss_pct": 0.97338,
|
|
"name": "ECOA Building Automation System - Arbitrary File Retrieval",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41293.yaml"
|
|
},
|
|
"CVE-2021-41349": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"epss": 0.93325,
|
|
"epss_pct": 0.99831,
|
|
"name": "Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41349.yaml"
|
|
},
|
|
"CVE-2021-41381": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.52926,
|
|
"epss_pct": 0.98895,
|
|
"name": "Payara Micro Community 5.2021.6 Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41381.yaml"
|
|
},
|
|
"CVE-2021-41419": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.08517,
|
|
"epss_pct": 0.94648,
|
|
"name": "QVIS NVR/DVR - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41419.yaml"
|
|
},
|
|
"CVE-2021-41432": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01711,
|
|
"epss_pct": 0.75733,
|
|
"name": "FlatPress 1.2.1 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41432.yaml"
|
|
},
|
|
"CVE-2021-41460": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06429,
|
|
"epss_pct": 0.93209,
|
|
"name": "ECShop 4.1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41460.yaml"
|
|
},
|
|
"CVE-2021-41467": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03601,
|
|
"epss_pct": 0.88637,
|
|
"name": "JustWriting - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41467.yaml"
|
|
},
|
|
"CVE-2021-41569": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-829",
|
|
"epss": 0.07845,
|
|
"epss_pct": 0.94258,
|
|
"name": "SAS/Internet 9.4 1520 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41569.yaml"
|
|
},
|
|
"CVE-2021-41648": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10169,
|
|
"epss_pct": 0.9532,
|
|
"name": "PuneethReddyHC action.php SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41648.yaml"
|
|
},
|
|
"CVE-2021-41649": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.5177,
|
|
"epss_pct": 0.98865,
|
|
"name": "PuneethReddyHC Online Shopping System homeaction.php SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41649.yaml"
|
|
},
|
|
"CVE-2021-41653": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.76045,
|
|
"epss_pct": 0.99493,
|
|
"name": "TP-Link - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41653.yaml"
|
|
},
|
|
"CVE-2021-41691": {
|
|
"epss": 0.01792,
|
|
"epss_pct": 0.7683,
|
|
"name": "openSIS Student Information System 8.0 SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41691.yaml"
|
|
},
|
|
"CVE-2021-41749": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.18122,
|
|
"epss_pct": 0.96987,
|
|
"name": "CraftCMS SEOmatic - Server-Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41749.yaml"
|
|
},
|
|
"CVE-2021-41773": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99992,
|
|
"epss_pct": 0.99986,
|
|
"name": "Apache 2.4.49 - Path Traversal and Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml"
|
|
},
|
|
"CVE-2021-41826": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.12056,
|
|
"epss_pct": 0.9584,
|
|
"name": "PlaceOS 1.2109.1 - Open Redirection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41826.yaml"
|
|
},
|
|
"CVE-2021-41878": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09912,
|
|
"epss_pct": 0.95235,
|
|
"name": "i-Panel Administration System 2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41878.yaml"
|
|
},
|
|
"CVE-2021-4191": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.80004,
|
|
"epss_pct": 0.99583,
|
|
"name": "GitLab GraphQL API User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4191.yaml"
|
|
},
|
|
"CVE-2021-41951": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.77892,
|
|
"epss_pct": 0.99537,
|
|
"name": "Resourcespace - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41951.yaml"
|
|
},
|
|
"CVE-2021-42013": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99964,
|
|
"epss_pct": 0.99975,
|
|
"name": "Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42013.yaml"
|
|
},
|
|
"CVE-2021-42063": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.22224,
|
|
"epss_pct": 0.97504,
|
|
"name": "SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42063.yaml"
|
|
},
|
|
"CVE-2021-42071": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.69882,
|
|
"epss_pct": 0.99321,
|
|
"name": "Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42071.yaml"
|
|
},
|
|
"CVE-2021-42192": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.10066,
|
|
"epss_pct": 0.95288,
|
|
"name": "KONGA 0.14.9 - Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42192.yaml"
|
|
},
|
|
"CVE-2021-42237": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.97904,
|
|
"epss_pct": 0.99904,
|
|
"name": "Sitecore Experience Platform Pre-Auth RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42237.yaml"
|
|
},
|
|
"CVE-2021-42258": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.74426,
|
|
"epss_pct": 0.99453,
|
|
"name": "BillQuick Web Suite SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42258.yaml"
|
|
},
|
|
"CVE-2021-42359": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.03839,
|
|
"epss_pct": 0.89362,
|
|
"name": "WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42359.yaml"
|
|
},
|
|
"CVE-2021-42551": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02671,
|
|
"epss_pct": 0.84698,
|
|
"name": "NetBiblio WebOPAC - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42551.yaml"
|
|
},
|
|
"CVE-2021-42565": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05832,
|
|
"epss_pct": 0.92631,
|
|
"name": "myfactory FMS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42565.yaml"
|
|
},
|
|
"CVE-2021-42566": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05832,
|
|
"epss_pct": 0.92631,
|
|
"name": "myfactory FMS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42566.yaml"
|
|
},
|
|
"CVE-2021-42567": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08064,
|
|
"epss_pct": 0.94382,
|
|
"name": "Apereo CAS Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42567.yaml"
|
|
},
|
|
"CVE-2021-42627": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.6307,
|
|
"epss_pct": 0.9914,
|
|
"name": "D-Link DIR-615 - Unauthorized Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42627.yaml"
|
|
},
|
|
"CVE-2021-42663": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03852,
|
|
"epss_pct": 0.89393,
|
|
"name": "Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42663.yaml"
|
|
},
|
|
"CVE-2021-42667": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.16046,
|
|
"epss_pct": 0.96679,
|
|
"name": "Online Event Booking and Reservation System 2.3.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42667.yaml"
|
|
},
|
|
"CVE-2021-42887": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.44291,
|
|
"epss_pct": 0.98664,
|
|
"name": "TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42887.yaml"
|
|
},
|
|
"CVE-2021-43062": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.12936,
|
|
"epss_pct": 0.96029,
|
|
"name": "Fortinet FortiMail 7.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43062.yaml"
|
|
},
|
|
"CVE-2021-43287": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.28039,
|
|
"epss_pct": 0.97963,
|
|
"name": "Pre-Auth Takeover of Build Pipelines in GoCD",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43287.yaml"
|
|
},
|
|
"CVE-2021-43421": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.42781,
|
|
"epss_pct": 0.98616,
|
|
"name": "Studio-42 elFinder <2.1.60 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43421.yaml"
|
|
},
|
|
"CVE-2021-43495": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09052,
|
|
"epss_pct": 0.94911,
|
|
"name": "AlquistManager Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43495.yaml"
|
|
},
|
|
"CVE-2021-43496": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15689,
|
|
"epss_pct": 0.96608,
|
|
"name": "Clustering Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43496.yaml"
|
|
},
|
|
"CVE-2021-43510": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07515,
|
|
"epss_pct": 0.94052,
|
|
"name": "Sourcecodester Simple Client Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43510.yaml"
|
|
},
|
|
"CVE-2021-43574": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02422,
|
|
"epss_pct": 0.83021,
|
|
"name": "Atmail 6.5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43574.yaml"
|
|
},
|
|
"CVE-2021-43725": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02573,
|
|
"epss_pct": 0.84064,
|
|
"name": "Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43725.yaml"
|
|
},
|
|
"CVE-2021-43734": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10728,
|
|
"epss_pct": 0.95496,
|
|
"name": "kkFileview v4.0.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43734.yaml"
|
|
},
|
|
"CVE-2021-4374": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.16408,
|
|
"epss_pct": 0.96747,
|
|
"name": "WordPress Automatic Plugin - Unauthenticated Options Change",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4374.yaml"
|
|
},
|
|
"CVE-2021-43778": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.52658,
|
|
"epss_pct": 0.98886,
|
|
"name": "GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43778.yaml"
|
|
},
|
|
"CVE-2021-43798": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.88503,
|
|
"epss_pct": 0.9976,
|
|
"name": "Grafana v8.x - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43798.yaml"
|
|
},
|
|
"CVE-2021-4380": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.04528,
|
|
"epss_pct": 0.90864,
|
|
"name": "Pinterest Automatic < 4.14.4 - Unauthenticated Arbitrary Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4380.yaml"
|
|
},
|
|
"CVE-2021-43810": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04996,
|
|
"epss_pct": 0.91616,
|
|
"name": "Admidio - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43810.yaml"
|
|
},
|
|
"CVE-2021-43831": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03794,
|
|
"epss_pct": 0.89225,
|
|
"name": "Gradio < 2.5.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43831.yaml"
|
|
},
|
|
"CVE-2021-44077": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.93298,
|
|
"epss_pct": 0.99829,
|
|
"name": "Zoho ManageEngine ServiceDesk Plus - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44077.yaml"
|
|
},
|
|
"CVE-2021-44138": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.14115,
|
|
"epss_pct": 0.96299,
|
|
"name": "Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44138.yaml"
|
|
},
|
|
"CVE-2021-44139": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.05643,
|
|
"epss_pct": 0.92415,
|
|
"name": "Alibaba Sentinel - Server-side request forgery (SSRF)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44139.yaml"
|
|
},
|
|
"CVE-2021-44152": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.58555,
|
|
"epss_pct": 0.99032,
|
|
"name": "Reprise License Manager 14.2 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44152.yaml"
|
|
},
|
|
"CVE-2021-44228": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99999,
|
|
"epss_pct": 1.0,
|
|
"name": "Apache Log4j2 Remote Code Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml"
|
|
},
|
|
"CVE-2021-44260": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.07382,
|
|
"epss_pct": 0.93974,
|
|
"name": "WAVLINK AC1200 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44260.yaml"
|
|
},
|
|
"CVE-2021-4436": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.06646,
|
|
"epss_pct": 0.93391,
|
|
"name": "3DPrint Lite < 1.9.1.5 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4436.yaml"
|
|
},
|
|
"CVE-2021-44427": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.50641,
|
|
"epss_pct": 0.98834,
|
|
"name": "Rosario Student Information System Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44427.yaml"
|
|
},
|
|
"CVE-2021-44451": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.07863,
|
|
"epss_pct": 0.9427,
|
|
"name": "Apache Superset <=1.3.2 - Default Login",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44451.yaml"
|
|
},
|
|
"CVE-2021-4448": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01381,
|
|
"epss_pct": 0.70207,
|
|
"name": "Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4448.yaml"
|
|
},
|
|
"CVE-2021-4449": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.05439,
|
|
"epss_pct": 0.92156,
|
|
"name": "ZoomSounds Plugin - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4449.yaml"
|
|
},
|
|
"CVE-2021-44515": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99871,
|
|
"epss_pct": 0.99962,
|
|
"name": "Zoho ManageEngine Desktop Central - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44515.yaml"
|
|
},
|
|
"CVE-2021-44521": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.55006,
|
|
"epss_pct": 0.98953,
|
|
"name": "Apache Cassandra Load UDF RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-44521.yaml"
|
|
},
|
|
"CVE-2021-44528": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04182,
|
|
"epss_pct": 0.90205,
|
|
"name": "Open Redirect in Host Authorization Middleware",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44528.yaml"
|
|
},
|
|
"CVE-2021-44529": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99105,
|
|
"epss_pct": 0.99931,
|
|
"name": "Ivanti EPM Cloud Services Appliance Code Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44529.yaml"
|
|
},
|
|
"CVE-2021-4462": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.0319,
|
|
"epss_pct": 0.87193,
|
|
"name": "Employee Records System 1.0 - Unauthenticated File Upload RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4462.yaml"
|
|
},
|
|
"CVE-2021-4463": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.01452,
|
|
"epss_pct": 0.71534,
|
|
"name": "Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4463.yaml"
|
|
},
|
|
"CVE-2021-44848": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.22966,
|
|
"epss_pct": 0.97584,
|
|
"name": "Thinfinity VirtualUI User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44848.yaml"
|
|
},
|
|
"CVE-2021-45027": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01927,
|
|
"epss_pct": 0.78518,
|
|
"name": "Oliver 5 Library Server <8.00.008.053 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45027.yaml"
|
|
},
|
|
"CVE-2021-45043": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.33133,
|
|
"epss_pct": 0.98241,
|
|
"name": "HD-Network Realtime Monitoring System 2.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45043.yaml"
|
|
},
|
|
"CVE-2021-45046": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.99977,
|
|
"epss_pct": 0.99979,
|
|
"name": "Apache Log4j2 - Remote Code Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45046.yaml"
|
|
},
|
|
"CVE-2021-45092": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.39973,
|
|
"epss_pct": 0.98523,
|
|
"name": "Thinfinity Iframe Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45092.yaml"
|
|
},
|
|
"CVE-2021-45232": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.85943,
|
|
"epss_pct": 0.99713,
|
|
"name": "Apache APISIX Dashboard <2.10.1 - API Unauthorized Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45232.yaml"
|
|
},
|
|
"CVE-2021-45328": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00948,
|
|
"epss_pct": 0.5872,
|
|
"name": "Gitea < 1.4.3 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45328.yaml"
|
|
},
|
|
"CVE-2021-45380": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0253,
|
|
"epss_pct": 0.83782,
|
|
"name": "AppCMS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45380.yaml"
|
|
},
|
|
"CVE-2021-45382": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97836,
|
|
"epss_pct": 0.99901,
|
|
"name": "D-Link - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45382.yaml"
|
|
},
|
|
"CVE-2021-45420": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.18957,
|
|
"epss_pct": 0.97094,
|
|
"name": "Emerson Dixell XWEB-500 - Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45420.yaml"
|
|
},
|
|
"CVE-2021-45422": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03241,
|
|
"epss_pct": 0.87412,
|
|
"name": "Reprise License Manager 14.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45422.yaml"
|
|
},
|
|
"CVE-2021-45428": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.56931,
|
|
"epss_pct": 0.98995,
|
|
"name": "Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45428.yaml"
|
|
},
|
|
"CVE-2021-45467": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.70745,
|
|
"epss_pct": 0.99349,
|
|
"name": "Control Web Panel (CWP) - File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45467.yaml"
|
|
},
|
|
"CVE-2021-45793": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04519,
|
|
"epss_pct": 0.90845,
|
|
"name": "Slims9 Bulian 9.4.2 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45793.yaml"
|
|
},
|
|
"CVE-2021-45811": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02454,
|
|
"epss_pct": 0.83258,
|
|
"name": "osTicket 1.15.x - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45811.yaml"
|
|
},
|
|
"CVE-2021-45967": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.208,
|
|
"epss_pct": 0.97367,
|
|
"name": "Pascom CPS Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45967.yaml"
|
|
},
|
|
"CVE-2021-45968": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.10385,
|
|
"epss_pct": 0.95391,
|
|
"name": "Pascom CPS - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45968.yaml"
|
|
},
|
|
"CVE-2021-46005": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02915,
|
|
"epss_pct": 0.8604,
|
|
"name": "Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46005.yaml"
|
|
},
|
|
"CVE-2021-46068": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02736,
|
|
"epss_pct": 0.85077,
|
|
"name": "Vehicle Service Management System - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46068.yaml"
|
|
},
|
|
"CVE-2021-46069": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02736,
|
|
"epss_pct": 0.85077,
|
|
"name": "Vehicle Service Management System 1.0 - Stored Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46069.yaml"
|
|
},
|
|
"CVE-2021-46071": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02736,
|
|
"epss_pct": 0.85078,
|
|
"name": "ehicle Service Management System 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46071.yaml"
|
|
},
|
|
"CVE-2021-46072": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02736,
|
|
"epss_pct": 0.85077,
|
|
"name": "Vehicle Service Management System 1.0 - Stored Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46072.yaml"
|
|
},
|
|
"CVE-2021-46073": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02759,
|
|
"epss_pct": 0.85222,
|
|
"name": "Vehicle Service Management System 1.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46073.yaml"
|
|
},
|
|
"CVE-2021-46104": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04231,
|
|
"epss_pct": 0.90308,
|
|
"name": "webp_server_go 0.4.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46104.yaml"
|
|
},
|
|
"CVE-2021-46107": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.07408,
|
|
"epss_pct": 0.93991,
|
|
"name": "Ligeo Archives Ligeo Basics - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46107.yaml"
|
|
},
|
|
"CVE-2021-46371": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.04305,
|
|
"epss_pct": 0.90449,
|
|
"name": "AntD Admin - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46371.yaml"
|
|
},
|
|
"CVE-2021-46379": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.15701,
|
|
"epss_pct": 0.96611,
|
|
"name": "D-Link DIR850 ET850-1.08TRb03 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46379.yaml"
|
|
},
|
|
"CVE-2021-46381": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.57984,
|
|
"epss_pct": 0.99019,
|
|
"name": "D-Link DAP-1620 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46381.yaml"
|
|
},
|
|
"CVE-2021-46387": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.21028,
|
|
"epss_pct": 0.97394,
|
|
"name": "Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46387.yaml"
|
|
},
|
|
"CVE-2021-46417": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.59753,
|
|
"epss_pct": 0.99061,
|
|
"name": "Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46417.yaml"
|
|
},
|
|
"CVE-2021-46418": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"epss": 0.23945,
|
|
"epss_pct": 0.97669,
|
|
"name": "Telesquare TLR-2855KS6 - Arbitrary File Creation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46418.yaml"
|
|
},
|
|
"CVE-2021-46419": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"epss": 0.71384,
|
|
"epss_pct": 0.99367,
|
|
"name": "Telesquare TLR-2855KS6 - Arbitrary File Deletion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46419.yaml"
|
|
},
|
|
"CVE-2021-46422": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.94342,
|
|
"epss_pct": 0.99843,
|
|
"name": "SDT-CW3B1 1.1.0 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46422.yaml"
|
|
},
|
|
"CVE-2021-46424": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.36459,
|
|
"epss_pct": 0.98375,
|
|
"name": "Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46424.yaml"
|
|
},
|
|
"CVE-2021-46704": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.21901,
|
|
"epss_pct": 0.97475,
|
|
"name": "GenieACS => 1.2.8 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46704.yaml"
|
|
},
|
|
"CVE-2021-47795": {
|
|
"cvss": 6.2,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02615,
|
|
"epss_pct": 0.84342,
|
|
"name": "GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-47795.yaml"
|
|
},
|
|
"CVE-2022-0087": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02601,
|
|
"epss_pct": 0.84248,
|
|
"name": "Keystone 6 Login Page - Open Redirect and Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0087.yaml"
|
|
},
|
|
"CVE-2022-0140": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.0384,
|
|
"epss_pct": 0.89366,
|
|
"name": "WordPress Visual Form Builder <3.0.8 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0140.yaml"
|
|
},
|
|
"CVE-2022-0147": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0156,
|
|
"epss_pct": 0.73466,
|
|
"name": "WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0147.yaml"
|
|
},
|
|
"CVE-2022-0148": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01572,
|
|
"epss_pct": 0.73654,
|
|
"name": "WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0148.yaml"
|
|
},
|
|
"CVE-2022-0149": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02337,
|
|
"epss_pct": 0.82393,
|
|
"name": "WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0149.yaml"
|
|
},
|
|
"CVE-2022-0150": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01718,
|
|
"epss_pct": 0.75827,
|
|
"name": "WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0150.yaml"
|
|
},
|
|
"CVE-2022-0165": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0428,
|
|
"epss_pct": 0.90404,
|
|
"name": "WordPress Page Builder KingComposer <=2.9.6 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0165.yaml"
|
|
},
|
|
"CVE-2022-0169": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.74615,
|
|
"epss_pct": 0.9946,
|
|
"name": "Photo Gallery by 10Web < 1.6.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0169.yaml"
|
|
},
|
|
"CVE-2022-0188": {
|
|
"name": "CMP WordPress < 4.0.19 - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0188.yaml"
|
|
},
|
|
"CVE-2022-0189": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02228,
|
|
"epss_pct": 0.815,
|
|
"name": "WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0189.yaml"
|
|
},
|
|
"CVE-2022-0201": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03368,
|
|
"epss_pct": 0.87889,
|
|
"name": "WordPress Permalink Manager <2.2.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0201.yaml"
|
|
},
|
|
"CVE-2022-0206": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01458,
|
|
"epss_pct": 0.71667,
|
|
"name": "WordPress NewStatPress <1.3.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0206.yaml"
|
|
},
|
|
"CVE-2022-0208": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02038,
|
|
"epss_pct": 0.79744,
|
|
"name": "WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0208.yaml"
|
|
},
|
|
"CVE-2022-0212": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02291,
|
|
"epss_pct": 0.82012,
|
|
"name": "WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0212.yaml"
|
|
},
|
|
"CVE-2022-0218": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.70511,
|
|
"epss_pct": 0.99341,
|
|
"name": "HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0218.yaml"
|
|
},
|
|
"CVE-2022-0220": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-116",
|
|
"epss": 0.02329,
|
|
"epss_pct": 0.82322,
|
|
"name": "WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0220.yaml"
|
|
},
|
|
"CVE-2022-0228": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05887,
|
|
"epss_pct": 0.92692,
|
|
"name": "Popup Builder < 4.0.7 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0228.yaml"
|
|
},
|
|
"CVE-2022-0234": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01752,
|
|
"epss_pct": 0.76295,
|
|
"name": "WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0234.yaml"
|
|
},
|
|
"CVE-2022-0250": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01615,
|
|
"epss_pct": 0.74284,
|
|
"name": "Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0250.yaml"
|
|
},
|
|
"CVE-2022-0271": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02254,
|
|
"epss_pct": 0.81708,
|
|
"name": "LearnPress <4.1.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0271.yaml"
|
|
},
|
|
"CVE-2022-0281": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.1201,
|
|
"epss_pct": 0.95831,
|
|
"name": "Microweber Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0281.yaml"
|
|
},
|
|
"CVE-2022-0288": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02389,
|
|
"epss_pct": 0.8278,
|
|
"name": "WordPress Ad Inserter <2.7.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0288.yaml"
|
|
},
|
|
"CVE-2022-0342": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.8442,
|
|
"epss_pct": 0.99682,
|
|
"name": "Zyxel - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0342.yaml"
|
|
},
|
|
"CVE-2022-0346": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02397,
|
|
"epss_pct": 0.82835,
|
|
"name": "WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0346.yaml"
|
|
},
|
|
"CVE-2022-0349": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.34359,
|
|
"epss_pct": 0.98291,
|
|
"name": "WordPress NotificationX <2.3.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0349.yaml"
|
|
},
|
|
"CVE-2022-0378": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03866,
|
|
"epss_pct": 0.89438,
|
|
"name": "Microweber Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0378.yaml"
|
|
},
|
|
"CVE-2022-0381": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03865,
|
|
"epss_pct": 0.89435,
|
|
"name": "WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0381.yaml"
|
|
},
|
|
"CVE-2022-0412": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.73998,
|
|
"epss_pct": 0.99443,
|
|
"name": "WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0412.yaml"
|
|
},
|
|
"CVE-2022-0415": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.65237,
|
|
"epss_pct": 0.99194,
|
|
"name": "Gogs <0.12.6 - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0415.yaml"
|
|
},
|
|
"CVE-2022-0422": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0812,
|
|
"epss_pct": 0.94423,
|
|
"name": "WordPress White Label CMS <2.2.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0422.yaml"
|
|
},
|
|
"CVE-2022-0424": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.03005,
|
|
"epss_pct": 0.86437,
|
|
"name": "Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0424.yaml"
|
|
},
|
|
"CVE-2022-0429": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01157,
|
|
"epss_pct": 0.64834,
|
|
"name": "WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0429.yaml"
|
|
},
|
|
"CVE-2022-0432": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-1321",
|
|
"epss": 0.04429,
|
|
"epss_pct": 0.90682,
|
|
"name": "Mastodon Prototype Pollution Vulnerability",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0432.yaml"
|
|
},
|
|
"CVE-2022-0434": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.14783,
|
|
"epss_pct": 0.9643,
|
|
"name": "WordPress Page Views Count <2.4.15 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0434.yaml"
|
|
},
|
|
"CVE-2022-0437": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.15054,
|
|
"epss_pct": 0.96477,
|
|
"name": "karma-runner DOM-based Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0437.yaml"
|
|
},
|
|
"CVE-2022-0439": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04156,
|
|
"epss_pct": 0.90148,
|
|
"name": "Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0439.yaml"
|
|
},
|
|
"CVE-2022-0441": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.85334,
|
|
"epss_pct": 0.99701,
|
|
"name": "MasterStudy LMS <2.7.6 - Improper Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0441.yaml"
|
|
},
|
|
"CVE-2022-0479": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.43807,
|
|
"epss_pct": 0.9865,
|
|
"name": "Popup Builder Plugin - SQL Injection and Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0479.yaml"
|
|
},
|
|
"CVE-2022-0482": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"epss": 0.43746,
|
|
"epss_pct": 0.98647,
|
|
"name": "Easy!Appointments <1.4.3 - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0482.yaml"
|
|
},
|
|
"CVE-2022-0533": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01809,
|
|
"epss_pct": 0.7705,
|
|
"name": "Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0533.yaml"
|
|
},
|
|
"CVE-2022-0535": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01262,
|
|
"epss_pct": 0.67577,
|
|
"name": "WordPress E2Pdf <1.16.45 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0535.yaml"
|
|
},
|
|
"CVE-2022-0540": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.88057,
|
|
"epss_pct": 0.99753,
|
|
"name": "Atlassian Jira Seraph - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0540.yaml"
|
|
},
|
|
"CVE-2022-0543": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99351,
|
|
"epss_pct": 0.99937,
|
|
"name": "Redis Sandbox Escape - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-0543.yaml"
|
|
},
|
|
"CVE-2022-0591": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.20249,
|
|
"epss_pct": 0.97282,
|
|
"name": "Formcraft3 <3.8.28 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0591.yaml"
|
|
},
|
|
"CVE-2022-0592": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10431,
|
|
"epss_pct": 0.95402,
|
|
"name": "MapSVG < 6.2.20 - Unauthenticated SQLi",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0592.yaml"
|
|
},
|
|
"CVE-2022-0594": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.02013,
|
|
"epss_pct": 0.79502,
|
|
"name": "WordPress Shareaholic <9.7.6 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0594.yaml"
|
|
},
|
|
"CVE-2022-0595": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.13575,
|
|
"epss_pct": 0.96184,
|
|
"name": "WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0595.yaml"
|
|
},
|
|
"CVE-2022-0597": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03019,
|
|
"epss_pct": 0.86496,
|
|
"name": "Microweber < 1.2.11 - Open Redirection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0597.yaml"
|
|
},
|
|
"CVE-2022-0599": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01669,
|
|
"epss_pct": 0.75113,
|
|
"name": "WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0599.yaml"
|
|
},
|
|
"CVE-2022-0651": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.32212,
|
|
"epss_pct": 0.98194,
|
|
"name": "WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0651.yaml"
|
|
},
|
|
"CVE-2022-0653": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02703,
|
|
"epss_pct": 0.84886,
|
|
"name": "Wordpress Profile Builder Plugin Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0653.yaml"
|
|
},
|
|
"CVE-2022-0656": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.07879,
|
|
"epss_pct": 0.94287,
|
|
"name": "uDraw <3.3.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0656.yaml"
|
|
},
|
|
"CVE-2022-0658": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08631,
|
|
"epss_pct": 0.94708,
|
|
"name": "CommonsBooking < 2.6.8 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0658.yaml"
|
|
},
|
|
"CVE-2022-0660": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.06923,
|
|
"epss_pct": 0.93627,
|
|
"name": "Microweber <1.2.11 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0660.yaml"
|
|
},
|
|
"CVE-2022-0666": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-93",
|
|
"epss": 0.44259,
|
|
"epss_pct": 0.98663,
|
|
"name": "Microweber < 1.2.11 - CRLF Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0666.yaml"
|
|
},
|
|
"CVE-2022-0678": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02273,
|
|
"epss_pct": 0.81849,
|
|
"name": "Microweber <1.2.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0678.yaml"
|
|
},
|
|
"CVE-2022-0679": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.4783,
|
|
"epss_pct": 0.98763,
|
|
"name": "WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0679.yaml"
|
|
},
|
|
"CVE-2022-0692": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.03378,
|
|
"epss_pct": 0.87923,
|
|
"name": "Rudloff alltube prior to 3.0.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0692.yaml"
|
|
},
|
|
"CVE-2022-0693": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07097,
|
|
"epss_pct": 0.93764,
|
|
"name": "WordPress Master Elements <=8.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0693.yaml"
|
|
},
|
|
"CVE-2022-0735": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.13227,
|
|
"epss_pct": 0.96098,
|
|
"name": "GitLab CE/EE - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0735.yaml"
|
|
},
|
|
"CVE-2022-0747": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.14882,
|
|
"epss_pct": 0.96449,
|
|
"name": "Infographic Maker iList < 4.3.8 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0747.yaml"
|
|
},
|
|
"CVE-2022-0760": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10825,
|
|
"epss_pct": 0.95529,
|
|
"name": "WordPress Simple Link Directory <7.7.2 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0760.yaml"
|
|
},
|
|
"CVE-2022-0765": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03932,
|
|
"epss_pct": 0.89628,
|
|
"name": "WordPress Loco Translate < 2.6.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0765.yaml"
|
|
},
|
|
"CVE-2022-0769": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0854,
|
|
"epss_pct": 0.9466,
|
|
"name": "Users Ultra <= 3.1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0769.yaml"
|
|
},
|
|
"CVE-2022-0773": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.43259,
|
|
"epss_pct": 0.98629,
|
|
"name": "Documentor <= 1.5.3 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0773.yaml"
|
|
},
|
|
"CVE-2022-0776": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03679,
|
|
"epss_pct": 0.88883,
|
|
"name": "RevealJS postMessage <4.3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0776.yaml"
|
|
},
|
|
"CVE-2022-0781": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.1305,
|
|
"epss_pct": 0.96062,
|
|
"name": "WordPress Nirweb Support <2.8.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0781.yaml"
|
|
},
|
|
"CVE-2022-0783": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07771,
|
|
"epss_pct": 0.94216,
|
|
"name": "Multiple Shipping Address Woocommerce < 2.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0783.yaml"
|
|
},
|
|
"CVE-2022-0784": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10079,
|
|
"epss_pct": 0.95291,
|
|
"name": "WordPress Title Experiments Free <9.0.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0784.yaml"
|
|
},
|
|
"CVE-2022-0785": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09276,
|
|
"epss_pct": 0.94999,
|
|
"name": "WordPress Daily Prayer Time <2022.03.01 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0785.yaml"
|
|
},
|
|
"CVE-2022-0786": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13271,
|
|
"epss_pct": 0.96106,
|
|
"name": "WordPress KiviCare <2.3.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0786.yaml"
|
|
},
|
|
"CVE-2022-0787": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08631,
|
|
"epss_pct": 0.94708,
|
|
"name": "Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0787.yaml"
|
|
},
|
|
"CVE-2022-0788": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07949,
|
|
"epss_pct": 0.94324,
|
|
"name": "WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0788.yaml"
|
|
},
|
|
"CVE-2022-0814": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09381,
|
|
"epss_pct": 0.95037,
|
|
"name": "Ubigeo de Peru < 3.6.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0814.yaml"
|
|
},
|
|
"CVE-2022-0817": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11586,
|
|
"epss_pct": 0.95725,
|
|
"name": "WordPress BadgeOS <=3.7.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0817.yaml"
|
|
},
|
|
"CVE-2022-0824": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.96977,
|
|
"epss_pct": 0.99886,
|
|
"name": "Webmin <1.990 - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0824.yaml"
|
|
},
|
|
"CVE-2022-0826": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09127,
|
|
"epss_pct": 0.94938,
|
|
"name": "WordPress WP Video Gallery <=1.7.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0826.yaml"
|
|
},
|
|
"CVE-2022-0827": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09127,
|
|
"epss_pct": 0.94938,
|
|
"name": "WordPress Best Books <=2.6.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0827.yaml"
|
|
},
|
|
"CVE-2022-0846": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08785,
|
|
"epss_pct": 0.94793,
|
|
"name": "SpeakOut Email Petitions < 2.14.15.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0846.yaml"
|
|
},
|
|
"CVE-2022-0864": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07415,
|
|
"epss_pct": 0.93997,
|
|
"name": "UpdraftPlus < 1.22.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0864.yaml"
|
|
},
|
|
"CVE-2022-0867": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.1345,
|
|
"epss_pct": 0.96152,
|
|
"name": "WordPress ARPrice <3.6.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0867.yaml"
|
|
},
|
|
"CVE-2022-0869": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02642,
|
|
"epss_pct": 0.8451,
|
|
"name": "nitely/spirit 0.12.3 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0869.yaml"
|
|
},
|
|
"CVE-2022-0870": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03422,
|
|
"epss_pct": 0.88059,
|
|
"name": "Gogs <0.12.5 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0870.yaml"
|
|
},
|
|
"CVE-2022-0873": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.009,
|
|
"epss_pct": 0.57177,
|
|
"name": "WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0873.yaml"
|
|
},
|
|
"CVE-2022-0879": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01195,
|
|
"epss_pct": 0.65872,
|
|
"name": "Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0879.yaml"
|
|
},
|
|
"CVE-2022-0885": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.09436,
|
|
"epss_pct": 0.95057,
|
|
"name": "Member Hero <=1.0.9 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0885.yaml"
|
|
},
|
|
"CVE-2022-0899": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01323,
|
|
"epss_pct": 0.68898,
|
|
"name": "Header Footer Code Manager < 1.1.24 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0899.yaml"
|
|
},
|
|
"CVE-2022-0928": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02389,
|
|
"epss_pct": 0.82777,
|
|
"name": "Microweber < 1.2.12 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0928.yaml"
|
|
},
|
|
"CVE-2022-0948": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09879,
|
|
"epss_pct": 0.95223,
|
|
"name": "WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0948.yaml"
|
|
},
|
|
"CVE-2022-0949": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0767,
|
|
"epss_pct": 0.94156,
|
|
"name": "WordPress Stop Bad Bots <6.930 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0949.yaml"
|
|
},
|
|
"CVE-2022-0952": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.11419,
|
|
"epss_pct": 0.95689,
|
|
"name": "WordPress Sitemap by click5 <1.0.36 - Missing Authorization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0952.yaml"
|
|
},
|
|
"CVE-2022-0954": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03197,
|
|
"epss_pct": 0.87221,
|
|
"name": "Microweber <1.2.11 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0954.yaml"
|
|
},
|
|
"CVE-2022-0963": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01877,
|
|
"epss_pct": 0.77932,
|
|
"name": "Microweber <1.2.12 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0963.yaml"
|
|
},
|
|
"CVE-2022-0968": {
|
|
"cvss": 5.5,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-190",
|
|
"epss": 0.03731,
|
|
"epss_pct": 0.89036,
|
|
"name": "Microweber <1.2.12 - Integer Overflow",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0968.yaml"
|
|
},
|
|
"CVE-2022-1007": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01868,
|
|
"epss_pct": 0.7783,
|
|
"name": "WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1007.yaml"
|
|
},
|
|
"CVE-2022-1013": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07681,
|
|
"epss_pct": 0.94162,
|
|
"name": "WordPress Personal Dictionary <1.3.4 - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1013.yaml"
|
|
},
|
|
"CVE-2022-1020": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.25937,
|
|
"epss_pct": 0.9783,
|
|
"name": "WordPress WooCommerce <3.1.2 - Arbitrary Function Call",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1020.yaml"
|
|
},
|
|
"CVE-2022-1026": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.14733,
|
|
"epss_pct": 0.96426,
|
|
"name": "Kyocera Net View Address Book Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1026.yaml"
|
|
},
|
|
"CVE-2022-1029": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00866,
|
|
"epss_pct": 0.56175,
|
|
"name": "Limit Login Attempts - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1029.yaml"
|
|
},
|
|
"CVE-2022-1040": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99796,
|
|
"epss_pct": 0.99957,
|
|
"name": "Sophos Firewall <=18.5 MR3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1040.yaml"
|
|
},
|
|
"CVE-2022-1054": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.04213,
|
|
"epss_pct": 0.90269,
|
|
"name": "WordPress RSVP and Event Management <2.7.8 - Missing Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1054.yaml"
|
|
},
|
|
"CVE-2022-1057": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07942,
|
|
"epss_pct": 0.9432,
|
|
"name": "WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1057.yaml"
|
|
},
|
|
"CVE-2022-1058": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.53177,
|
|
"epss_pct": 0.98902,
|
|
"name": "Gitea <1.16.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1058.yaml"
|
|
},
|
|
"CVE-2022-1119": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19958,
|
|
"epss_pct": 0.97243,
|
|
"name": "WordPress Simple File List <3.2.8 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1119.yaml"
|
|
},
|
|
"CVE-2022-1162": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.76177,
|
|
"epss_pct": 0.99497,
|
|
"name": "GitLab CE/EE - Hard-Coded Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1162.yaml"
|
|
},
|
|
"CVE-2022-1168": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01847,
|
|
"epss_pct": 0.77558,
|
|
"name": "WordPress WP JobSearch <1.5.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1168.yaml"
|
|
},
|
|
"CVE-2022-1170": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01789,
|
|
"epss_pct": 0.76777,
|
|
"name": "JobMonster < 4.5.2.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1170.yaml"
|
|
},
|
|
"CVE-2022-1221": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02176,
|
|
"epss_pct": 0.81055,
|
|
"name": "WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1221.yaml"
|
|
},
|
|
"CVE-2022-1281": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.43036,
|
|
"epss_pct": 0.98623,
|
|
"name": "Photo Gallery WordPress v1.6.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1281.yaml"
|
|
},
|
|
"CVE-2022-1329": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.92658,
|
|
"epss_pct": 0.9982,
|
|
"name": "Elementor Website Builder - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1329.yaml"
|
|
},
|
|
"CVE-2022-1386": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.71427,
|
|
"epss_pct": 0.99367,
|
|
"name": "WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1386.yaml"
|
|
},
|
|
"CVE-2022-1388": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.99958,
|
|
"epss_pct": 0.99974,
|
|
"name": "F5 BIG-IP iControl - REST Auth Bypass RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1388.yaml"
|
|
},
|
|
"CVE-2022-1390": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.21881,
|
|
"epss_pct": 0.97473,
|
|
"name": "WordPress Admin Word Count Column 2.2 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1390.yaml"
|
|
},
|
|
"CVE-2022-1391": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15064,
|
|
"epss_pct": 0.96477,
|
|
"name": "WordPress Cab fare calculator < 1.0.4 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1391.yaml"
|
|
},
|
|
"CVE-2022-1392": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1129,
|
|
"epss_pct": 0.95659,
|
|
"name": "WordPress Videos sync PDF <=1.7.4 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1392.yaml"
|
|
},
|
|
"CVE-2022-1398": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03054,
|
|
"epss_pct": 0.86647,
|
|
"name": "External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1398.yaml"
|
|
},
|
|
"CVE-2022-1439": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03258,
|
|
"epss_pct": 0.87486,
|
|
"name": "Microweber <1.2.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1439.yaml"
|
|
},
|
|
"CVE-2022-1442": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.08843,
|
|
"epss_pct": 0.94821,
|
|
"name": "WordPress Metform <=2.1.3 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1442.yaml"
|
|
},
|
|
"CVE-2022-1453": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07158,
|
|
"epss_pct": 0.93821,
|
|
"name": "RSVPMaker <= 9.2.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1453.yaml"
|
|
},
|
|
"CVE-2022-1574": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.12018,
|
|
"epss_pct": 0.95831,
|
|
"name": "WordPress HTML2WP <=1.0.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1574.yaml"
|
|
},
|
|
"CVE-2022-1580": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.01386,
|
|
"epss_pct": 0.70301,
|
|
"name": "Site Offline WP Plugin < 1.5.3 - Authorization Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1580.yaml"
|
|
},
|
|
"CVE-2022-1595": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02903,
|
|
"epss_pct": 0.85984,
|
|
"name": "WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1595.yaml"
|
|
},
|
|
"CVE-2022-1597": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03017,
|
|
"epss_pct": 0.86487,
|
|
"name": "WordPress WPQA <5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1597.yaml"
|
|
},
|
|
"CVE-2022-1598": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.05383,
|
|
"epss_pct": 0.92098,
|
|
"name": "WordPress WPQA <5.5 - Improper Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1598.yaml"
|
|
},
|
|
"CVE-2022-1609": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.64075,
|
|
"epss_pct": 0.99165,
|
|
"name": "The School Management < 9.9.7 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1609.yaml"
|
|
},
|
|
"CVE-2022-1692": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10648,
|
|
"epss_pct": 0.95469,
|
|
"name": "CP Image Store with Slideshow <= 1.0.67 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1692.yaml"
|
|
},
|
|
"CVE-2022-1711": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.05945,
|
|
"epss_pct": 0.92745,
|
|
"name": "draw.io < 18.0.5 - Server Side Request Forgery (SSRF)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1711.yaml"
|
|
},
|
|
"CVE-2022-1713": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.09581,
|
|
"epss_pct": 0.95118,
|
|
"name": "Drawio <18.0.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1713.yaml"
|
|
},
|
|
"CVE-2022-1724": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01849,
|
|
"epss_pct": 0.77582,
|
|
"name": "WordPress Simple Membership <4.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1724.yaml"
|
|
},
|
|
"CVE-2022-1756": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01941,
|
|
"epss_pct": 0.78693,
|
|
"name": "Newsletter < 7.4.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1756.yaml"
|
|
},
|
|
"CVE-2022-1768": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12624,
|
|
"epss_pct": 0.95955,
|
|
"name": "WordPress RSVPMaker <=9.3.2 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1768.yaml"
|
|
},
|
|
"CVE-2022-1815": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.05389,
|
|
"epss_pct": 0.92103,
|
|
"name": "Drawio <18.1.2 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1815.yaml"
|
|
},
|
|
"CVE-2022-1883": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0676,
|
|
"epss_pct": 0.93494,
|
|
"name": "Terraboard <2.2.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1883.yaml"
|
|
},
|
|
"CVE-2022-1903": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.08771,
|
|
"epss_pct": 0.94786,
|
|
"name": "ARMember < 3.4.8 - Unauthenticated Admin Account Takeover",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1903.yaml"
|
|
},
|
|
"CVE-2022-1904": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01452,
|
|
"epss_pct": 0.71559,
|
|
"name": "WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1904.yaml"
|
|
},
|
|
"CVE-2022-1906": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01117,
|
|
"epss_pct": 0.63773,
|
|
"name": "WordPress Copyright Proof <=4.16 - Cross-Site-Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1906.yaml"
|
|
},
|
|
"CVE-2022-1910": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01379,
|
|
"epss_pct": 0.70169,
|
|
"name": "WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1910.yaml"
|
|
},
|
|
"CVE-2022-1916": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01913,
|
|
"epss_pct": 0.7836,
|
|
"name": "WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1916.yaml"
|
|
},
|
|
"CVE-2022-1933": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01566,
|
|
"epss_pct": 0.73553,
|
|
"name": "WordPress CDI <5.1.9 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1933.yaml"
|
|
},
|
|
"CVE-2022-1937": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01686,
|
|
"epss_pct": 0.75382,
|
|
"name": "WordPress Awin Data Feed <=1.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1937.yaml"
|
|
},
|
|
"CVE-2022-1946": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01735,
|
|
"epss_pct": 0.76048,
|
|
"name": "WordPress Gallery <2.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1946.yaml"
|
|
},
|
|
"CVE-2022-1950": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05513,
|
|
"epss_pct": 0.9224,
|
|
"name": "Youzify < 1.2.0 - Unauthenticated SQLi",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1950.yaml"
|
|
},
|
|
"CVE-2022-1952": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.23487,
|
|
"epss_pct": 0.97628,
|
|
"name": "WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1952.yaml"
|
|
},
|
|
"CVE-2022-2034": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.02528,
|
|
"epss_pct": 0.83763,
|
|
"name": "WordPress Sensei LMS <4.5.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2034.yaml"
|
|
},
|
|
"CVE-2022-2130": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03076,
|
|
"epss_pct": 0.86724,
|
|
"name": "Microweber < 1.2.17 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2130.yaml"
|
|
},
|
|
"CVE-2022-21371": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.92649,
|
|
"epss_pct": 0.9982,
|
|
"name": "Oracle WebLogic Server Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21371.yaml"
|
|
},
|
|
"CVE-2022-21500": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.71703,
|
|
"epss_pct": 0.99375,
|
|
"name": "Oracle E-Business Suite <=12.2 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21500.yaml"
|
|
},
|
|
"CVE-2022-21587": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.98342,
|
|
"epss_pct": 0.99914,
|
|
"name": "Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21587.yaml"
|
|
},
|
|
"CVE-2022-21661": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.97795,
|
|
"epss_pct": 0.999,
|
|
"name": "WordPress <5.8.3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21661.yaml"
|
|
},
|
|
"CVE-2022-2168": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0127,
|
|
"epss_pct": 0.67753,
|
|
"name": "WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2168.yaml"
|
|
},
|
|
"CVE-2022-21705": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.0865,
|
|
"epss_pct": 0.9472,
|
|
"name": "October CMS - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21705.yaml"
|
|
},
|
|
"CVE-2022-2174": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02999,
|
|
"epss_pct": 0.86407,
|
|
"name": "microweber 1.2.18 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2174.yaml"
|
|
},
|
|
"CVE-2022-2185": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.76884,
|
|
"epss_pct": 0.99511,
|
|
"name": "GitLab CE/EE - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2185.yaml"
|
|
},
|
|
"CVE-2022-2187": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01428,
|
|
"epss_pct": 0.71104,
|
|
"name": "WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2187.yaml"
|
|
},
|
|
"CVE-2022-2219": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01619,
|
|
"epss_pct": 0.74359,
|
|
"name": "Unyson < 2.7.27 - Cross Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2219.yaml"
|
|
},
|
|
"CVE-2022-22242": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02634,
|
|
"epss_pct": 0.84466,
|
|
"name": "Juniper Web Device Manager - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22242.yaml"
|
|
},
|
|
"CVE-2022-22536": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-444",
|
|
"epss": 0.97945,
|
|
"epss_pct": 0.99905,
|
|
"name": "SAP Memory Pipes (MPI) Desynchronization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22536.yaml"
|
|
},
|
|
"CVE-2022-22733": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.37594,
|
|
"epss_pct": 0.98426,
|
|
"name": "Apache ShardingSphere ElasticJob-UI privilege escalation",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22733.yaml"
|
|
},
|
|
"CVE-2022-22897": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.1439,
|
|
"epss_pct": 0.96358,
|
|
"name": "PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22897.yaml"
|
|
},
|
|
"CVE-2022-2290": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02849,
|
|
"epss_pct": 0.85722,
|
|
"name": "Trilium <0.52.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2290.yaml"
|
|
},
|
|
"CVE-2022-22947": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.98253,
|
|
"epss_pct": 0.99911,
|
|
"name": "Spring Cloud Gateway Code Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22947.yaml"
|
|
},
|
|
"CVE-2022-22954": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99997,
|
|
"epss_pct": 0.99989,
|
|
"name": "VMware Workspace ONE Access - Server-Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22954.yaml"
|
|
},
|
|
"CVE-2022-22956": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.50694,
|
|
"epss_pct": 0.98836,
|
|
"name": "VMware Workspace ONE Access - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22956.yaml"
|
|
},
|
|
"CVE-2022-22963": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99939,
|
|
"epss_pct": 0.99971,
|
|
"name": "Spring Cloud - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yaml"
|
|
},
|
|
"CVE-2022-22965": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99638,
|
|
"epss_pct": 0.99948,
|
|
"name": "Spring - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22965.yaml"
|
|
},
|
|
"CVE-2022-22972": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.56305,
|
|
"epss_pct": 0.98979,
|
|
"name": "VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22972.yaml"
|
|
},
|
|
"CVE-2022-23102": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.05265,
|
|
"epss_pct": 0.91969,
|
|
"name": "SINEMA Remote Connect Server < V2.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23102.yaml"
|
|
},
|
|
"CVE-2022-23131": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-290",
|
|
"epss": 0.95683,
|
|
"epss_pct": 0.99865,
|
|
"name": "Zabbix - SAML SSO Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23131.yaml"
|
|
},
|
|
"CVE-2022-23134": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"epss": 0.84657,
|
|
"epss_pct": 0.99689,
|
|
"name": "Zabbix Setup Configuration Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23134.yaml"
|
|
},
|
|
"CVE-2022-2314": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.1652,
|
|
"epss_pct": 0.96766,
|
|
"name": "WordPress VR Calendar <=2.3.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2314.yaml"
|
|
},
|
|
"CVE-2022-23178": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.75159,
|
|
"epss_pct": 0.99473,
|
|
"name": "Crestron Device - Credentials Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23178.yaml"
|
|
},
|
|
"CVE-2022-23347": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13844,
|
|
"epss_pct": 0.96247,
|
|
"name": "BigAnt Server v5.6.06 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23347.yaml"
|
|
},
|
|
"CVE-2022-23348": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-916",
|
|
"epss": 0.03273,
|
|
"epss_pct": 0.8754,
|
|
"name": "BigAnt Server 5.6.06 - Improper Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23348.yaml"
|
|
},
|
|
"CVE-2022-23397": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01028,
|
|
"epss_pct": 0.61222,
|
|
"name": "Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23397.yaml"
|
|
},
|
|
"CVE-2022-23544": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.01607,
|
|
"epss_pct": 0.74163,
|
|
"name": "MeterSphere < 2.5.0 SSRF",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23544.yaml"
|
|
},
|
|
"CVE-2022-2373": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01857,
|
|
"epss_pct": 0.77703,
|
|
"name": "WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2373.yaml"
|
|
},
|
|
"CVE-2022-2376": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01489,
|
|
"epss_pct": 0.72248,
|
|
"name": "WordPress Directorist <7.3.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2376.yaml"
|
|
},
|
|
"CVE-2022-23779": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.1514,
|
|
"epss_pct": 0.96489,
|
|
"name": "Zoho ManageEngine - Internal Hostname Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23779.yaml"
|
|
},
|
|
"CVE-2022-2379": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.0331,
|
|
"epss_pct": 0.87685,
|
|
"name": "WordPress Easy Student Results <=2.2.8 - Improper Authorization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2379.yaml"
|
|
},
|
|
"CVE-2022-23808": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.07936,
|
|
"epss_pct": 0.94316,
|
|
"name": "phpMyAdmin < 5.1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23808.yaml"
|
|
},
|
|
"CVE-2022-2383": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06332,
|
|
"epss_pct": 0.93129,
|
|
"name": "WordPress Feed Them Social <3.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2383.yaml"
|
|
},
|
|
"CVE-2022-23854": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.45957,
|
|
"epss_pct": 0.98716,
|
|
"name": "AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23854.yaml"
|
|
},
|
|
"CVE-2022-23881": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.56509,
|
|
"epss_pct": 0.98985,
|
|
"name": "ZZZCMS zzzphp 2.1.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23881.yaml"
|
|
},
|
|
"CVE-2022-23898": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07734,
|
|
"epss_pct": 0.94195,
|
|
"name": "MCMS 5.2.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23898.yaml"
|
|
},
|
|
"CVE-2022-23944": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"epss": 0.79007,
|
|
"epss_pct": 0.99567,
|
|
"name": "Apache ShenYu Admin Unauth Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23944.yaml"
|
|
},
|
|
"CVE-2022-24086": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.99199,
|
|
"epss_pct": 0.99932,
|
|
"name": "Adobe Commerce (Magento) - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24086.yaml"
|
|
},
|
|
"CVE-2022-24112": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-290",
|
|
"epss": 0.96001,
|
|
"epss_pct": 0.9987,
|
|
"name": "Apache APISIX - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24112.yaml"
|
|
},
|
|
"CVE-2022-24124": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.55295,
|
|
"epss_pct": 0.98958,
|
|
"name": "Casdoor 1.13.0 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24124.yaml"
|
|
},
|
|
"CVE-2022-24129": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.06139,
|
|
"epss_pct": 0.92943,
|
|
"name": "Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24129.yaml"
|
|
},
|
|
"CVE-2022-2414": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.85608,
|
|
"epss_pct": 0.99707,
|
|
"name": "FreeIPA - XML Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2414.yaml"
|
|
},
|
|
"CVE-2022-24181": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0608,
|
|
"epss_pct": 0.92889,
|
|
"name": "PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24181.yaml"
|
|
},
|
|
"CVE-2022-24223": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.61965,
|
|
"epss_pct": 0.99113,
|
|
"name": "Atom CMS v2.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24223.yaml"
|
|
},
|
|
"CVE-2022-24260": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.49992,
|
|
"epss_pct": 0.98816,
|
|
"name": "VoipMonitor - Pre-Auth SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24260.yaml"
|
|
},
|
|
"CVE-2022-24264": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06711,
|
|
"epss_pct": 0.93442,
|
|
"name": "Cuppa CMS v1.0 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24264.yaml"
|
|
},
|
|
"CVE-2022-24265": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06711,
|
|
"epss_pct": 0.93442,
|
|
"name": "Cuppa CMS v1.0 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24265.yaml"
|
|
},
|
|
"CVE-2022-24266": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05707,
|
|
"epss_pct": 0.92476,
|
|
"name": "Cuppa CMS v1.0 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24266.yaml"
|
|
},
|
|
"CVE-2022-24288": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.7788,
|
|
"epss_pct": 0.99536,
|
|
"name": "Apache Airflow OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24288.yaml"
|
|
},
|
|
"CVE-2022-24384": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0409,
|
|
"epss_pct": 0.90001,
|
|
"name": "SmarterTools SmarterTrack - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24384.yaml"
|
|
},
|
|
"CVE-2022-2461": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.03852,
|
|
"epss_pct": 0.89392,
|
|
"name": "Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2461.yaml"
|
|
},
|
|
"CVE-2022-2462": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03225,
|
|
"epss_pct": 0.87349,
|
|
"name": "WordPress Transposh <=1.0.8.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2462.yaml"
|
|
},
|
|
"CVE-2022-24627": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.26389,
|
|
"epss_pct": 0.97857,
|
|
"name": "AudioCodes Device Manager Express - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24627.yaml"
|
|
},
|
|
"CVE-2022-24637": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.99055,
|
|
"epss_pct": 0.99929,
|
|
"name": "Open Web Analytics 1.7.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24637.yaml"
|
|
},
|
|
"CVE-2022-2467": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04493,
|
|
"epss_pct": 0.908,
|
|
"name": "Garage Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2467.yaml"
|
|
},
|
|
"CVE-2022-24681": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03619,
|
|
"epss_pct": 0.88687,
|
|
"name": "ManageEngine ADSelfService Plus <6121 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24681.yaml"
|
|
},
|
|
"CVE-2022-24682": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-116",
|
|
"epss": 0.30931,
|
|
"epss_pct": 0.98124,
|
|
"name": "Zimbra Collaboration Suite < 8.8.15 - Improper Encoding",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24682.yaml"
|
|
},
|
|
"CVE-2022-24706": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.92414,
|
|
"epss_pct": 0.99817,
|
|
"name": "CouchDB Erlang Distribution - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-24706.yaml"
|
|
},
|
|
"CVE-2022-24716": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.89378,
|
|
"epss_pct": 0.99772,
|
|
"name": "Icinga Web 2 - Arbitrary File Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24716.yaml"
|
|
},
|
|
"CVE-2022-24816": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.98518,
|
|
"epss_pct": 0.99917,
|
|
"name": "GeoServer <1.2.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24816.yaml"
|
|
},
|
|
"CVE-2022-24819": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-359",
|
|
"epss": 0.03198,
|
|
"epss_pct": 0.87229,
|
|
"name": "XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24819.yaml"
|
|
},
|
|
"CVE-2022-24856": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.10479,
|
|
"epss_pct": 0.95418,
|
|
"name": "Flyte Console <0.52.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24856.yaml"
|
|
},
|
|
"CVE-2022-2486": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.29763,
|
|
"epss_pct": 0.98064,
|
|
"name": "Wavlink WN535K2/WN535K3 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2486.yaml"
|
|
},
|
|
"CVE-2022-2487": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.79513,
|
|
"epss_pct": 0.99573,
|
|
"name": "Wavlink WN535K2/WN535K3 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2487.yaml"
|
|
},
|
|
"CVE-2022-2488": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.32947,
|
|
"epss_pct": 0.98234,
|
|
"name": "Wavlink WN535K2/WN535K3 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2488.yaml"
|
|
},
|
|
"CVE-2022-24899": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04478,
|
|
"epss_pct": 0.90773,
|
|
"name": "Contao <4.13.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24899.yaml"
|
|
},
|
|
"CVE-2022-24900": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"epss": 0.0841,
|
|
"epss_pct": 0.94583,
|
|
"name": "Piano LED Visualizer 1.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24900.yaml"
|
|
},
|
|
"CVE-2022-24990": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.83553,
|
|
"epss_pct": 0.99663,
|
|
"name": "TerraMaster TOS < 4.2.30 Server Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24990.yaml"
|
|
},
|
|
"CVE-2022-25061": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.58701,
|
|
"epss_pct": 0.99036,
|
|
"name": "TP-Link TL-WR840N - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25061.yaml"
|
|
},
|
|
"CVE-2022-25082": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.15673,
|
|
"epss_pct": 0.96603,
|
|
"name": "TOTOLink - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25082.yaml"
|
|
},
|
|
"CVE-2022-25125": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06981,
|
|
"epss_pct": 0.93673,
|
|
"name": "MCMS 5.2.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25125.yaml"
|
|
},
|
|
"CVE-2022-25148": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.8093,
|
|
"epss_pct": 0.996,
|
|
"name": "WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25148.yaml"
|
|
},
|
|
"CVE-2022-25149": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.77956,
|
|
"epss_pct": 0.99539,
|
|
"name": "WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25149.yaml"
|
|
},
|
|
"CVE-2022-25216": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.13835,
|
|
"epss_pct": 0.96245,
|
|
"name": "DVDFab 12 Player/PlayerFab - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25216.yaml"
|
|
},
|
|
"CVE-2022-25226": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.11027,
|
|
"epss_pct": 0.95589,
|
|
"name": "ThinVNC - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25226.yaml"
|
|
},
|
|
"CVE-2022-25237": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.56724,
|
|
"epss_pct": 0.9899,
|
|
"name": "Bonita Web 2021.2 - Authentication/Authorization Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25237.yaml"
|
|
},
|
|
"CVE-2022-25322": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08346,
|
|
"epss_pct": 0.94547,
|
|
"name": "ZEROF Web Server 2.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25322.yaml"
|
|
},
|
|
"CVE-2022-25323": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03245,
|
|
"epss_pct": 0.87428,
|
|
"name": "ZEROF Web Server 2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25323.yaml"
|
|
},
|
|
"CVE-2022-2535": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.01909,
|
|
"epss_pct": 0.78315,
|
|
"name": "SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2535.yaml"
|
|
},
|
|
"CVE-2022-25356": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-91",
|
|
"epss": 0.05879,
|
|
"epss_pct": 0.92685,
|
|
"name": "Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25356.yaml"
|
|
},
|
|
"CVE-2022-25369": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.40739,
|
|
"epss_pct": 0.9855,
|
|
"name": "Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25369.yaml"
|
|
},
|
|
"CVE-2022-2544": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.04267,
|
|
"epss_pct": 0.90381,
|
|
"name": "WordPress Ninja Job Board < 1.3.3 - Direct Request",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2544.yaml"
|
|
},
|
|
"CVE-2022-2546": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01204,
|
|
"epss_pct": 0.66083,
|
|
"name": "WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2546.yaml"
|
|
},
|
|
"CVE-2022-25481": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.04748,
|
|
"epss_pct": 0.91235,
|
|
"name": "ThinkPHP 5.0.24 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25481.yaml"
|
|
},
|
|
"CVE-2022-25485": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-829",
|
|
"epss": 0.07927,
|
|
"epss_pct": 0.94309,
|
|
"name": "Cuppa CMS v1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25485.yaml"
|
|
},
|
|
"CVE-2022-25486": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-829",
|
|
"epss": 0.09966,
|
|
"epss_pct": 0.95256,
|
|
"name": "Cuppa CMS v1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25486.yaml"
|
|
},
|
|
"CVE-2022-25487": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.53839,
|
|
"epss_pct": 0.98923,
|
|
"name": "Atom CMS v2.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25487.yaml"
|
|
},
|
|
"CVE-2022-25488": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07148,
|
|
"epss_pct": 0.93812,
|
|
"name": "Atom CMS v2.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25488.yaml"
|
|
},
|
|
"CVE-2022-25489": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01459,
|
|
"epss_pct": 0.71682,
|
|
"name": "Atom CMS v2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25489.yaml"
|
|
},
|
|
"CVE-2022-25497": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.03642,
|
|
"epss_pct": 0.88773,
|
|
"name": "Cuppa CMS v1.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25497.yaml"
|
|
},
|
|
"CVE-2022-2551": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.16673,
|
|
"epss_pct": 0.96795,
|
|
"name": "WordPress Duplicator <1.4.7 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2551.yaml"
|
|
},
|
|
"CVE-2022-2552": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.11298,
|
|
"epss_pct": 0.9566,
|
|
"name": "Duplicator < 1.4.7.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2552.yaml"
|
|
},
|
|
"CVE-2022-25568": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.06885,
|
|
"epss_pct": 0.9359,
|
|
"name": "MotionEye Config Info Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25568.yaml"
|
|
},
|
|
"CVE-2022-2599": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01331,
|
|
"epss_pct": 0.69089,
|
|
"name": "WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2599.yaml"
|
|
},
|
|
"CVE-2022-26134": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-917",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99993,
|
|
"name": "Confluence - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml"
|
|
},
|
|
"CVE-2022-26138": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.9817,
|
|
"epss_pct": 0.9991,
|
|
"name": "Atlassian Questions For Confluence - Hardcoded Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26138.yaml"
|
|
},
|
|
"CVE-2022-26143": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.87212,
|
|
"epss_pct": 0.99737,
|
|
"name": "Mitel MiCollab - Information Disclosure & Denial of Service",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26143.yaml"
|
|
},
|
|
"CVE-2022-26148": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-312",
|
|
"epss": 0.53439,
|
|
"epss_pct": 0.98912,
|
|
"name": "Grafana & Zabbix Integration - Credentials Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26148.yaml"
|
|
},
|
|
"CVE-2022-26159": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.13372,
|
|
"epss_pct": 0.96137,
|
|
"name": "Ametys CMS Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26159.yaml"
|
|
},
|
|
"CVE-2022-26233": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15028,
|
|
"epss_pct": 0.9647,
|
|
"name": "Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26233.yaml"
|
|
},
|
|
"CVE-2022-26263": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.41722,
|
|
"epss_pct": 0.98582,
|
|
"name": "Yonyou U8 13.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26263.yaml"
|
|
},
|
|
"CVE-2022-2627": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01018,
|
|
"epss_pct": 0.609,
|
|
"name": "WordPress Newspaper < 12 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2627.yaml"
|
|
},
|
|
"CVE-2022-26271": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.04515,
|
|
"epss_pct": 0.90838,
|
|
"name": "74cmsSE v3.4.1 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26271.yaml"
|
|
},
|
|
"CVE-2022-2633": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-610",
|
|
"epss": 0.27193,
|
|
"epss_pct": 0.97909,
|
|
"name": "All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2633.yaml"
|
|
},
|
|
"CVE-2022-26352": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.91553,
|
|
"epss_pct": 0.99805,
|
|
"name": "DotCMS - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26352.yaml"
|
|
},
|
|
"CVE-2022-26564": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02759,
|
|
"epss_pct": 0.85223,
|
|
"name": "HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26564.yaml"
|
|
},
|
|
"CVE-2022-26585": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05475,
|
|
"epss_pct": 0.92196,
|
|
"name": "Mingsoft MCMS v5.2.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26585.yaml"
|
|
},
|
|
"CVE-2022-26833": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.37639,
|
|
"epss_pct": 0.98428,
|
|
"name": "Open Automation Software OAS Platform V16.00.0121 - Missing Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26833.yaml"
|
|
},
|
|
"CVE-2022-26960": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.50993,
|
|
"epss_pct": 0.98845,
|
|
"name": "elFinder <=2.1.60 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26960.yaml"
|
|
},
|
|
"CVE-2022-27043": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06299,
|
|
"epss_pct": 0.93099,
|
|
"name": "Yearning - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27043.yaml"
|
|
},
|
|
"CVE-2022-27228": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.20776,
|
|
"epss_pct": 0.97363,
|
|
"name": "Bitrix Site Manager - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27228.yaml"
|
|
},
|
|
"CVE-2022-2733": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.95839,
|
|
"epss_pct": 0.99869,
|
|
"name": "Openemr < 7.0.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2733.yaml"
|
|
},
|
|
"CVE-2022-2756": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03109,
|
|
"epss_pct": 0.86854,
|
|
"name": "Kavita <0.5.4.1 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2756.yaml"
|
|
},
|
|
"CVE-2022-27593": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-610",
|
|
"epss": 0.87908,
|
|
"epss_pct": 0.99752,
|
|
"name": "QNAP QTS Photo Station External Reference - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27593.yaml"
|
|
},
|
|
"CVE-2022-27849": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.04619,
|
|
"epss_pct": 0.91031,
|
|
"name": "WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27849.yaml"
|
|
},
|
|
"CVE-2022-27924": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.85398,
|
|
"epss_pct": 0.99703,
|
|
"name": "Zimbra Collaboration Suite - Memcached Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27924.yaml"
|
|
},
|
|
"CVE-2022-27926": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.17634,
|
|
"epss_pct": 0.96928,
|
|
"name": "Zimbra Collaboration (ZCS) - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27926.yaml"
|
|
},
|
|
"CVE-2022-27927": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13829,
|
|
"epss_pct": 0.96245,
|
|
"name": "Microfinance Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27927.yaml"
|
|
},
|
|
"CVE-2022-27984": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0678,
|
|
"epss_pct": 0.93509,
|
|
"name": "Cuppa CMS v1.0 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27984.yaml"
|
|
},
|
|
"CVE-2022-27985": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06598,
|
|
"epss_pct": 0.93359,
|
|
"name": "Cuppa CMS v1.0 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27985.yaml"
|
|
},
|
|
"CVE-2022-28032": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05922,
|
|
"epss_pct": 0.9272,
|
|
"name": "Atom CMS v2.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28032.yaml"
|
|
},
|
|
"CVE-2022-28033": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05412,
|
|
"epss_pct": 0.92128,
|
|
"name": "Atom.CMS 2.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28033.yaml"
|
|
},
|
|
"CVE-2022-28079": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.28512,
|
|
"epss_pct": 0.97991,
|
|
"name": "College Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28079.yaml"
|
|
},
|
|
"CVE-2022-28080": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.56907,
|
|
"epss_pct": 0.98994,
|
|
"name": "Royal Event - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28080.yaml"
|
|
},
|
|
"CVE-2022-28117": {
|
|
"cvss": 4.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.22903,
|
|
"epss_pct": 0.97577,
|
|
"name": "Navigate CMS 2.9.4 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28117.yaml"
|
|
},
|
|
"CVE-2022-28219": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.97193,
|
|
"epss_pct": 0.99889,
|
|
"name": "Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28219.yaml"
|
|
},
|
|
"CVE-2022-28290": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01436,
|
|
"epss_pct": 0.71244,
|
|
"name": "WordPress Country Selector <1.6.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28290.yaml"
|
|
},
|
|
"CVE-2022-28363": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0492,
|
|
"epss_pct": 0.91495,
|
|
"name": "Reprise License Manager 14.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28363.yaml"
|
|
},
|
|
"CVE-2022-28365": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.09149,
|
|
"epss_pct": 0.94949,
|
|
"name": "Reprise License Manager 14.2 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28365.yaml"
|
|
},
|
|
"CVE-2022-28508": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05324,
|
|
"epss_pct": 0.92031,
|
|
"name": "MantisBT < 2.25.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28508.yaml"
|
|
},
|
|
"CVE-2022-2863": {
|
|
"cvss": 4.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.20668,
|
|
"epss_pct": 0.97346,
|
|
"name": "WordPress WPvivid Backup <0.9.76 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2863.yaml"
|
|
},
|
|
"CVE-2022-28666": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.0137,
|
|
"epss_pct": 0.69983,
|
|
"name": "Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28666.yaml"
|
|
},
|
|
"CVE-2022-28923": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01431,
|
|
"epss_pct": 0.71155,
|
|
"name": "Caddy 2.4.6 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28923.yaml"
|
|
},
|
|
"CVE-2022-28955": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.39733,
|
|
"epss_pct": 0.98517,
|
|
"name": "D-Link DIR-816L - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28955.yaml"
|
|
},
|
|
"CVE-2022-28987": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.10365,
|
|
"epss_pct": 0.95386,
|
|
"name": "Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28987.yaml"
|
|
},
|
|
"CVE-2022-29004": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02944,
|
|
"epss_pct": 0.86165,
|
|
"name": "Diary Management System 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29004.yaml"
|
|
},
|
|
"CVE-2022-29005": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02178,
|
|
"epss_pct": 0.81072,
|
|
"name": "Online Birth Certificate System 1.2 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29005.yaml"
|
|
},
|
|
"CVE-2022-29006": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.19253,
|
|
"epss_pct": 0.97137,
|
|
"name": "Directory Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29006.yaml"
|
|
},
|
|
"CVE-2022-29007": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.19253,
|
|
"epss_pct": 0.97137,
|
|
"name": "Dairy Farm Shop Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29007.yaml"
|
|
},
|
|
"CVE-2022-29009": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.22909,
|
|
"epss_pct": 0.97577,
|
|
"name": "Cyber Cafe Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29009.yaml"
|
|
},
|
|
"CVE-2022-29013": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.76905,
|
|
"epss_pct": 0.99512,
|
|
"name": "Razer Sila Gaming Router - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29013.yaml"
|
|
},
|
|
"CVE-2022-29014": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.11816,
|
|
"epss_pct": 0.95781,
|
|
"name": "Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29014.yaml"
|
|
},
|
|
"CVE-2022-29078": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.32808,
|
|
"epss_pct": 0.98228,
|
|
"name": "Node.js Embedded JavaScript 3.1.6 - Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29078.yaml"
|
|
},
|
|
"CVE-2022-29081": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.83543,
|
|
"epss_pct": 0.99662,
|
|
"name": "Zoho ManageEngine - Access Control Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29081.yaml"
|
|
},
|
|
"CVE-2022-29153": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.08676,
|
|
"epss_pct": 0.94733,
|
|
"name": "HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29153.yaml"
|
|
},
|
|
"CVE-2022-29272": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.04038,
|
|
"epss_pct": 0.89884,
|
|
"name": "Nagios XI <5.8.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29272.yaml"
|
|
},
|
|
"CVE-2022-29298": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.46803,
|
|
"epss_pct": 0.98738,
|
|
"name": "SolarView Compact 6.00 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29298.yaml"
|
|
},
|
|
"CVE-2022-29303": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97997,
|
|
"epss_pct": 0.99906,
|
|
"name": "SolarView Compact 6.00 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29303.yaml"
|
|
},
|
|
"CVE-2022-29316": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03321,
|
|
"epss_pct": 0.87723,
|
|
"name": "Complete Online Job Search System 1.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29316.yaml"
|
|
},
|
|
"CVE-2022-29349": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0175,
|
|
"epss_pct": 0.76249,
|
|
"name": "kkFileView 4.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29349.yaml"
|
|
},
|
|
"CVE-2022-29383": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.48537,
|
|
"epss_pct": 0.9878,
|
|
"name": "NETGEAR ProSafe SSL VPN firmware - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29383.yaml"
|
|
},
|
|
"CVE-2022-29455": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.23678,
|
|
"epss_pct": 0.97648,
|
|
"name": "WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29455.yaml"
|
|
},
|
|
"CVE-2022-29464": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99994,
|
|
"name": "WSO2 Management - Arbitrary File Upload & Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29464.yaml"
|
|
},
|
|
"CVE-2022-29495": {
|
|
"name": "WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29495.yaml"
|
|
},
|
|
"CVE-2022-29548": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.41078,
|
|
"epss_pct": 0.9856,
|
|
"name": "WSO2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29548.yaml"
|
|
},
|
|
"CVE-2022-29775": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.60667,
|
|
"epss_pct": 0.99081,
|
|
"name": "iSpy 7.2.2.0 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29775.yaml"
|
|
},
|
|
"CVE-2022-30073": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01603,
|
|
"epss_pct": 0.74094,
|
|
"name": "WBCE CMS 1.5.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30073.yaml"
|
|
},
|
|
"CVE-2022-30489": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0416,
|
|
"epss_pct": 0.90155,
|
|
"name": "Wavlink WN-535G3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30489.yaml"
|
|
},
|
|
"CVE-2022-30512": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.09706,
|
|
"epss_pct": 0.95161,
|
|
"name": "School Dormitory Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30512.yaml"
|
|
},
|
|
"CVE-2022-30513": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03635,
|
|
"epss_pct": 0.88732,
|
|
"name": "School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30513.yaml"
|
|
},
|
|
"CVE-2022-30514": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03635,
|
|
"epss_pct": 0.88732,
|
|
"name": "School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30514.yaml"
|
|
},
|
|
"CVE-2022-30525": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99944,
|
|
"epss_pct": 0.99972,
|
|
"name": "Zyxel Firewall - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30525.yaml"
|
|
},
|
|
"CVE-2022-3062": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.44095,
|
|
"epss_pct": 0.98658,
|
|
"name": "Simple File List < 4.4.12 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3062.yaml"
|
|
},
|
|
"CVE-2022-30776": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04291,
|
|
"epss_pct": 0.90423,
|
|
"name": "Atmail 6.5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30776.yaml"
|
|
},
|
|
"CVE-2022-30777": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02296,
|
|
"epss_pct": 0.8205,
|
|
"name": "Parallels H-Sphere 3.6.1713 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30777.yaml"
|
|
},
|
|
"CVE-2022-31101": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.2317,
|
|
"epss_pct": 0.97601,
|
|
"name": "Prestashop Blockwishlist 2.1.0 SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31101.yaml"
|
|
},
|
|
"CVE-2022-31126": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.52137,
|
|
"epss_pct": 0.98875,
|
|
"name": "Roxy-WI - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31126.yaml"
|
|
},
|
|
"CVE-2022-31137": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.90387,
|
|
"epss_pct": 0.9979,
|
|
"name": "Roxy-WI < 6.1.1.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31137.yaml"
|
|
},
|
|
"CVE-2022-31161": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.26819,
|
|
"epss_pct": 0.97884,
|
|
"name": "Roxy-WI - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31161.yaml"
|
|
},
|
|
"CVE-2022-31181": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.06479,
|
|
"epss_pct": 0.93257,
|
|
"name": "PrestaShop - SQL Injection to Eval Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31181.yaml"
|
|
},
|
|
"CVE-2022-3124": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.06504,
|
|
"epss_pct": 0.93277,
|
|
"name": "Frontend File Manager < 21.3 - Unauthenticated File Renaming",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3124.yaml"
|
|
},
|
|
"CVE-2022-31260": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.01862,
|
|
"epss_pct": 0.77758,
|
|
"name": "ResourceSpace - Metadata Export",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31260.yaml"
|
|
},
|
|
"CVE-2022-31268": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10694,
|
|
"epss_pct": 0.95484,
|
|
"name": "Gitblit 1.9.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31268.yaml"
|
|
},
|
|
"CVE-2022-31269": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.06987,
|
|
"epss_pct": 0.93678,
|
|
"name": "Linear eMerge E3-Series - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31269.yaml"
|
|
},
|
|
"CVE-2022-31299": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05045,
|
|
"epss_pct": 0.9169,
|
|
"name": "Haraj 3.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31299.yaml"
|
|
},
|
|
"CVE-2022-31373": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05458,
|
|
"epss_pct": 0.92173,
|
|
"name": "SolarView Compact 6.00 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31373.yaml"
|
|
},
|
|
"CVE-2022-3142": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11416,
|
|
"epss_pct": 0.95687,
|
|
"name": "NEX-Forms Plugin < 7.9.7 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3142.yaml"
|
|
},
|
|
"CVE-2022-31470": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.52721,
|
|
"epss_pct": 0.98889,
|
|
"name": "Axigen WebMail - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31470.yaml"
|
|
},
|
|
"CVE-2022-31474": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.63761,
|
|
"epss_pct": 0.99159,
|
|
"name": "BackupBuddy - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31474.yaml"
|
|
},
|
|
"CVE-2022-31499": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.64589,
|
|
"epss_pct": 0.99178,
|
|
"name": "Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31499.yaml"
|
|
},
|
|
"CVE-2022-31656": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.2294,
|
|
"epss_pct": 0.97582,
|
|
"name": "VMware - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31656.yaml"
|
|
},
|
|
"CVE-2022-31678": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.08717,
|
|
"epss_pct": 0.94752,
|
|
"name": "VMWare Cloud Foundation NSX-V - XML External Entity (XXE)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31678.yaml"
|
|
},
|
|
"CVE-2022-31704": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.81011,
|
|
"epss_pct": 0.99602,
|
|
"name": "VMware vRealize Log Insight - Improper Access Control to RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31704.yaml"
|
|
},
|
|
"CVE-2022-31706": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.87077,
|
|
"epss_pct": 0.99734,
|
|
"name": "VMware vRealize Log Insight - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31706.yaml"
|
|
},
|
|
"CVE-2022-31711": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.21657,
|
|
"epss_pct": 0.97454,
|
|
"name": "VMware vRealize Log Insight < v8.10.2 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31711.yaml"
|
|
},
|
|
"CVE-2022-31793": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.15852,
|
|
"epss_pct": 0.96638,
|
|
"name": "muhttpd <=1.1.5 - Local Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-31793.yaml"
|
|
},
|
|
"CVE-2022-31798": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-384",
|
|
"epss": 0.08513,
|
|
"epss_pct": 0.94645,
|
|
"name": "Nortek Linear eMerge E3-Series - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31798.yaml"
|
|
},
|
|
"CVE-2022-31814": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.87798,
|
|
"epss_pct": 0.99749,
|
|
"name": "pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31814.yaml"
|
|
},
|
|
"CVE-2022-31845": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.08698,
|
|
"epss_pct": 0.94745,
|
|
"name": "WAVLINK WN535 G3 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31845.yaml"
|
|
},
|
|
"CVE-2022-31846": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.07429,
|
|
"epss_pct": 0.94003,
|
|
"name": "WAVLINK WN535 G3 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31846.yaml"
|
|
},
|
|
"CVE-2022-31847": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.06555,
|
|
"epss_pct": 0.93322,
|
|
"name": "WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31847.yaml"
|
|
},
|
|
"CVE-2022-31854": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.3283,
|
|
"epss_pct": 0.98229,
|
|
"name": "Codoforum 5.1 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31854.yaml"
|
|
},
|
|
"CVE-2022-31974": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05042,
|
|
"epss_pct": 0.91685,
|
|
"name": "Online Fire Reporting System v1.0 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31974.yaml"
|
|
},
|
|
"CVE-2022-31975": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04906,
|
|
"epss_pct": 0.91479,
|
|
"name": "Online Fire Reporting System v1.0 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31975.yaml"
|
|
},
|
|
"CVE-2022-31976": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07224,
|
|
"epss_pct": 0.93869,
|
|
"name": "Online Fire Reporting System v1.0 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31976.yaml"
|
|
},
|
|
"CVE-2022-31977": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07224,
|
|
"epss_pct": 0.93869,
|
|
"name": "Online Fire Reporting System v1.0 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31977.yaml"
|
|
},
|
|
"CVE-2022-31978": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07224,
|
|
"epss_pct": 0.9387,
|
|
"name": "Online Fire Reporting System v1.0 - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31978.yaml"
|
|
},
|
|
"CVE-2022-31984": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04906,
|
|
"epss_pct": 0.91479,
|
|
"name": "Online Fire Reporting System v1.0 - SQL injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31984.yaml"
|
|
},
|
|
"CVE-2022-32007": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04563,
|
|
"epss_pct": 0.90935,
|
|
"name": "Complete Online Job Search System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32007.yaml"
|
|
},
|
|
"CVE-2022-32015": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04563,
|
|
"epss_pct": 0.90936,
|
|
"name": "Complete Online Job Search System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32015.yaml"
|
|
},
|
|
"CVE-2022-32018": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04563,
|
|
"epss_pct": 0.90935,
|
|
"name": "Complete Online Job Search System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32018.yaml"
|
|
},
|
|
"CVE-2022-32022": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04923,
|
|
"epss_pct": 0.915,
|
|
"name": "Car Rental Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32022.yaml"
|
|
},
|
|
"CVE-2022-32024": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04563,
|
|
"epss_pct": 0.90935,
|
|
"name": "Car Rental Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32024.yaml"
|
|
},
|
|
"CVE-2022-32025": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04563,
|
|
"epss_pct": 0.90935,
|
|
"name": "Car Rental Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32025.yaml"
|
|
},
|
|
"CVE-2022-32026": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05308,
|
|
"epss_pct": 0.92015,
|
|
"name": "Car Rental Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32026.yaml"
|
|
},
|
|
"CVE-2022-32028": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05059,
|
|
"epss_pct": 0.91705,
|
|
"name": "Car Rental Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32028.yaml"
|
|
},
|
|
"CVE-2022-32094": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07635,
|
|
"epss_pct": 0.94133,
|
|
"name": "Hospital Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32094.yaml"
|
|
},
|
|
"CVE-2022-32195": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02407,
|
|
"epss_pct": 0.82903,
|
|
"name": "Open edX <2022-06-06 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32195.yaml"
|
|
},
|
|
"CVE-2022-3236": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.98905,
|
|
"epss_pct": 0.99924,
|
|
"name": "Sophos Firewall <= 19.0 MR1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3236.yaml"
|
|
},
|
|
"CVE-2022-32409": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12593,
|
|
"epss_pct": 0.9595,
|
|
"name": "Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32409.yaml"
|
|
},
|
|
"CVE-2022-3242": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.0152,
|
|
"epss_pct": 0.7278,
|
|
"name": "Microweber <1.3.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3242.yaml"
|
|
},
|
|
"CVE-2022-32429": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.75556,
|
|
"epss_pct": 0.9948,
|
|
"name": "MSNSwitch Firmware MNT.2408 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32429.yaml"
|
|
},
|
|
"CVE-2022-32430": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.04645,
|
|
"epss_pct": 0.91073,
|
|
"name": "Lin CMS Spring Boot - Default JWT Token",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32430.yaml"
|
|
},
|
|
"CVE-2022-32444": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02396,
|
|
"epss_pct": 0.82828,
|
|
"name": "u5cms v8.3.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32444.yaml"
|
|
},
|
|
"CVE-2022-3254": {
|
|
"name": "AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3254.yaml"
|
|
},
|
|
"CVE-2022-32770": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04448,
|
|
"epss_pct": 0.90727,
|
|
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32770.yaml"
|
|
},
|
|
"CVE-2022-32771": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04226,
|
|
"epss_pct": 0.90296,
|
|
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32771.yaml"
|
|
},
|
|
"CVE-2022-32772": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03871,
|
|
"epss_pct": 0.89449,
|
|
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32772.yaml"
|
|
},
|
|
"CVE-2022-33119": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01551,
|
|
"epss_pct": 0.73339,
|
|
"name": "NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33119.yaml"
|
|
},
|
|
"CVE-2022-33174": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.14116,
|
|
"epss_pct": 0.963,
|
|
"name": "Powertek Firmware <3.30.30 - Authorization Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33174.yaml"
|
|
},
|
|
"CVE-2022-33198": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.03225,
|
|
"epss_pct": 0.87353,
|
|
"name": "WordPress Accordions - Unauthenticated Settings Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33198.yaml"
|
|
},
|
|
"CVE-2022-33891": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.93076,
|
|
"epss_pct": 0.99826,
|
|
"name": "Apache Spark UI - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33891.yaml"
|
|
},
|
|
"CVE-2022-33901": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02599,
|
|
"epss_pct": 0.8424,
|
|
"name": "WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33901.yaml"
|
|
},
|
|
"CVE-2022-33965": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04334,
|
|
"epss_pct": 0.90502,
|
|
"name": "WordPress Visitor Statistics <=5.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33965.yaml"
|
|
},
|
|
"CVE-2022-34045": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.03193,
|
|
"epss_pct": 0.87206,
|
|
"name": "WAVLINK WN530HG4 - Improper Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34045.yaml"
|
|
},
|
|
"CVE-2022-34046": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.20351,
|
|
"epss_pct": 0.97297,
|
|
"name": "WAVLINK WN533A8 - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34046.yaml"
|
|
},
|
|
"CVE-2022-34047": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.21387,
|
|
"epss_pct": 0.97427,
|
|
"name": "WAVLINK WN530HG4 - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34047.yaml"
|
|
},
|
|
"CVE-2022-34048": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06461,
|
|
"epss_pct": 0.93242,
|
|
"name": "Wavlink WN-533A8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34048.yaml"
|
|
},
|
|
"CVE-2022-34049": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.0264,
|
|
"epss_pct": 0.845,
|
|
"name": "WAVLINK WN530HG4 - Improper Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34049.yaml"
|
|
},
|
|
"CVE-2022-34093": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02804,
|
|
"epss_pct": 0.85484,
|
|
"name": "Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34093.yaml"
|
|
},
|
|
"CVE-2022-34094": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02804,
|
|
"epss_pct": 0.85484,
|
|
"name": "Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34094.yaml"
|
|
},
|
|
"CVE-2022-34121": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-829",
|
|
"epss": 0.03624,
|
|
"epss_pct": 0.88699,
|
|
"name": "CuppaCMS v1.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34121.yaml"
|
|
},
|
|
"CVE-2022-34265": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.73274,
|
|
"epss_pct": 0.99418,
|
|
"name": "Django - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2022/CVE-2022-34265.yaml"
|
|
},
|
|
"CVE-2022-34267": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.42162,
|
|
"epss_pct": 0.98594,
|
|
"name": "RWS WorldServer - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34267.yaml"
|
|
},
|
|
"CVE-2022-34305": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06562,
|
|
"epss_pct": 0.93328,
|
|
"name": "Apache Tomcat Examples Web Application - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34305.yaml"
|
|
},
|
|
"CVE-2022-34328": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02299,
|
|
"epss_pct": 0.82076,
|
|
"name": "PMB 7.3.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34328.yaml"
|
|
},
|
|
"CVE-2022-34487": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-264",
|
|
"epss": 0.03225,
|
|
"epss_pct": 0.87353,
|
|
"name": "ShortCode Addons - Unauthenticated Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34487.yaml"
|
|
},
|
|
"CVE-2022-34534": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02457,
|
|
"epss_pct": 0.83278,
|
|
"name": "Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34534.yaml"
|
|
},
|
|
"CVE-2022-34576": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.0364,
|
|
"epss_pct": 0.88752,
|
|
"name": "WAVLINK WN535 G3 - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34576.yaml"
|
|
},
|
|
"CVE-2022-34590": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04475,
|
|
"epss_pct": 0.90769,
|
|
"name": "Hospital Management System 1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34590.yaml"
|
|
},
|
|
"CVE-2022-34753": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.71284,
|
|
"epss_pct": 0.99363,
|
|
"name": "SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34753.yaml"
|
|
},
|
|
"CVE-2022-3477": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.03583,
|
|
"epss_pct": 0.88581,
|
|
"name": "WordPress tagDiv Composer < 3.5 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3477.yaml"
|
|
},
|
|
"CVE-2022-3481": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.03725,
|
|
"epss_pct": 0.89014,
|
|
"name": "NotificationX Dropshipping < 4.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3481.yaml"
|
|
},
|
|
"CVE-2022-3484": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00912,
|
|
"epss_pct": 0.57542,
|
|
"name": "WordPress WPB Show Core - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3484.yaml"
|
|
},
|
|
"CVE-2022-3506": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0119,
|
|
"epss_pct": 0.65731,
|
|
"name": "WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3506.yaml"
|
|
},
|
|
"CVE-2022-35151": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01361,
|
|
"epss_pct": 0.69791,
|
|
"name": "kkFileView 4.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35151.yaml"
|
|
},
|
|
"CVE-2022-35405": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99927,
|
|
"epss_pct": 0.99968,
|
|
"name": "Zoho ManageEngine - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35405.yaml"
|
|
},
|
|
"CVE-2022-35413": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.14054,
|
|
"epss_pct": 0.9629,
|
|
"name": "WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35413.yaml"
|
|
},
|
|
"CVE-2022-35416": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02886,
|
|
"epss_pct": 0.85893,
|
|
"name": "H3C SSL VPN <=2022-07-10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35416.yaml"
|
|
},
|
|
"CVE-2022-35493": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01854,
|
|
"epss_pct": 0.77658,
|
|
"name": "eShop 3.0.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35493.yaml"
|
|
},
|
|
"CVE-2022-35507": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.01391,
|
|
"epss_pct": 0.70407,
|
|
"name": "Proxmox - CRLF Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35507.yaml"
|
|
},
|
|
"CVE-2022-35653": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.04458,
|
|
"epss_pct": 0.90744,
|
|
"name": "Moodle LTI module Reflected - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35653.yaml"
|
|
},
|
|
"CVE-2022-3578": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00956,
|
|
"epss_pct": 0.58959,
|
|
"name": "WordPress ProfileGrid <5.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3578.yaml"
|
|
},
|
|
"CVE-2022-3590": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-367",
|
|
"epss": 0.0315,
|
|
"epss_pct": 0.87031,
|
|
"name": "WordPress <= 6.2 - Server Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3590.yaml"
|
|
},
|
|
"CVE-2022-35914": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.99662,
|
|
"epss_pct": 0.99948,
|
|
"name": "GLPI <=10.0.2 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35914.yaml"
|
|
},
|
|
"CVE-2022-36446": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-116",
|
|
"epss": 0.96049,
|
|
"epss_pct": 0.99871,
|
|
"name": "Webmin <1.997 - Authenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36446.yaml"
|
|
},
|
|
"CVE-2022-36537": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.95335,
|
|
"epss_pct": 0.9986,
|
|
"name": "ZK Framework - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36537.yaml"
|
|
},
|
|
"CVE-2022-36553": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.90902,
|
|
"epss_pct": 0.99797,
|
|
"name": "Hytec Inter HWL-2511-SS - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36553.yaml"
|
|
},
|
|
"CVE-2022-36642": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.12591,
|
|
"epss_pct": 0.9595,
|
|
"name": "Omnia MPX 1.5.0+r1 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36642.yaml"
|
|
},
|
|
"CVE-2022-36804": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99077,
|
|
"epss_pct": 0.9993,
|
|
"name": "Atlassian Bitbucket - Remote Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36804.yaml"
|
|
},
|
|
"CVE-2022-36883": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.06453,
|
|
"epss_pct": 0.93236,
|
|
"name": "Jenkins Git <=4.11.3 - Missing Authorization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36883.yaml"
|
|
},
|
|
"CVE-2022-36923": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.071,
|
|
"epss_pct": 0.9377,
|
|
"name": "Zoho ManageEngine - getUserAPIKey Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36923.yaml"
|
|
},
|
|
"CVE-2022-37042": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.91893,
|
|
"epss_pct": 0.99809,
|
|
"name": "Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml"
|
|
},
|
|
"CVE-2022-37061": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99607,
|
|
"epss_pct": 0.99946,
|
|
"name": "FLIR AX8 1.46.16 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37061.yaml"
|
|
},
|
|
"CVE-2022-37122": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.23061,
|
|
"epss_pct": 0.97591,
|
|
"name": "Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37122.yaml"
|
|
},
|
|
"CVE-2022-37153": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01647,
|
|
"epss_pct": 0.74783,
|
|
"name": "Artica Proxy 4.30.000000 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37153.yaml"
|
|
},
|
|
"CVE-2022-37190": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-732",
|
|
"epss": 0.45769,
|
|
"epss_pct": 0.98711,
|
|
"name": "Cuppa CMS v1.0 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37190.yaml"
|
|
},
|
|
"CVE-2022-37191": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-829",
|
|
"epss": 0.02798,
|
|
"epss_pct": 0.85449,
|
|
"name": "Cuppa CMS v1.0 - Authenticated Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37191.yaml"
|
|
},
|
|
"CVE-2022-37299": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03104,
|
|
"epss_pct": 0.86836,
|
|
"name": "Shirne CMS 1.2.0 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37299.yaml"
|
|
},
|
|
"CVE-2022-3766": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06132,
|
|
"epss_pct": 0.92937,
|
|
"name": "phpMyFAQ < 3.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3766.yaml"
|
|
},
|
|
"CVE-2022-3768": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03663,
|
|
"epss_pct": 0.88841,
|
|
"name": "WordPress WPSmartContracts <1.3.12 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3768.yaml"
|
|
},
|
|
"CVE-2022-37932": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.02641,
|
|
"epss_pct": 0.84503,
|
|
"name": "HP Switch - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37932.yaml"
|
|
},
|
|
"CVE-2022-3800": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.02344,
|
|
"epss_pct": 0.82451,
|
|
"name": "IBAX - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3800.yaml"
|
|
},
|
|
"CVE-2022-3805": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01594,
|
|
"epss_pct": 0.73967,
|
|
"name": "Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3805.yaml"
|
|
},
|
|
"CVE-2022-38130": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.54072,
|
|
"epss_pct": 0.98929,
|
|
"name": "KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38130.yaml"
|
|
},
|
|
"CVE-2022-38131": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01403,
|
|
"epss_pct": 0.70633,
|
|
"name": "RStudio Connect - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38131.yaml"
|
|
},
|
|
"CVE-2022-38295": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01134,
|
|
"epss_pct": 0.64204,
|
|
"name": "Cuppa CMS v1.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38295.yaml"
|
|
},
|
|
"CVE-2022-38296": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04053,
|
|
"epss_pct": 0.8992,
|
|
"name": "Cuppa CMS v1.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38296.yaml"
|
|
},
|
|
"CVE-2022-38463": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02669,
|
|
"epss_pct": 0.84689,
|
|
"name": "ServiceNow - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38463.yaml"
|
|
},
|
|
"CVE-2022-38467": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0081,
|
|
"epss_pct": 0.54395,
|
|
"name": "CRM Perks Forms < 1.1.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38467.yaml"
|
|
},
|
|
"CVE-2022-38553": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02426,
|
|
"epss_pct": 0.83051,
|
|
"name": "Academy Learning Management System <5.9.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38553.yaml"
|
|
},
|
|
"CVE-2022-38627": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04305,
|
|
"epss_pct": 0.90449,
|
|
"name": "Nortek Linear eMerge E3-Series - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38627.yaml"
|
|
},
|
|
"CVE-2022-38637": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04917,
|
|
"epss_pct": 0.91491,
|
|
"name": "Hospital Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38637.yaml"
|
|
},
|
|
"CVE-2022-3869": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01302,
|
|
"epss_pct": 0.68459,
|
|
"name": "Froxlor < 0.10.38.2. - HTML Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3869.yaml"
|
|
},
|
|
"CVE-2022-38794": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03928,
|
|
"epss_pct": 0.89612,
|
|
"name": "Zaver - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38794.yaml"
|
|
},
|
|
"CVE-2022-38812": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02603,
|
|
"epss_pct": 0.8426,
|
|
"name": "AeroCMS 0.1.1 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38812.yaml"
|
|
},
|
|
"CVE-2022-38817": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.03206,
|
|
"epss_pct": 0.87264,
|
|
"name": "Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38817.yaml"
|
|
},
|
|
"CVE-2022-38840": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.09803,
|
|
"epss_pct": 0.95198,
|
|
"name": "G\u00fcralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38840.yaml"
|
|
},
|
|
"CVE-2022-38870": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.03066,
|
|
"epss_pct": 0.86691,
|
|
"name": "Free5gc 3.2.1 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38870.yaml"
|
|
},
|
|
"CVE-2022-39048": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01089,
|
|
"epss_pct": 0.62989,
|
|
"name": "ServiceNow - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39048.yaml"
|
|
},
|
|
"CVE-2022-3908": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00897,
|
|
"epss_pct": 0.57074,
|
|
"name": "WordPress Helloprint <1.4.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3908.yaml"
|
|
},
|
|
"CVE-2022-39195": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06314,
|
|
"epss_pct": 0.93114,
|
|
"name": "LISTSERV 17 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39195.yaml"
|
|
},
|
|
"CVE-2022-39258": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01472,
|
|
"epss_pct": 0.7195,
|
|
"name": "Mailcow Dockerized Swagger UI - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39258.yaml"
|
|
},
|
|
"CVE-2022-3933": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00869,
|
|
"epss_pct": 0.56251,
|
|
"name": "WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3933.yaml"
|
|
},
|
|
"CVE-2022-3934": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00869,
|
|
"epss_pct": 0.5625,
|
|
"name": "WordPress FlatPM <3.0.13 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3934.yaml"
|
|
},
|
|
"CVE-2022-3980": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.08413,
|
|
"epss_pct": 0.94585,
|
|
"name": "Sophos Mobile managed on-premises - XML External Entity Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3980.yaml"
|
|
},
|
|
"CVE-2022-3982": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04493,
|
|
"epss_pct": 0.90801,
|
|
"name": "WordPress Booking Calendar <3.2.2 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3982.yaml"
|
|
},
|
|
"CVE-2022-39952": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99809,
|
|
"epss_pct": 0.99957,
|
|
"name": "Fortinet FortiNAC - Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39952.yaml"
|
|
},
|
|
"CVE-2022-39960": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.2568,
|
|
"epss_pct": 0.9781,
|
|
"name": "Jira Netic Group Export <1.0.3 - Missing Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39960.yaml"
|
|
},
|
|
"CVE-2022-39986": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99034,
|
|
"epss_pct": 0.99929,
|
|
"name": "RaspAP 2.8.7 - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39986.yaml"
|
|
},
|
|
"CVE-2022-40022": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.92472,
|
|
"epss_pct": 0.99817,
|
|
"name": "Symmetricom SyncServer Unauthenticated - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40022.yaml"
|
|
},
|
|
"CVE-2022-40032": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.20693,
|
|
"epss_pct": 0.97352,
|
|
"name": "Simple Task Managing System v1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40032.yaml"
|
|
},
|
|
"CVE-2022-40047": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01199,
|
|
"epss_pct": 0.65955,
|
|
"name": "Flatpress < v1.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40047.yaml"
|
|
},
|
|
"CVE-2022-40083": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02473,
|
|
"epss_pct": 0.83378,
|
|
"name": "Labstack Echo 4.8.0 - Open Redirect",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40083.yaml"
|
|
},
|
|
"CVE-2022-40127": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.85653,
|
|
"epss_pct": 0.99707,
|
|
"name": "AirFlow < 2.4.0 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40127.yaml"
|
|
},
|
|
"CVE-2022-40359": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01479,
|
|
"epss_pct": 0.7207,
|
|
"name": "Kae's File Manager <=1.4.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40359.yaml"
|
|
},
|
|
"CVE-2022-40443": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02224,
|
|
"epss_pct": 0.81472,
|
|
"name": "ZZCMS 2022 - Path Information Disclosure",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40443.yaml"
|
|
},
|
|
"CVE-2022-4049": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04756,
|
|
"epss_pct": 0.91246,
|
|
"name": "WP User <= 7.0 - Unauthenticated SQLi",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4049.yaml"
|
|
},
|
|
"CVE-2022-4050": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04756,
|
|
"epss_pct": 0.91246,
|
|
"name": "WordPress JoomSport <5.2.8 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4050.yaml"
|
|
},
|
|
"CVE-2022-4057": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.0146,
|
|
"epss_pct": 0.71722,
|
|
"name": "Autoptimize < 3.1.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4057.yaml"
|
|
},
|
|
"CVE-2022-4059": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04795,
|
|
"epss_pct": 0.91306,
|
|
"name": "Cryptocurrency Widgets Pack < 2.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4059.yaml"
|
|
},
|
|
"CVE-2022-4060": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.42723,
|
|
"epss_pct": 0.98615,
|
|
"name": "WordPress User Post Gallery <=2.19 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4060.yaml"
|
|
},
|
|
"CVE-2022-40624": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.17107,
|
|
"epss_pct": 0.96857,
|
|
"name": "pfSense pfBlockerNG - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40624.yaml"
|
|
},
|
|
"CVE-2022-4063": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09519,
|
|
"epss_pct": 0.95091,
|
|
"name": "WordPress InPost Gallery <2.1.4.1 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4063.yaml"
|
|
},
|
|
"CVE-2022-40684": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99984,
|
|
"epss_pct": 0.99982,
|
|
"name": "Fortinet - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml"
|
|
},
|
|
"CVE-2022-40734": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04197,
|
|
"epss_pct": 0.90231,
|
|
"name": "Laravel Filemanager v2.5.1 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40734.yaml"
|
|
},
|
|
"CVE-2022-40843": {
|
|
"cvss": 4.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.28802,
|
|
"epss_pct": 0.98009,
|
|
"name": "Tenda AC1200 V-W15Ev2 - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40843.yaml"
|
|
},
|
|
"CVE-2022-40879": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01157,
|
|
"epss_pct": 0.64842,
|
|
"name": "kkFileView 4.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40879.yaml"
|
|
},
|
|
"CVE-2022-40881": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.29722,
|
|
"epss_pct": 0.98062,
|
|
"name": "SolarView 6.00 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40881.yaml"
|
|
},
|
|
"CVE-2022-4117": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04955,
|
|
"epss_pct": 0.91559,
|
|
"name": "WordPress IWS Geo Form Fields <=1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4117.yaml"
|
|
},
|
|
"CVE-2022-41352": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.95478,
|
|
"epss_pct": 0.99863,
|
|
"name": "Zimbra Collaboration - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41352.yaml"
|
|
},
|
|
"CVE-2022-4140": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.02941,
|
|
"epss_pct": 0.86148,
|
|
"name": "WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4140.yaml"
|
|
},
|
|
"CVE-2022-41412": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.04088,
|
|
"epss_pct": 0.89998,
|
|
"name": "perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41412.yaml"
|
|
},
|
|
"CVE-2022-41441": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05187,
|
|
"epss_pct": 0.91874,
|
|
"name": "ReQlogic v11.3 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41441.yaml"
|
|
},
|
|
"CVE-2022-41473": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01054,
|
|
"epss_pct": 0.62007,
|
|
"name": "RPCMS 3.0.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41473.yaml"
|
|
},
|
|
"CVE-2022-41678": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.8581,
|
|
"epss_pct": 0.99712,
|
|
"name": "Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41678.yaml"
|
|
},
|
|
"CVE-2022-41697": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-204",
|
|
"epss": 0.20041,
|
|
"epss_pct": 0.9725,
|
|
"name": "Ghost CMS - User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41697.yaml"
|
|
},
|
|
"CVE-2022-41800": {
|
|
"cvss": 8.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.76866,
|
|
"epss_pct": 0.9951,
|
|
"name": "F5 BIG-IP Appliance Mode - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41800.yaml"
|
|
},
|
|
"CVE-2022-41840": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05212,
|
|
"epss_pct": 0.9191,
|
|
"name": "Welcart eCommerce <=2.7.7 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41840.yaml"
|
|
},
|
|
"CVE-2022-42094": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02505,
|
|
"epss_pct": 0.836,
|
|
"name": "Backdrop CMS version 1.23.0 - Stored Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42094.yaml"
|
|
},
|
|
"CVE-2022-42095": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01947,
|
|
"epss_pct": 0.78753,
|
|
"name": "Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42095.yaml"
|
|
},
|
|
"CVE-2022-42096": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0196,
|
|
"epss_pct": 0.78894,
|
|
"name": "Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42096.yaml"
|
|
},
|
|
"CVE-2022-42118": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0093,
|
|
"epss_pct": 0.58118,
|
|
"name": "Liferay Portal - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42118.yaml"
|
|
},
|
|
"CVE-2022-42149": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02334,
|
|
"epss_pct": 0.82369,
|
|
"name": "kkFileView 4.0 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42149.yaml"
|
|
},
|
|
"CVE-2022-4223": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.80069,
|
|
"epss_pct": 0.99584,
|
|
"name": "pgAdmin < 6.17 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4223.yaml"
|
|
},
|
|
"CVE-2022-42233": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.42704,
|
|
"epss_pct": 0.98614,
|
|
"name": "Tenda 11N - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42233.yaml"
|
|
},
|
|
"CVE-2022-42475": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99474,
|
|
"epss_pct": 0.99941,
|
|
"name": "Fortinet SSL-VPN - Heap-Based Buffer Overflow",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2022/CVE-2022-42475.yaml"
|
|
},
|
|
"CVE-2022-4260": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00851,
|
|
"epss_pct": 0.55668,
|
|
"name": "WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4260.yaml"
|
|
},
|
|
"CVE-2022-42746": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01129,
|
|
"epss_pct": 0.64085,
|
|
"name": "CandidATS 3.0.0 - Cross-Site Scripting.",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42746.yaml"
|
|
},
|
|
"CVE-2022-42747": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01082,
|
|
"epss_pct": 0.62808,
|
|
"name": "CandidATS 3.0.0 - Cross-Site Scripting.",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42747.yaml"
|
|
},
|
|
"CVE-2022-42748": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01082,
|
|
"epss_pct": 0.62809,
|
|
"name": "CandidATS 3.0.0 - Cross-Site Scripting.",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42748.yaml"
|
|
},
|
|
"CVE-2022-42749": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01082,
|
|
"epss_pct": 0.62809,
|
|
"name": "CandidATS 3.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42749.yaml"
|
|
},
|
|
"CVE-2022-42889": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99931,
|
|
"epss_pct": 0.99968,
|
|
"name": "Text4Shell - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2022/CVE-2022-42889.yaml"
|
|
},
|
|
"CVE-2022-4295": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00897,
|
|
"epss_pct": 0.57074,
|
|
"name": "Show all comments < 7.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4295.yaml"
|
|
},
|
|
"CVE-2022-4301": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00902,
|
|
"epss_pct": 0.5724,
|
|
"name": "WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4301.yaml"
|
|
},
|
|
"CVE-2022-43014": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01366,
|
|
"epss_pct": 0.69899,
|
|
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43014.yaml"
|
|
},
|
|
"CVE-2022-43015": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01366,
|
|
"epss_pct": 0.69899,
|
|
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43015.yaml"
|
|
},
|
|
"CVE-2022-43016": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01425,
|
|
"epss_pct": 0.71061,
|
|
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43016.yaml"
|
|
},
|
|
"CVE-2022-43017": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01425,
|
|
"epss_pct": 0.71061,
|
|
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43017.yaml"
|
|
},
|
|
"CVE-2022-43018": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01425,
|
|
"epss_pct": 0.71061,
|
|
"name": "OpenCATS 0.9.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43018.yaml"
|
|
},
|
|
"CVE-2022-4305": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.38625,
|
|
"epss_pct": 0.9847,
|
|
"name": "Login as User or Customer < 3.3 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4305.yaml"
|
|
},
|
|
"CVE-2022-4306": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00841,
|
|
"epss_pct": 0.55347,
|
|
"name": "WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4306.yaml"
|
|
},
|
|
"CVE-2022-43140": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.0197,
|
|
"epss_pct": 0.78996,
|
|
"name": "kkFileView 4.1.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43140.yaml"
|
|
},
|
|
"CVE-2022-43164": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00918,
|
|
"epss_pct": 0.57734,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43164.yaml"
|
|
},
|
|
"CVE-2022-43165": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00918,
|
|
"epss_pct": 0.57733,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43165.yaml"
|
|
},
|
|
"CVE-2022-43166": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00918,
|
|
"epss_pct": 0.57734,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43166.yaml"
|
|
},
|
|
"CVE-2022-43167": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00976,
|
|
"epss_pct": 0.59657,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43167.yaml"
|
|
},
|
|
"CVE-2022-43169": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00918,
|
|
"epss_pct": 0.57734,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43169.yaml"
|
|
},
|
|
"CVE-2022-43170": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00918,
|
|
"epss_pct": 0.57734,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43170.yaml"
|
|
},
|
|
"CVE-2022-43185": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01009,
|
|
"epss_pct": 0.60651,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43185.yaml"
|
|
},
|
|
"CVE-2022-4320": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00891,
|
|
"epss_pct": 0.56883,
|
|
"name": "WordPress Events Calendar <1.4.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4320.yaml"
|
|
},
|
|
"CVE-2022-4321": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01193,
|
|
"epss_pct": 0.65809,
|
|
"name": "PDF Generator for WordPress < 1.1.2 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4321.yaml"
|
|
},
|
|
"CVE-2022-4325": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00902,
|
|
"epss_pct": 0.5724,
|
|
"name": "WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4325.yaml"
|
|
},
|
|
"CVE-2022-4328": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04427,
|
|
"epss_pct": 0.90678,
|
|
"name": "WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4328.yaml"
|
|
},
|
|
"CVE-2022-4375": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.0289,
|
|
"epss_pct": 0.85918,
|
|
"name": "Mingsoft MCMS - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4375.yaml"
|
|
},
|
|
"CVE-2022-43769": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.9767,
|
|
"epss_pct": 0.99899,
|
|
"name": "Hitachi Pentaho Business Analytics Server - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43769.yaml"
|
|
},
|
|
"CVE-2022-43939": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
|
|
"cwe": "CWE-647",
|
|
"epss": 0.92266,
|
|
"epss_pct": 0.99815,
|
|
"name": "Hitachi Pentaho Business Analytics Server - Bypass Authorization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43939.yaml"
|
|
},
|
|
"CVE-2022-44290": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03587,
|
|
"epss_pct": 0.88589,
|
|
"name": "WebTareas 2.4p5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44290.yaml"
|
|
},
|
|
"CVE-2022-44291": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03587,
|
|
"epss_pct": 0.8859,
|
|
"name": "WebTareas 2.4p5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44291.yaml"
|
|
},
|
|
"CVE-2022-44356": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02734,
|
|
"epss_pct": 0.8506,
|
|
"name": "WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44356.yaml"
|
|
},
|
|
"CVE-2022-4447": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04756,
|
|
"epss_pct": 0.91247,
|
|
"name": "WordPress Fontsy <=1.8.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4447.yaml"
|
|
},
|
|
"CVE-2022-44588": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02249,
|
|
"epss_pct": 0.81667,
|
|
"name": "Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44588.yaml"
|
|
},
|
|
"CVE-2022-44727": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02486,
|
|
"epss_pct": 0.83469,
|
|
"name": "PrestaShop lgcookieslaw - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44727.yaml"
|
|
},
|
|
"CVE-2022-44877": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99995,
|
|
"epss_pct": 0.99987,
|
|
"name": "CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44877.yaml"
|
|
},
|
|
"CVE-2022-44944": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01037,
|
|
"epss_pct": 0.61515,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44944.yaml"
|
|
},
|
|
"CVE-2022-44946": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01037,
|
|
"epss_pct": 0.61515,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44946.yaml"
|
|
},
|
|
"CVE-2022-44947": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00961,
|
|
"epss_pct": 0.59109,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44947.yaml"
|
|
},
|
|
"CVE-2022-44948": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00903,
|
|
"epss_pct": 0.57285,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44948.yaml"
|
|
},
|
|
"CVE-2022-44949": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00937,
|
|
"epss_pct": 0.58369,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44949.yaml"
|
|
},
|
|
"CVE-2022-44950": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00937,
|
|
"epss_pct": 0.58369,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44950.yaml"
|
|
},
|
|
"CVE-2022-44951": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00937,
|
|
"epss_pct": 0.5837,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44951.yaml"
|
|
},
|
|
"CVE-2022-44952": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00903,
|
|
"epss_pct": 0.57285,
|
|
"name": "Rukovoditel <= 3.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44952.yaml"
|
|
},
|
|
"CVE-2022-44957": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01037,
|
|
"epss_pct": 0.61515,
|
|
"name": "WebTareas 2.4p5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44957.yaml"
|
|
},
|
|
"CVE-2022-45037": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01024,
|
|
"epss_pct": 0.61099,
|
|
"name": "WBCE CMS v1.5.4 - Cross Site Scripting (Stored)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45037.yaml"
|
|
},
|
|
"CVE-2022-45038": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01024,
|
|
"epss_pct": 0.61098,
|
|
"name": "WBCE CMS v1.5.4 - Cross Site Scripting (Stored)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45038.yaml"
|
|
},
|
|
"CVE-2022-45269": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03092,
|
|
"epss_pct": 0.8679,
|
|
"name": "Linx Sphere - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45269.yaml"
|
|
},
|
|
"CVE-2022-45354": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.38083,
|
|
"epss_pct": 0.98448,
|
|
"name": "Download Monitor <= 4.7.60 - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45354.yaml"
|
|
},
|
|
"CVE-2022-45362": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.41762,
|
|
"epss_pct": 0.98584,
|
|
"name": "WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45362.yaml"
|
|
},
|
|
"CVE-2022-45365": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.48879,
|
|
"epss_pct": 0.9879,
|
|
"name": "Stock Ticker <= 3.23.2 - Cross-Site-Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45365.yaml"
|
|
},
|
|
"CVE-2022-45699": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.76604,
|
|
"epss_pct": 0.99505,
|
|
"name": "APsystems ECU-R Firmware - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45699.yaml"
|
|
},
|
|
"CVE-2022-45805": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02327,
|
|
"epss_pct": 0.82306,
|
|
"name": "WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45805.yaml"
|
|
},
|
|
"CVE-2022-45808": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04269,
|
|
"epss_pct": 0.90384,
|
|
"name": "LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45808.yaml"
|
|
},
|
|
"CVE-2022-45835": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.37673,
|
|
"epss_pct": 0.98429,
|
|
"name": "WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45835.yaml"
|
|
},
|
|
"CVE-2022-45836": {
|
|
"name": "WordPress Download Manager <= 3.2.59 - Reflected XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45836.yaml"
|
|
},
|
|
"CVE-2022-45917": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0199,
|
|
"epss_pct": 0.7922,
|
|
"name": "ILIAS eLearning <7.16 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45917.yaml"
|
|
},
|
|
"CVE-2022-45933": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.51696,
|
|
"epss_pct": 0.98863,
|
|
"name": "KubeView <=0.1.31 - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45933.yaml"
|
|
},
|
|
"CVE-2022-46020": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.38953,
|
|
"epss_pct": 0.98482,
|
|
"name": "WBCE CMS v1.5.4 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46020.yaml"
|
|
},
|
|
"CVE-2022-46071": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0431,
|
|
"epss_pct": 0.90458,
|
|
"name": "Helmet Store Showroom v1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46071.yaml"
|
|
},
|
|
"CVE-2022-46073": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01235,
|
|
"epss_pct": 0.66945,
|
|
"name": "Helmet Store Showroom - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46073.yaml"
|
|
},
|
|
"CVE-2022-46169": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99826,
|
|
"epss_pct": 0.99958,
|
|
"name": "Cacti <=1.2.22 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46169.yaml"
|
|
},
|
|
"CVE-2022-46381": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01739,
|
|
"epss_pct": 0.76098,
|
|
"name": "Linear eMerge E3-Series - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46381.yaml"
|
|
},
|
|
"CVE-2022-46443": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.37729,
|
|
"epss_pct": 0.98434,
|
|
"name": "Bangresto - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46443.yaml"
|
|
},
|
|
"CVE-2022-46888": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01543,
|
|
"epss_pct": 0.73183,
|
|
"name": "NexusPHP <1.7.33 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46888.yaml"
|
|
},
|
|
"CVE-2022-46934": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01084,
|
|
"epss_pct": 0.62855,
|
|
"name": "kkFileView 4.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-46934.yaml"
|
|
},
|
|
"CVE-2022-47002": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.06253,
|
|
"epss_pct": 0.93054,
|
|
"name": "Masa CMS - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47002.yaml"
|
|
},
|
|
"CVE-2022-47003": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.03614,
|
|
"epss_pct": 0.88672,
|
|
"name": "Mura CMS <10.0.580 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47003.yaml"
|
|
},
|
|
"CVE-2022-47075": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.59407,
|
|
"epss_pct": 0.99052,
|
|
"name": "Smart Office Web 20.28 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47075.yaml"
|
|
},
|
|
"CVE-2022-47501": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.1018,
|
|
"epss_pct": 0.95324,
|
|
"name": "Apache OFBiz < 18.12.07 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47501.yaml"
|
|
},
|
|
"CVE-2022-47615": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.05063,
|
|
"epss_pct": 0.91712,
|
|
"name": "LearnPress Plugin < 4.2.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47615.yaml"
|
|
},
|
|
"CVE-2022-47945": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.28254,
|
|
"epss_pct": 0.97977,
|
|
"name": "Thinkphp Lang - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47945.yaml"
|
|
},
|
|
"CVE-2022-47966": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99753,
|
|
"epss_pct": 0.99953,
|
|
"name": "ManageEngine - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47966.yaml"
|
|
},
|
|
"CVE-2022-47986": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99968,
|
|
"epss_pct": 0.99976,
|
|
"name": "IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47986.yaml"
|
|
},
|
|
"CVE-2022-48012": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0137,
|
|
"epss_pct": 0.69963,
|
|
"name": "OpenCATS 0.9.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48012.yaml"
|
|
},
|
|
"CVE-2022-48164": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.03096,
|
|
"epss_pct": 0.86807,
|
|
"name": "Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48164.yaml"
|
|
},
|
|
"CVE-2022-48165": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.03284,
|
|
"epss_pct": 0.87584,
|
|
"name": "Wavlink - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48165.yaml"
|
|
},
|
|
"CVE-2022-48166": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02823,
|
|
"epss_pct": 0.85588,
|
|
"name": "Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48166.yaml"
|
|
},
|
|
"CVE-2022-48197": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06608,
|
|
"epss_pct": 0.93366,
|
|
"name": "Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48197.yaml"
|
|
},
|
|
"CVE-2022-48323": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.56787,
|
|
"epss_pct": 0.98992,
|
|
"name": "Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-48323.yaml"
|
|
},
|
|
"CVE-2022-4897": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00858,
|
|
"epss_pct": 0.55924,
|
|
"name": "WordPress BackupBuddy <8.8.3 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4897.yaml"
|
|
},
|
|
"CVE-2022-4940": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01084,
|
|
"epss_pct": 0.62877,
|
|
"name": "WCFM Membership <= 2.10.0 - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4940.yaml"
|
|
},
|
|
"CVE-2022-4971": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.16223,
|
|
"epss_pct": 0.96711,
|
|
"name": "Sassy Social Share <= 3.3.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4971.yaml"
|
|
},
|
|
"CVE-2023-0037": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03911,
|
|
"epss_pct": 0.89549,
|
|
"name": "WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0037.yaml"
|
|
},
|
|
"CVE-2023-0099": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01726,
|
|
"epss_pct": 0.75919,
|
|
"name": "Simple URLs < 115 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0099.yaml"
|
|
},
|
|
"CVE-2023-0126": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.72699,
|
|
"epss_pct": 0.99404,
|
|
"name": "SonicWall SMA1000 LFI",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0126.yaml"
|
|
},
|
|
"CVE-2023-0159": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.55459,
|
|
"epss_pct": 0.98962,
|
|
"name": "Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0159.yaml"
|
|
},
|
|
"CVE-2023-0236": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01347,
|
|
"epss_pct": 0.69461,
|
|
"name": "WordPress Tutor LMS <2.0.10 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0236.yaml"
|
|
},
|
|
"CVE-2023-0261": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04356,
|
|
"epss_pct": 0.90544,
|
|
"name": "WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0261.yaml"
|
|
},
|
|
"CVE-2023-0297": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.95915,
|
|
"epss_pct": 0.99868,
|
|
"name": "PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0297.yaml"
|
|
},
|
|
"CVE-2023-0334": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00881,
|
|
"epss_pct": 0.56631,
|
|
"name": "ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0334.yaml"
|
|
},
|
|
"CVE-2023-0448": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.42928,
|
|
"epss_pct": 0.98621,
|
|
"name": "WP Helper Lite < 4.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0448.yaml"
|
|
},
|
|
"CVE-2023-0514": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0085,
|
|
"epss_pct": 0.55633,
|
|
"name": "Membership Database <= 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0514.yaml"
|
|
},
|
|
"CVE-2023-0527": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06118,
|
|
"epss_pct": 0.92925,
|
|
"name": "Online Security Guards Hiring System - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0527.yaml"
|
|
},
|
|
"CVE-2023-0552": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.24263,
|
|
"epss_pct": 0.97692,
|
|
"name": "WordPress Pie Register <3.8.2.3 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0552.yaml"
|
|
},
|
|
"CVE-2023-0562": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.44268,
|
|
"epss_pct": 0.98663,
|
|
"name": "Bank Locker Management System v1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0562.yaml"
|
|
},
|
|
"CVE-2023-0563": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.37608,
|
|
"epss_pct": 0.98428,
|
|
"name": "Bank Locker Management System - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0563.yaml"
|
|
},
|
|
"CVE-2023-0600": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04234,
|
|
"epss_pct": 0.90315,
|
|
"name": "WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0600.yaml"
|
|
},
|
|
"CVE-2023-0602": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00886,
|
|
"epss_pct": 0.56742,
|
|
"name": "Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0602.yaml"
|
|
},
|
|
"CVE-2023-0630": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05141,
|
|
"epss_pct": 0.9181,
|
|
"name": "Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0630.yaml"
|
|
},
|
|
"CVE-2023-0669": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99996,
|
|
"name": "Fortra GoAnywhere MFT - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0669.yaml"
|
|
},
|
|
"CVE-2023-0676": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01532,
|
|
"epss_pct": 0.72982,
|
|
"name": "phpIPAM 1.5.1 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0676.yaml"
|
|
},
|
|
"CVE-2023-0678": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.37304,
|
|
"epss_pct": 0.98416,
|
|
"name": "PHPIPAM <v1.5.1 - Missing Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0678.yaml"
|
|
},
|
|
"CVE-2023-0777": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.15207,
|
|
"epss_pct": 0.96502,
|
|
"name": "modoboa 2.0.4 - Admin TakeOver",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0777.yaml"
|
|
},
|
|
"CVE-2023-0876": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00713,
|
|
"epss_pct": 0.51114,
|
|
"name": "WordPress Meta SEO <= 4.5.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0876.yaml"
|
|
},
|
|
"CVE-2023-0900": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03229,
|
|
"epss_pct": 0.87363,
|
|
"name": "AP Pricing Tables Lite <= 1.1.6 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0900.yaml"
|
|
},
|
|
"CVE-2023-0942": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01213,
|
|
"epss_pct": 0.66382,
|
|
"name": "WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0942.yaml"
|
|
},
|
|
"CVE-2023-0947": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03637,
|
|
"epss_pct": 0.88743,
|
|
"name": "Flatpress < 1.3 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0947.yaml"
|
|
},
|
|
"CVE-2023-0948": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0085,
|
|
"epss_pct": 0.55633,
|
|
"name": "WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0948.yaml"
|
|
},
|
|
"CVE-2023-0968": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01252,
|
|
"epss_pct": 0.67339,
|
|
"name": "WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0968.yaml"
|
|
},
|
|
"CVE-2023-1020": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0499,
|
|
"epss_pct": 0.9161,
|
|
"name": "Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1020.yaml"
|
|
},
|
|
"CVE-2023-1080": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0126,
|
|
"epss_pct": 0.67537,
|
|
"name": "WordPress GN Publisher <1.5.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1080.yaml"
|
|
},
|
|
"CVE-2023-1119": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01244,
|
|
"epss_pct": 0.67148,
|
|
"name": "WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1119.yaml"
|
|
},
|
|
"CVE-2023-1177": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.6968,
|
|
"epss_pct": 0.99316,
|
|
"name": "Mlflow <2.2.1 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1177.yaml"
|
|
},
|
|
"CVE-2023-1263": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01414,
|
|
"epss_pct": 0.70848,
|
|
"name": "Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1263.yaml"
|
|
},
|
|
"CVE-2023-1315": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01059,
|
|
"epss_pct": 0.62136,
|
|
"name": "osTicket < v1.16.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1315.yaml"
|
|
},
|
|
"CVE-2023-1317": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01015,
|
|
"epss_pct": 0.60835,
|
|
"name": "osTicket < v1.16.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1317.yaml"
|
|
},
|
|
"CVE-2023-1318": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01015,
|
|
"epss_pct": 0.60835,
|
|
"name": "osTicket < v1.16.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1318.yaml"
|
|
},
|
|
"CVE-2023-1362": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-1021",
|
|
"epss": 0.01411,
|
|
"epss_pct": 0.70787,
|
|
"name": "unilogies/bumsys < v2.0.2 - Clickjacking",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1362.yaml"
|
|
},
|
|
"CVE-2023-1389": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99992,
|
|
"name": "TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1389.yaml"
|
|
},
|
|
"CVE-2023-1408": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03229,
|
|
"epss_pct": 0.87363,
|
|
"name": "Video List Manager <= 1.7 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1408.yaml"
|
|
},
|
|
"CVE-2023-1454": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.35825,
|
|
"epss_pct": 0.98351,
|
|
"name": "Jeecg-boot 3.5.0 qurestSql - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1454.yaml"
|
|
},
|
|
"CVE-2023-1496": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01585,
|
|
"epss_pct": 0.73835,
|
|
"name": "Imgproxy < 3.14.0 - Cross-site Scripting (XSS)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1496.yaml"
|
|
},
|
|
"CVE-2023-1546": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0085,
|
|
"epss_pct": 0.55634,
|
|
"name": "MyCryptoCheckout < 2.124 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1546.yaml"
|
|
},
|
|
"CVE-2023-1671": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99991,
|
|
"name": "Sophos Web Appliance - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1671.yaml"
|
|
},
|
|
"CVE-2023-1698": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.82037,
|
|
"epss_pct": 0.99627,
|
|
"name": "WAGO - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1698.yaml"
|
|
},
|
|
"CVE-2023-1719": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-665",
|
|
"epss": 0.04973,
|
|
"epss_pct": 0.91584,
|
|
"name": "Bitrix Component - Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1719.yaml"
|
|
},
|
|
"CVE-2023-1730": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.40586,
|
|
"epss_pct": 0.98548,
|
|
"name": "SupportCandy < 3.1.5 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1730.yaml"
|
|
},
|
|
"CVE-2023-1780": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00998,
|
|
"epss_pct": 0.60307,
|
|
"name": "Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1780.yaml"
|
|
},
|
|
"CVE-2023-1835": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00925,
|
|
"epss_pct": 0.57951,
|
|
"name": "Ninja Forms < 3.6.22 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1835.yaml"
|
|
},
|
|
"CVE-2023-1880": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01644,
|
|
"epss_pct": 0.74735,
|
|
"name": "Phpmyfaq v3.1.11 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1880.yaml"
|
|
},
|
|
"CVE-2023-1890": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01067,
|
|
"epss_pct": 0.62402,
|
|
"name": "Tablesome < 1.0.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1890.yaml"
|
|
},
|
|
"CVE-2023-1892": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02742,
|
|
"epss_pct": 0.8512,
|
|
"name": "Sidekiq < 7.0.8 - Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1892.yaml"
|
|
},
|
|
"CVE-2023-1893": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00718,
|
|
"epss_pct": 0.51322,
|
|
"name": "Login Configurator <=2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1893.yaml"
|
|
},
|
|
"CVE-2023-20073": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.90106,
|
|
"epss_pct": 0.99786,
|
|
"name": "Cisco VPN Routers - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20073.yaml"
|
|
},
|
|
"CVE-2023-2009": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00824,
|
|
"epss_pct": 0.54828,
|
|
"name": "Pretty Url <= 1.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2009.yaml"
|
|
},
|
|
"CVE-2023-20198": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99571,
|
|
"epss_pct": 0.99945,
|
|
"name": "Cisco IOS XE Web UI - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20198.yaml"
|
|
},
|
|
"CVE-2023-2023": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0171,
|
|
"epss_pct": 0.75719,
|
|
"name": "Custom 404 Pro < 3.7.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2023.yaml"
|
|
},
|
|
"CVE-2023-2059": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-28",
|
|
"epss": 0.02406,
|
|
"epss_pct": 0.82898,
|
|
"name": "DedeCMS 5.7.87 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2059.yaml"
|
|
},
|
|
"CVE-2023-20864": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.70423,
|
|
"epss_pct": 0.99339,
|
|
"name": "VMware Aria Operations for Logs - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20864.yaml"
|
|
},
|
|
"CVE-2023-20887": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.98281,
|
|
"epss_pct": 0.99913,
|
|
"name": "VMware VRealize Network Insight - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20887.yaml"
|
|
},
|
|
"CVE-2023-20888": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.82282,
|
|
"epss_pct": 0.99635,
|
|
"name": "VMware Aria Operations for Networks - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20888.yaml"
|
|
},
|
|
"CVE-2023-20889": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.79258,
|
|
"epss_pct": 0.9957,
|
|
"name": "VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20889.yaml"
|
|
},
|
|
"CVE-2023-2122": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0085,
|
|
"epss_pct": 0.55632,
|
|
"name": "Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2122.yaml"
|
|
},
|
|
"CVE-2023-2130": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04122,
|
|
"epss_pct": 0.90071,
|
|
"name": "Purchase Order Management v1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2130.yaml"
|
|
},
|
|
"CVE-2023-2178": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00773,
|
|
"epss_pct": 0.53191,
|
|
"name": "Aajoda Testimonials < 2.2.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2178.yaml"
|
|
},
|
|
"CVE-2023-21839": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.999,
|
|
"epss_pct": 0.99964,
|
|
"name": "Oracle WebLogic Server - Unauthorized Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-21839.yaml"
|
|
},
|
|
"CVE-2023-22047": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.7698,
|
|
"epss_pct": 0.99513,
|
|
"name": "Oracle Peoplesoft - Unauthenticated File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22047.yaml"
|
|
},
|
|
"CVE-2023-22232": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"epss": 0.81875,
|
|
"epss_pct": 0.99622,
|
|
"name": "Adobe Connect < 12.1.5 - Local File Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22232.yaml"
|
|
},
|
|
"CVE-2023-2224": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00909,
|
|
"epss_pct": 0.57473,
|
|
"name": "Seo By 10Web < 1.2.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2224.yaml"
|
|
},
|
|
"CVE-2023-2227": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.44029,
|
|
"epss_pct": 0.98656,
|
|
"name": "Modoboa < 2.1.0 - Improper Authorization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2227.yaml"
|
|
},
|
|
"CVE-2023-22432": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02402,
|
|
"epss_pct": 0.82867,
|
|
"name": "Web2py URL - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22432.yaml"
|
|
},
|
|
"CVE-2023-22463": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.69667,
|
|
"epss_pct": 0.99315,
|
|
"name": "KubePi JwtSigKey - Admin Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22463.yaml"
|
|
},
|
|
"CVE-2023-22478": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.03573,
|
|
"epss_pct": 0.88548,
|
|
"name": "KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22478.yaml"
|
|
},
|
|
"CVE-2023-22480": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.66768,
|
|
"epss_pct": 0.99232,
|
|
"name": "KubeOperator Foreground `kubeconfig` - File Download",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22480.yaml"
|
|
},
|
|
"CVE-2023-22515": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99156,
|
|
"epss_pct": 0.99931,
|
|
"name": "Atlassian Confluence - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml"
|
|
},
|
|
"CVE-2023-22518": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99996,
|
|
"name": "Atlassian Confluence Server - Improper Authorization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22518.yaml"
|
|
},
|
|
"CVE-2023-2252": {
|
|
"cvss": 2.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01342,
|
|
"epss_pct": 0.69362,
|
|
"name": "Directorist < 7.5.4 - Local File Inclusion",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2252.yaml"
|
|
},
|
|
"CVE-2023-22527": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.99984,
|
|
"epss_pct": 0.99982,
|
|
"name": "Atlassian Confluence - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22527.yaml"
|
|
},
|
|
"CVE-2023-2256": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00952,
|
|
"epss_pct": 0.58851,
|
|
"name": "WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2256.yaml"
|
|
},
|
|
"CVE-2023-22620": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.0392,
|
|
"epss_pct": 0.89588,
|
|
"name": "SecurePoint UTM 12.x Session ID Leak",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22620.yaml"
|
|
},
|
|
"CVE-2023-22621": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.76825,
|
|
"epss_pct": 0.9951,
|
|
"name": "Strapi Versions <=4.5.5 - SSTI to Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22621.yaml"
|
|
},
|
|
"CVE-2023-22629": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.12322,
|
|
"epss_pct": 0.95903,
|
|
"name": "TitanFTP move-file Function \u2264 1.94.1205 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-22629.yaml"
|
|
},
|
|
"CVE-2023-2272": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0085,
|
|
"epss_pct": 0.55634,
|
|
"name": "Tiempo.com <= 0.1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2272.yaml"
|
|
},
|
|
"CVE-2023-22893": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.04158,
|
|
"epss_pct": 0.90151,
|
|
"name": "Strapi Versions <=4.5.6 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22893.yaml"
|
|
},
|
|
"CVE-2023-22897": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-908",
|
|
"epss": 0.04074,
|
|
"epss_pct": 0.89963,
|
|
"name": "Securepoint UTM - Leaking Remote Memory Contents",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22897.yaml"
|
|
},
|
|
"CVE-2023-22952": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.80274,
|
|
"epss_pct": 0.99589,
|
|
"name": "SugarCRM Unauthenticated - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22952.yaml"
|
|
},
|
|
"CVE-2023-23063": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02431,
|
|
"epss_pct": 0.8309,
|
|
"name": "Cellinx NVT Web Server - Local File Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23063.yaml"
|
|
},
|
|
"CVE-2023-2309": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.00845,
|
|
"epss_pct": 0.55459,
|
|
"name": "wpForo Forum <= 2.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2309.yaml"
|
|
},
|
|
"CVE-2023-23161": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0591,
|
|
"epss_pct": 0.92707,
|
|
"name": "Art Gallery Management System Project v1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23161.yaml"
|
|
},
|
|
"CVE-2023-23333": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99291,
|
|
"epss_pct": 0.99935,
|
|
"name": "SolarView Compact 6.00 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23333.yaml"
|
|
},
|
|
"CVE-2023-23488": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.9246,
|
|
"epss_pct": 0.99817,
|
|
"name": "WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23488.yaml"
|
|
},
|
|
"CVE-2023-23489": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11172,
|
|
"epss_pct": 0.95631,
|
|
"name": "WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23489.yaml"
|
|
},
|
|
"CVE-2023-23491": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01179,
|
|
"epss_pct": 0.6546,
|
|
"name": "Quick Event Manager < 9.7.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23491.yaml"
|
|
},
|
|
"CVE-2023-23492": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.57123,
|
|
"epss_pct": 0.99,
|
|
"name": "Login with Phone Number - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23492.yaml"
|
|
},
|
|
"CVE-2023-2356": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.04153,
|
|
"epss_pct": 0.90142,
|
|
"name": "Mlflow <2.3.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2356.yaml"
|
|
},
|
|
"CVE-2023-23752": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.99827,
|
|
"epss_pct": 0.99959,
|
|
"name": "Joomla! Webservice - Password Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23752.yaml"
|
|
},
|
|
"CVE-2023-23897": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-352",
|
|
"epss": 0.0161,
|
|
"epss_pct": 0.74206,
|
|
"name": "Ozette Plugins - Cross-Site Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23897.yaml"
|
|
},
|
|
"CVE-2023-24000": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0257,
|
|
"epss_pct": 0.8405,
|
|
"name": "WordPress GamiPress <= 2.5.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24000.yaml"
|
|
},
|
|
"CVE-2023-24243": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03995,
|
|
"epss_pct": 0.89785,
|
|
"name": "CData RSB Connect v22.0.8336 - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24243.yaml"
|
|
},
|
|
"CVE-2023-24278": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02908,
|
|
"epss_pct": 0.8601,
|
|
"name": "Squidex <7.4.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24278.yaml"
|
|
},
|
|
"CVE-2023-24322": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.31714,
|
|
"epss_pct": 0.98166,
|
|
"name": "mojoPortal 2.7.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24322.yaml"
|
|
},
|
|
"CVE-2023-2437": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.06801,
|
|
"epss_pct": 0.93525,
|
|
"name": "UserPro <= 5.1.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2437.yaml"
|
|
},
|
|
"CVE-2023-24488": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.80907,
|
|
"epss_pct": 0.99599,
|
|
"name": "Citrix Gateway and Citrix ADC - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24488.yaml"
|
|
},
|
|
"CVE-2023-24489": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.9729,
|
|
"epss_pct": 0.99891,
|
|
"name": "Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24489.yaml"
|
|
},
|
|
"CVE-2023-24657": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03904,
|
|
"epss_pct": 0.89529,
|
|
"name": "phpIPAM - 1.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24657.yaml"
|
|
},
|
|
"CVE-2023-24733": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01169,
|
|
"epss_pct": 0.65174,
|
|
"name": "PMB 7.4.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24733.yaml"
|
|
},
|
|
"CVE-2023-24735": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0108,
|
|
"epss_pct": 0.62724,
|
|
"name": "PMB 7.4.6 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24735.yaml"
|
|
},
|
|
"CVE-2023-24737": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01169,
|
|
"epss_pct": 0.65174,
|
|
"name": "PMB v7.4.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24737.yaml"
|
|
},
|
|
"CVE-2023-2479": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.22014,
|
|
"epss_pct": 0.97487,
|
|
"name": "Appium Desktop Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2479.yaml"
|
|
},
|
|
"CVE-2023-25135": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.23926,
|
|
"epss_pct": 0.97668,
|
|
"name": "vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25135.yaml"
|
|
},
|
|
"CVE-2023-25157": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.85247,
|
|
"epss_pct": 0.99699,
|
|
"name": "GeoServer OGC Filter - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25157.yaml"
|
|
},
|
|
"CVE-2023-2518": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01092,
|
|
"epss_pct": 0.63065,
|
|
"name": "WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2518.yaml"
|
|
},
|
|
"CVE-2023-25194": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.9581,
|
|
"epss_pct": 0.99868,
|
|
"name": "Apache Druid Kafka Connect - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25194.yaml"
|
|
},
|
|
"CVE-2023-25280": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.97864,
|
|
"epss_pct": 0.99903,
|
|
"name": "D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25280.yaml"
|
|
},
|
|
"CVE-2023-25346": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01524,
|
|
"epss_pct": 0.72856,
|
|
"name": "ChurchCRM 4.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25346.yaml"
|
|
},
|
|
"CVE-2023-25573": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.51609,
|
|
"epss_pct": 0.98862,
|
|
"name": "Metersphere - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25573.yaml"
|
|
},
|
|
"CVE-2023-25717": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.98069,
|
|
"epss_pct": 0.99907,
|
|
"name": "Ruckus Wireless Admin - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25717.yaml"
|
|
},
|
|
"CVE-2023-25826": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.42765,
|
|
"epss_pct": 0.98616,
|
|
"name": "OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25826.yaml"
|
|
},
|
|
"CVE-2023-26035": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.80462,
|
|
"epss_pct": 0.99592,
|
|
"name": "ZoneMinder Snapshots - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26035.yaml"
|
|
},
|
|
"CVE-2023-26067": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.37835,
|
|
"epss_pct": 0.98438,
|
|
"name": "Lexmark Printers - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26067.yaml"
|
|
},
|
|
"CVE-2023-2624": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.01156,
|
|
"epss_pct": 0.64811,
|
|
"name": "KiviCare WordPress Plugin - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2624.yaml"
|
|
},
|
|
"CVE-2023-26255": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.47199,
|
|
"epss_pct": 0.9875,
|
|
"name": "STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26255.yaml"
|
|
},
|
|
"CVE-2023-26256": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11615,
|
|
"epss_pct": 0.95733,
|
|
"name": "STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26256.yaml"
|
|
},
|
|
"CVE-2023-26258": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.37715,
|
|
"epss_pct": 0.98431,
|
|
"name": "Arcserve UDP <= 9.0.6034 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26258.yaml"
|
|
},
|
|
"CVE-2023-26347": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.10072,
|
|
"epss_pct": 0.95289,
|
|
"name": "Adobe Coldfusion - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26347.yaml"
|
|
},
|
|
"CVE-2023-26360": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.97339,
|
|
"epss_pct": 0.99892,
|
|
"name": "Adobe ColdFusion - Local File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml"
|
|
},
|
|
"CVE-2023-2640": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.16052,
|
|
"epss_pct": 0.96681,
|
|
"name": "GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-2640.yaml"
|
|
},
|
|
"CVE-2023-26469": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.82949,
|
|
"epss_pct": 0.99649,
|
|
"name": "Jorani 1.0.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26469.yaml"
|
|
},
|
|
"CVE-2023-2648": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.28478,
|
|
"epss_pct": 0.97989,
|
|
"name": "Weaver E-Office 9.5 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2648.yaml"
|
|
},
|
|
"CVE-2023-26802": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.4871,
|
|
"epss_pct": 0.98785,
|
|
"name": "DCBI-Netlog-LAB v1.0 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26802.yaml"
|
|
},
|
|
"CVE-2023-26842": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01397,
|
|
"epss_pct": 0.70515,
|
|
"name": "ChurchCRM 4.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26842.yaml"
|
|
},
|
|
"CVE-2023-26843": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0142,
|
|
"epss_pct": 0.70963,
|
|
"name": "ChurchCRM 4.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26843.yaml"
|
|
},
|
|
"CVE-2023-27008": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01499,
|
|
"epss_pct": 0.7244,
|
|
"name": "ATutor < 2.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27008.yaml"
|
|
},
|
|
"CVE-2023-27032": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03015,
|
|
"epss_pct": 0.86478,
|
|
"name": "PrestaShop AdvancedPopupCreator - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27032.yaml"
|
|
},
|
|
"CVE-2023-27034": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.58743,
|
|
"epss_pct": 0.99037,
|
|
"name": "Jms Blog - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27034.yaml"
|
|
},
|
|
"CVE-2023-27159": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.36171,
|
|
"epss_pct": 0.98362,
|
|
"name": "Appwrite <=1.2.1 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27159.yaml"
|
|
},
|
|
"CVE-2023-27163": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.06591,
|
|
"epss_pct": 0.93352,
|
|
"name": "Request-Baskets <= 1.2.1 - Server Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27163.yaml"
|
|
},
|
|
"CVE-2023-27179": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.60793,
|
|
"epss_pct": 0.99086,
|
|
"name": "GDidees CMS v3.9.1 - Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27179.yaml"
|
|
},
|
|
"CVE-2023-27292": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01027,
|
|
"epss_pct": 0.61205,
|
|
"name": "OpenCATS - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27292.yaml"
|
|
},
|
|
"CVE-2023-2732": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.67511,
|
|
"epss_pct": 0.99255,
|
|
"name": "MStore API <= 3.9.2 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2732.yaml"
|
|
},
|
|
"CVE-2023-2734": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03805,
|
|
"epss_pct": 0.89262,
|
|
"name": "MStore API <= 3.9.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2734.yaml"
|
|
},
|
|
"CVE-2023-27350": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99995,
|
|
"name": "PaperCut - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27350.yaml"
|
|
},
|
|
"CVE-2023-27351": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.78052,
|
|
"epss_pct": 0.9954,
|
|
"name": "PaperCut NG - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27351.yaml"
|
|
},
|
|
"CVE-2023-27372": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99682,
|
|
"epss_pct": 0.99949,
|
|
"name": "SPIP - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27372.yaml"
|
|
},
|
|
"CVE-2023-2745": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.79527,
|
|
"epss_pct": 0.99574,
|
|
"name": "WordPress Core <=6.2 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2745.yaml"
|
|
},
|
|
"CVE-2023-27482": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.71974,
|
|
"epss_pct": 0.99382,
|
|
"name": "Home Assistant Supervisor - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27482.yaml"
|
|
},
|
|
"CVE-2023-27524": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.97405,
|
|
"epss_pct": 0.99893,
|
|
"name": "Apache Superset - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27524.yaml"
|
|
},
|
|
"CVE-2023-27584": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-321",
|
|
"epss": 0.33638,
|
|
"epss_pct": 0.98263,
|
|
"name": "Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27584.yaml"
|
|
},
|
|
"CVE-2023-27587": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.03857,
|
|
"epss_pct": 0.8941,
|
|
"name": "ReadToMyShoe - Generation of Error Message Containing Sensitive Information",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27587.yaml"
|
|
},
|
|
"CVE-2023-27624": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00619,
|
|
"epss_pct": 0.47209,
|
|
"name": "WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27624.yaml"
|
|
},
|
|
"CVE-2023-27637": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03299,
|
|
"epss_pct": 0.87646,
|
|
"name": "PrestaShop `tshirtecommerce` Module - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27637.yaml"
|
|
},
|
|
"CVE-2023-27638": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03299,
|
|
"epss_pct": 0.87646,
|
|
"name": "tshirtecommerce PrestaShop Module - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27638.yaml"
|
|
},
|
|
"CVE-2023-27639": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03551,
|
|
"epss_pct": 0.88483,
|
|
"name": "PrestaShop TshirteCommerce - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27639.yaml"
|
|
},
|
|
"CVE-2023-27640": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03573,
|
|
"epss_pct": 0.88548,
|
|
"name": "PrestaShop tshirtecommerce - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27640.yaml"
|
|
},
|
|
"CVE-2023-27641": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01092,
|
|
"epss_pct": 0.63064,
|
|
"name": "L-Soft LISTSERV 16.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27641.yaml"
|
|
},
|
|
"CVE-2023-2766": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.54232,
|
|
"epss_pct": 0.98933,
|
|
"name": "Weaver OA 9.5 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2766.yaml"
|
|
},
|
|
"CVE-2023-2779": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05991,
|
|
"epss_pct": 0.92796,
|
|
"name": "Super Socializer < 7.13.52 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2779.yaml"
|
|
},
|
|
"CVE-2023-2780": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.06363,
|
|
"epss_pct": 0.93153,
|
|
"name": "Mlflow <2.3.1 - Local File Inclusion Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2780.yaml"
|
|
},
|
|
"CVE-2023-27847": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04715,
|
|
"epss_pct": 0.91183,
|
|
"name": "PrestaShop xipblog - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27847.yaml"
|
|
},
|
|
"CVE-2023-27922": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01198,
|
|
"epss_pct": 0.65928,
|
|
"name": "Newsletter < 7.6.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27922.yaml"
|
|
},
|
|
"CVE-2023-2796": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.42674,
|
|
"epss_pct": 0.98614,
|
|
"name": "EventON <= 2.1 - Missing Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2796.yaml"
|
|
},
|
|
"CVE-2023-28121": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.8651,
|
|
"epss_pct": 0.99722,
|
|
"name": "WooCommerce Payments - Unauthorized Admin Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28121.yaml"
|
|
},
|
|
"CVE-2023-2813": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01011,
|
|
"epss_pct": 0.60728,
|
|
"name": "Wordpress Multiple Themes - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2813.yaml"
|
|
},
|
|
"CVE-2023-2822": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03301,
|
|
"epss_pct": 0.87656,
|
|
"name": "Ellucian Ethos Identity CAS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2822.yaml"
|
|
},
|
|
"CVE-2023-2825": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.71641,
|
|
"epss_pct": 0.99373,
|
|
"name": "GitLab 16.0.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2825.yaml"
|
|
},
|
|
"CVE-2023-28343": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.84752,
|
|
"epss_pct": 0.99691,
|
|
"name": "Altenergy Power Control Software C1.2.5 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28343.yaml"
|
|
},
|
|
"CVE-2023-28432": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.83957,
|
|
"epss_pct": 0.99673,
|
|
"name": "MinIO Cluster Deployment - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28432.yaml"
|
|
},
|
|
"CVE-2023-28662": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.42186,
|
|
"epss_pct": 0.98595,
|
|
"name": "Wordpress Gift Cards <= 4.3.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28662.yaml"
|
|
},
|
|
"CVE-2023-28665": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00887,
|
|
"epss_pct": 0.56775,
|
|
"name": "Woo Bulk Price Update <2.2.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28665.yaml"
|
|
},
|
|
"CVE-2023-28787": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0196,
|
|
"epss_pct": 0.78901,
|
|
"name": "Quiz and Survey Master <= 8.1.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28787.yaml"
|
|
},
|
|
"CVE-2023-29084": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.98167,
|
|
"epss_pct": 0.99909,
|
|
"name": "ManageEngine ADManager Plus - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29084.yaml"
|
|
},
|
|
"CVE-2023-29204": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01756,
|
|
"epss_pct": 0.76349,
|
|
"name": "XWiki - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29204.yaml"
|
|
},
|
|
"CVE-2023-29298": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.99757,
|
|
"epss_pct": 0.99954,
|
|
"name": "Adobe ColdFusion - Access Control Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29298.yaml"
|
|
},
|
|
"CVE-2023-29300": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99989,
|
|
"epss_pct": 0.99984,
|
|
"name": "Adobe ColdFusion - Pre-Auth Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml"
|
|
},
|
|
"CVE-2023-29357": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99984,
|
|
"epss_pct": 0.99982,
|
|
"name": "Microsoft SharePoint - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29357.yaml"
|
|
},
|
|
"CVE-2023-29439": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01747,
|
|
"epss_pct": 0.76208,
|
|
"name": "FooGallery plugin <= 2.2.35 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29439.yaml"
|
|
},
|
|
"CVE-2023-2948": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.96731,
|
|
"epss_pct": 0.99882,
|
|
"name": "OpenEMR < 7.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2948.yaml"
|
|
},
|
|
"CVE-2023-29489": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.65533,
|
|
"epss_pct": 0.99205,
|
|
"name": "cPanel < 11.109.9999.116 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29489.yaml"
|
|
},
|
|
"CVE-2023-2949": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01472,
|
|
"epss_pct": 0.71949,
|
|
"name": "OpenEMR < 7.0.1 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2949.yaml"
|
|
},
|
|
"CVE-2023-29506": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01721,
|
|
"epss_pct": 0.75862,
|
|
"name": "XWiki >= 13.10.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29506.yaml"
|
|
},
|
|
"CVE-2023-29623": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0125,
|
|
"epss_pct": 0.67294,
|
|
"name": "Purchase Order Management v1.0 - Cross Site Scripting (Reflected)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29623.yaml"
|
|
},
|
|
"CVE-2023-2982": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.46242,
|
|
"epss_pct": 0.98724,
|
|
"name": "Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2982.yaml"
|
|
},
|
|
"CVE-2023-29827": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.05552,
|
|
"epss_pct": 0.92287,
|
|
"name": "Embedded JavaScript(EJS) 3.1.6 - Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29827.yaml"
|
|
},
|
|
"CVE-2023-2986": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.42814,
|
|
"epss_pct": 0.98618,
|
|
"name": "Abandoned Cart Lite for WooCommerce - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-2986.yaml"
|
|
},
|
|
"CVE-2023-29887": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04736,
|
|
"epss_pct": 0.91219,
|
|
"name": "Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29887.yaml"
|
|
},
|
|
"CVE-2023-29919": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-276",
|
|
"epss": 0.60221,
|
|
"epss_pct": 0.9907,
|
|
"name": "SolarView Compact <= 6.00 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29919.yaml"
|
|
},
|
|
"CVE-2023-29922": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.02998,
|
|
"epss_pct": 0.86403,
|
|
"name": "PowerJob V4.3.1 - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29922.yaml"
|
|
},
|
|
"CVE-2023-29923": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-276",
|
|
"epss": 0.09545,
|
|
"epss_pct": 0.95103,
|
|
"name": "PowerJob <=4.3.2 - Unauthenticated Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29923.yaml"
|
|
},
|
|
"CVE-2023-30013": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.25889,
|
|
"epss_pct": 0.97828,
|
|
"name": "TOTOLink - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30013.yaml"
|
|
},
|
|
"CVE-2023-30019": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02214,
|
|
"epss_pct": 0.81385,
|
|
"name": "Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30019.yaml"
|
|
},
|
|
"CVE-2023-30150": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03849,
|
|
"epss_pct": 0.89385,
|
|
"name": "PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30150.yaml"
|
|
},
|
|
"CVE-2023-30192": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02678,
|
|
"epss_pct": 0.84744,
|
|
"name": "PrestaShop 'possearchproducts' <= 1.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30192.yaml"
|
|
},
|
|
"CVE-2023-30194": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.32413,
|
|
"epss_pct": 0.98205,
|
|
"name": "Prestashop posstaticfooter <= 1.0.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30194.yaml"
|
|
},
|
|
"CVE-2023-30210": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01173,
|
|
"epss_pct": 0.65295,
|
|
"name": "OURPHP <= 7.2.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30210.yaml"
|
|
},
|
|
"CVE-2023-30212": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08115,
|
|
"epss_pct": 0.94418,
|
|
"name": "OURPHP <= 7.2.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30212.yaml"
|
|
},
|
|
"CVE-2023-30256": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08731,
|
|
"epss_pct": 0.94762,
|
|
"name": "Webkul QloApps 1.5.2 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30256.yaml"
|
|
},
|
|
"CVE-2023-30258": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.9425,
|
|
"epss_pct": 0.99842,
|
|
"name": "MagnusBilling - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30258.yaml"
|
|
},
|
|
"CVE-2023-30534": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.02569,
|
|
"epss_pct": 0.84037,
|
|
"name": "Cacti < 1.2.25 Insecure Deserialization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30534.yaml"
|
|
},
|
|
"CVE-2023-30625": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.85825,
|
|
"epss_pct": 0.99713,
|
|
"name": "Rudder Server < 1.3.0-rc.1 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30625.yaml"
|
|
},
|
|
"CVE-2023-3077": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.05505,
|
|
"epss_pct": 0.92231,
|
|
"name": "MStore API < 3.9.8 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3077.yaml"
|
|
},
|
|
"CVE-2023-30777": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.38768,
|
|
"epss_pct": 0.98476,
|
|
"name": "Advanced Custom Fields < 6.1.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30777.yaml"
|
|
},
|
|
"CVE-2023-30868": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03995,
|
|
"epss_pct": 0.89788,
|
|
"name": "Tree Page View Plugin < 1.6.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30868.yaml"
|
|
},
|
|
"CVE-2023-30869": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.031,
|
|
"epss_pct": 0.86823,
|
|
"name": "Easy Digital Downloads - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30869.yaml"
|
|
},
|
|
"CVE-2023-30943": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"epss": 0.06583,
|
|
"epss_pct": 0.93347,
|
|
"name": "Moodle - Cross-Site Scripting/Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30943.yaml"
|
|
},
|
|
"CVE-2023-31059": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05574,
|
|
"epss_pct": 0.92318,
|
|
"name": "Repetier Server - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31059.yaml"
|
|
},
|
|
"CVE-2023-3139": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00734,
|
|
"epss_pct": 0.51895,
|
|
"name": "Protect WP Admin < 4.0 - Unauthenticated Protection Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3139.yaml"
|
|
},
|
|
"CVE-2023-31446": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.61081,
|
|
"epss_pct": 0.99094,
|
|
"name": "Cassia Gateway Firmware - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31446.yaml"
|
|
},
|
|
"CVE-2023-31465": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.46304,
|
|
"epss_pct": 0.98726,
|
|
"name": "TimeKeeper by FSMLabs - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31465.yaml"
|
|
},
|
|
"CVE-2023-31478": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.29699,
|
|
"epss_pct": 0.98061,
|
|
"name": "GL.iNET SSID Key Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31478.yaml"
|
|
},
|
|
"CVE-2023-31548": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01248,
|
|
"epss_pct": 0.67267,
|
|
"name": "ChurchCRM v4.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-31548.yaml"
|
|
},
|
|
"CVE-2023-3169": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01279,
|
|
"epss_pct": 0.67965,
|
|
"name": "tagDiv Composer < 4.2 - Stored Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3169.yaml"
|
|
},
|
|
"CVE-2023-3188": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01356,
|
|
"epss_pct": 0.69684,
|
|
"name": "Owncast - Server Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3188.yaml"
|
|
},
|
|
"CVE-2023-3197": {
|
|
"name": "WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3197.yaml"
|
|
},
|
|
"CVE-2023-32068": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.5507,
|
|
"epss_pct": 0.98953,
|
|
"name": "XWiki - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32068.yaml"
|
|
},
|
|
"CVE-2023-32077": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.03534,
|
|
"epss_pct": 0.88431,
|
|
"name": "Netmaker - Hardcoded DNS Secret Key",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32077.yaml"
|
|
},
|
|
"CVE-2023-32117": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"epss": 0.07133,
|
|
"epss_pct": 0.93798,
|
|
"name": "Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32117.yaml"
|
|
},
|
|
"CVE-2023-3219": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.07521,
|
|
"epss_pct": 0.94054,
|
|
"name": "EventON Lite < 2.1.2 - Arbitrary File Download",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3219.yaml"
|
|
},
|
|
"CVE-2023-32235": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.39078,
|
|
"epss_pct": 0.98485,
|
|
"name": "Ghost CMS < 5.42.1 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32235.yaml"
|
|
},
|
|
"CVE-2023-32243": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.75531,
|
|
"epss_pct": 0.99479,
|
|
"name": "WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32243.yaml"
|
|
},
|
|
"CVE-2023-32315": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99992,
|
|
"name": "Openfire Administration Console - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32315.yaml"
|
|
},
|
|
"CVE-2023-32563": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.89099,
|
|
"epss_pct": 0.99768,
|
|
"name": "Ivanti Avalanche - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32563.yaml"
|
|
},
|
|
"CVE-2023-32590": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01808,
|
|
"epss_pct": 0.77041,
|
|
"name": "Subscribe to Category <= 2.7.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32590.yaml"
|
|
},
|
|
"CVE-2023-3277": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.02888,
|
|
"epss_pct": 0.85906,
|
|
"name": "MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3277.yaml"
|
|
},
|
|
"CVE-2023-33193": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-444",
|
|
"epss": 0.01699,
|
|
"epss_pct": 0.75556,
|
|
"name": "Emby Server - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33193.yaml"
|
|
},
|
|
"CVE-2023-33246": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.96604,
|
|
"epss_pct": 0.99879,
|
|
"name": "RocketMQ <= 5.1.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-33246.yaml"
|
|
},
|
|
"CVE-2023-33338": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03632,
|
|
"epss_pct": 0.88724,
|
|
"name": "Old Age Home Management System v1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33338.yaml"
|
|
},
|
|
"CVE-2023-33405": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.31265,
|
|
"epss_pct": 0.98144,
|
|
"name": "BlogEngine CMS - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33405.yaml"
|
|
},
|
|
"CVE-2023-33439": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03307,
|
|
"epss_pct": 0.87676,
|
|
"name": "Faculty Evaluation System v1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33439.yaml"
|
|
},
|
|
"CVE-2023-33440": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.14507,
|
|
"epss_pct": 0.96379,
|
|
"name": "Faculty Evaluation System v1.0 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33440.yaml"
|
|
},
|
|
"CVE-2023-3345": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.0197,
|
|
"epss_pct": 0.78991,
|
|
"name": "LMS by Masteriyo < 1.6.8 - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3345.yaml"
|
|
},
|
|
"CVE-2023-33510": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.04042,
|
|
"epss_pct": 0.89895,
|
|
"name": "Jeecg P3 Biz Chat - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33510.yaml"
|
|
},
|
|
"CVE-2023-33568": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.1494,
|
|
"epss_pct": 0.96457,
|
|
"name": "Dolibarr Unauthenticated Contacts Database Theft",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33568.yaml"
|
|
},
|
|
"CVE-2023-33629": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-787",
|
|
"epss": 0.04353,
|
|
"epss_pct": 0.9054,
|
|
"name": "H3C Magic R300-2100M - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33629.yaml"
|
|
},
|
|
"CVE-2023-3368": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.69671,
|
|
"epss_pct": 0.99315,
|
|
"name": "Chamilo LMS <= v1.11.20 Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3368.yaml"
|
|
},
|
|
"CVE-2023-3380": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.0388,
|
|
"epss_pct": 0.89474,
|
|
"name": "WAVLINK WN579X3 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3380.yaml"
|
|
},
|
|
"CVE-2023-33831": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.22707,
|
|
"epss_pct": 0.97556,
|
|
"name": "FUXA - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33831.yaml"
|
|
},
|
|
"CVE-2023-3388": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.84461,
|
|
"epss_pct": 0.99683,
|
|
"name": "Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3388.yaml"
|
|
},
|
|
"CVE-2023-33960": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01257,
|
|
"epss_pct": 0.67468,
|
|
"name": "OpenProject < 12.5.4 - Project Identifiers Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33960.yaml"
|
|
},
|
|
"CVE-2023-34020": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00963,
|
|
"epss_pct": 0.59187,
|
|
"name": "Uncanny Toolkit for LearnDash - Open Redirection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34020.yaml"
|
|
},
|
|
"CVE-2023-34039": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-327",
|
|
"epss": 0.6799,
|
|
"epss_pct": 0.99267,
|
|
"name": "VMWare Aria Operations - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-34039.yaml"
|
|
},
|
|
"CVE-2023-34048": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-787",
|
|
"epss": 0.99428,
|
|
"epss_pct": 0.9994,
|
|
"name": "VMware vCenter Server - Out-of-Bounds Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34048.yaml"
|
|
},
|
|
"CVE-2023-34092": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-50",
|
|
"epss": 0.03126,
|
|
"epss_pct": 0.86936,
|
|
"name": "Vite Dev Server - Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34092.yaml"
|
|
},
|
|
"CVE-2023-34105": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"epss": 0.08689,
|
|
"epss_pct": 0.9474,
|
|
"name": "SRS - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34105.yaml"
|
|
},
|
|
"CVE-2023-34124": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.49077,
|
|
"epss_pct": 0.98795,
|
|
"name": "SonicWall GMS and Analytics Web Services - Shell Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34124.yaml"
|
|
},
|
|
"CVE-2023-34133": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.72579,
|
|
"epss_pct": 0.99399,
|
|
"name": "SonicWall GMS and Analytics - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34133.yaml"
|
|
},
|
|
"CVE-2023-34192": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.77266,
|
|
"epss_pct": 0.99519,
|
|
"name": "Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34192.yaml"
|
|
},
|
|
"CVE-2023-34259": {
|
|
"cvss": 4.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.60482,
|
|
"epss_pct": 0.99078,
|
|
"name": "Kyocera TASKalfa printer - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34259.yaml"
|
|
},
|
|
"CVE-2023-34362": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99934,
|
|
"epss_pct": 0.99969,
|
|
"name": "MOVEit Transfer - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34362.yaml"
|
|
},
|
|
"CVE-2023-3452": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.06958,
|
|
"epss_pct": 0.93651,
|
|
"name": "WordPress Canto Plugin <= 3.0.4 - File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3452.yaml"
|
|
},
|
|
"CVE-2023-34537": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01438,
|
|
"epss_pct": 0.71282,
|
|
"name": "Hoteldruid 3.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34537.yaml"
|
|
},
|
|
"CVE-2023-34598": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.47238,
|
|
"epss_pct": 0.98751,
|
|
"name": "Gibbon v25.0.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34598.yaml"
|
|
},
|
|
"CVE-2023-34599": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01853,
|
|
"epss_pct": 0.77632,
|
|
"name": "Gibbon v25.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34599.yaml"
|
|
},
|
|
"CVE-2023-3460": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.72306,
|
|
"epss_pct": 0.99392,
|
|
"name": "Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3460.yaml"
|
|
},
|
|
"CVE-2023-34659": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.1248,
|
|
"epss_pct": 0.9593,
|
|
"name": "JeecgBoot 3.5.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34659.yaml"
|
|
},
|
|
"CVE-2023-34751": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04228,
|
|
"epss_pct": 0.90301,
|
|
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34751.yaml"
|
|
},
|
|
"CVE-2023-34752": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04383,
|
|
"epss_pct": 0.90602,
|
|
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34752.yaml"
|
|
},
|
|
"CVE-2023-34753": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04228,
|
|
"epss_pct": 0.90301,
|
|
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34753.yaml"
|
|
},
|
|
"CVE-2023-34754": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03449,
|
|
"epss_pct": 0.88164,
|
|
"name": "Bloofox v0.5.2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34754.yaml"
|
|
},
|
|
"CVE-2023-34755": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04228,
|
|
"epss_pct": 0.903,
|
|
"name": "bloofoxCMS v0.5.2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34755.yaml"
|
|
},
|
|
"CVE-2023-34756": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04228,
|
|
"epss_pct": 0.90301,
|
|
"name": "Bloofox v0.5.2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34756.yaml"
|
|
},
|
|
"CVE-2023-3479": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01293,
|
|
"epss_pct": 0.6827,
|
|
"name": "Hestiacp <= 1.7.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3479.yaml"
|
|
},
|
|
"CVE-2023-34843": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.07176,
|
|
"epss_pct": 0.93839,
|
|
"name": "Traggo Server - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34843.yaml"
|
|
},
|
|
"CVE-2023-34960": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99325,
|
|
"epss_pct": 0.99936,
|
|
"name": "Chamilo Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34960.yaml"
|
|
},
|
|
"CVE-2023-34990": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.24901,
|
|
"epss_pct": 0.97748,
|
|
"name": "FortiWLM - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34990.yaml"
|
|
},
|
|
"CVE-2023-34992": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.80061,
|
|
"epss_pct": 0.99584,
|
|
"name": "Fortinet FortiSIEM - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-34992.yaml"
|
|
},
|
|
"CVE-2023-34993": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.18148,
|
|
"epss_pct": 0.96989,
|
|
"name": "Fortinet FortiWLM Unauthenticated Command Injection Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34993.yaml"
|
|
},
|
|
"CVE-2023-35078": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99995,
|
|
"name": "Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35078.yaml"
|
|
},
|
|
"CVE-2023-35082": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99996,
|
|
"name": "MobileIron Core - Remote Unauthenticated API Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35082.yaml"
|
|
},
|
|
"CVE-2023-35155": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01496,
|
|
"epss_pct": 0.72369,
|
|
"name": "XWiki - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35155.yaml"
|
|
},
|
|
"CVE-2023-35156": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02081,
|
|
"epss_pct": 0.80195,
|
|
"name": "XWiki >= 6.0-rc-1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35156.yaml"
|
|
},
|
|
"CVE-2023-35158": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-87",
|
|
"epss": 0.02048,
|
|
"epss_pct": 0.79852,
|
|
"name": "XWiki - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35158.yaml"
|
|
},
|
|
"CVE-2023-35159": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02182,
|
|
"epss_pct": 0.81104,
|
|
"name": "XWiki >= 3.4-milestone-1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35159.yaml"
|
|
},
|
|
"CVE-2023-35160": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02268,
|
|
"epss_pct": 0.81813,
|
|
"name": "XWiki >= 2.5-milestone-2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35160.yaml"
|
|
},
|
|
"CVE-2023-35161": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02377,
|
|
"epss_pct": 0.82681,
|
|
"name": "XWiki >= 6.2-milestone-1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35161.yaml"
|
|
},
|
|
"CVE-2023-35162": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02377,
|
|
"epss_pct": 0.82681,
|
|
"name": "XWiki < 14.10.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35162.yaml"
|
|
},
|
|
"CVE-2023-3519": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99749,
|
|
"epss_pct": 0.99953,
|
|
"name": "Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3519.yaml"
|
|
},
|
|
"CVE-2023-3521": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00919,
|
|
"epss_pct": 0.57767,
|
|
"name": "FOSSBilling < 0.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3521.yaml"
|
|
},
|
|
"CVE-2023-35708": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.96682,
|
|
"epss_pct": 0.9988,
|
|
"name": "MOVEit Transfer - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35708.yaml"
|
|
},
|
|
"CVE-2023-3578": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.0357,
|
|
"epss_pct": 0.88538,
|
|
"name": "DedeCMS 5.7.109 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3578.yaml"
|
|
},
|
|
"CVE-2023-35813": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.86685,
|
|
"epss_pct": 0.99726,
|
|
"name": "Sitecore - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35813.yaml"
|
|
},
|
|
"CVE-2023-35843": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08875,
|
|
"epss_pct": 0.94838,
|
|
"name": "NocoDB version <= 0.106.1 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35843.yaml"
|
|
},
|
|
"CVE-2023-35844": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06344,
|
|
"epss_pct": 0.93138,
|
|
"name": "Lightdash version <= 0.510.3 Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35844.yaml"
|
|
},
|
|
"CVE-2023-35885": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-565",
|
|
"epss": 0.74888,
|
|
"epss_pct": 0.99467,
|
|
"name": "Cloudpanel 2 < 2.3.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35885.yaml"
|
|
},
|
|
"CVE-2023-36144": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.36507,
|
|
"epss_pct": 0.98377,
|
|
"name": "Intelbras Switch - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36144.yaml"
|
|
},
|
|
"CVE-2023-36284": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03157,
|
|
"epss_pct": 0.8706,
|
|
"name": "QloApps 1.6.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36284.yaml"
|
|
},
|
|
"CVE-2023-36287": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01199,
|
|
"epss_pct": 0.65947,
|
|
"name": "Webkul QloApps 1.6.0 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36287.yaml"
|
|
},
|
|
"CVE-2023-36289": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01169,
|
|
"epss_pct": 0.65168,
|
|
"name": "Webkul QloApps 1.6.0 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36289.yaml"
|
|
},
|
|
"CVE-2023-36306": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05313,
|
|
"epss_pct": 0.92022,
|
|
"name": "Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36306.yaml"
|
|
},
|
|
"CVE-2023-36346": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05252,
|
|
"epss_pct": 0.91956,
|
|
"name": "POS Codekop v2.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36346.yaml"
|
|
},
|
|
"CVE-2023-36347": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.34054,
|
|
"epss_pct": 0.98281,
|
|
"name": "POS Codekop v2.0 - Broken Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36347.yaml"
|
|
},
|
|
"CVE-2023-3643": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.75363,
|
|
"epss_pct": 0.99478,
|
|
"name": "CAREL Boss Mini <= 1.4.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3643.yaml"
|
|
},
|
|
"CVE-2023-36844": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-473",
|
|
"epss": 0.91357,
|
|
"epss_pct": 0.99803,
|
|
"name": "Juniper Devices - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml"
|
|
},
|
|
"CVE-2023-36845": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-473",
|
|
"epss": 0.94595,
|
|
"epss_pct": 0.99848,
|
|
"name": "Juniper J-Web - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36845.yaml"
|
|
},
|
|
"CVE-2023-36934": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.95184,
|
|
"epss_pct": 0.99858,
|
|
"name": "MOVEit Transfer - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36934.yaml"
|
|
},
|
|
"CVE-2023-3710": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.33094,
|
|
"epss_pct": 0.9824,
|
|
"name": "Honeywell PM43 Printers - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3710.yaml"
|
|
},
|
|
"CVE-2023-3722": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.0386,
|
|
"epss_pct": 0.89416,
|
|
"name": "Avaya Aura Device Services - OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3722.yaml"
|
|
},
|
|
"CVE-2023-37265": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.07356,
|
|
"epss_pct": 0.93955,
|
|
"name": "CasaOS < 0.4.4 - Authentication Bypass via Internal IP",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37265.yaml"
|
|
},
|
|
"CVE-2023-37266": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.06844,
|
|
"epss_pct": 0.93556,
|
|
"name": "CasaOS < 0.4.4 - Authentication Bypass via Random JWT Token",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37266.yaml"
|
|
},
|
|
"CVE-2023-37270": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.045,
|
|
"epss_pct": 0.90813,
|
|
"name": "Piwigo 13.7.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37270.yaml"
|
|
},
|
|
"CVE-2023-37462": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.91492,
|
|
"epss_pct": 0.99804,
|
|
"name": "XWiki Platform - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37462.yaml"
|
|
},
|
|
"CVE-2023-37474": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.4492,
|
|
"epss_pct": 0.98684,
|
|
"name": "Copyparty <= 1.8.2 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37474.yaml"
|
|
},
|
|
"CVE-2023-37580": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.46709,
|
|
"epss_pct": 0.98738,
|
|
"name": "Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37580.yaml"
|
|
},
|
|
"CVE-2023-37582": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.90427,
|
|
"epss_pct": 0.99792,
|
|
"name": "Apache RocketMQ - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-37582.yaml"
|
|
},
|
|
"CVE-2023-37599": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.03632,
|
|
"epss_pct": 0.88724,
|
|
"name": "Issabel PBX 4.0.0-6 - Directory Listing",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37599.yaml"
|
|
},
|
|
"CVE-2023-37629": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.23311,
|
|
"epss_pct": 0.97611,
|
|
"name": "Online Piggery Management System v1.0 - Unauthenticated File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37629.yaml"
|
|
},
|
|
"CVE-2023-37645": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-668",
|
|
"epss": 0.24931,
|
|
"epss_pct": 0.97751,
|
|
"name": "EyouCms v1.6.3 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37645.yaml"
|
|
},
|
|
"CVE-2023-3765": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-36",
|
|
"epss": 0.6755,
|
|
"epss_pct": 0.99256,
|
|
"name": "MLflow Absolute Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3765.yaml"
|
|
},
|
|
"CVE-2023-37679": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99434,
|
|
"epss_pct": 0.9994,
|
|
"name": "NextGen Mirth Connect - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37679.yaml"
|
|
},
|
|
"CVE-2023-37728": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01164,
|
|
"epss_pct": 0.65038,
|
|
"name": "IceWarp Webmail Server v10.2.1 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37728.yaml"
|
|
},
|
|
"CVE-2023-37979": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09707,
|
|
"epss_pct": 0.95162,
|
|
"name": "Ninja Forms < 3.6.26 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37979.yaml"
|
|
},
|
|
"CVE-2023-37988": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01317,
|
|
"epss_pct": 0.68776,
|
|
"name": "Contact Form Generator <= 2.5.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37988.yaml"
|
|
},
|
|
"CVE-2023-37999": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.03349,
|
|
"epss_pct": 0.87824,
|
|
"name": "HT Mega \u2013 Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-37999.yaml"
|
|
},
|
|
"CVE-2023-38035": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.99954,
|
|
"epss_pct": 0.99973,
|
|
"name": "Ivanti Sentry - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38035.yaml"
|
|
},
|
|
"CVE-2023-38040": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01983,
|
|
"epss_pct": 0.79145,
|
|
"name": "Revive Adserver 5.4.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38040.yaml"
|
|
},
|
|
"CVE-2023-38192": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01107,
|
|
"epss_pct": 0.63532,
|
|
"name": "SuperWebMailer 9.00.0.01710 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38192.yaml"
|
|
},
|
|
"CVE-2023-38194": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01131,
|
|
"epss_pct": 0.64139,
|
|
"name": "SuperWebMailer - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38194.yaml"
|
|
},
|
|
"CVE-2023-38203": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.96716,
|
|
"epss_pct": 0.99881,
|
|
"name": "Adobe ColdFusion - Deserialization of Untrusted Data",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38203.yaml"
|
|
},
|
|
"CVE-2023-38205": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.99742,
|
|
"epss_pct": 0.99953,
|
|
"name": "Adobe ColdFusion - Access Control Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38205.yaml"
|
|
},
|
|
"CVE-2023-3836": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.7367,
|
|
"epss_pct": 0.99432,
|
|
"name": "Dahua Smart Park Management - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3836.yaml"
|
|
},
|
|
"CVE-2023-3843": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05955,
|
|
"epss_pct": 0.92758,
|
|
"name": "mooDating 1.2 - Cross-site scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3843.yaml"
|
|
},
|
|
"CVE-2023-38433": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.03722,
|
|
"epss_pct": 0.89007,
|
|
"name": "Fujitsu IP Series - Hardcoded Credentials",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38433.yaml"
|
|
},
|
|
"CVE-2023-3844": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05955,
|
|
"epss_pct": 0.92757,
|
|
"name": "MooDating 1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3844.yaml"
|
|
},
|
|
"CVE-2023-3845": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05955,
|
|
"epss_pct": 0.92758,
|
|
"name": "MooDating 1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3845.yaml"
|
|
},
|
|
"CVE-2023-3846": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05955,
|
|
"epss_pct": 0.92757,
|
|
"name": "MooDating 1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3846.yaml"
|
|
},
|
|
"CVE-2023-3847": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05955,
|
|
"epss_pct": 0.92757,
|
|
"name": "MooDating 1.2 - Cross-Site scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3847.yaml"
|
|
},
|
|
"CVE-2023-3848": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06004,
|
|
"epss_pct": 0.92808,
|
|
"name": "MooDating 1.2 - Cross-site scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3848.yaml"
|
|
},
|
|
"CVE-2023-3849": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.06004,
|
|
"epss_pct": 0.92808,
|
|
"name": "mooDating 1.2 - Cross-site scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3849.yaml"
|
|
},
|
|
"CVE-2023-38501": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09321,
|
|
"epss_pct": 0.95014,
|
|
"name": "CopyParty v1.8.6 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38501.yaml"
|
|
},
|
|
"CVE-2023-38646": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.98677,
|
|
"epss_pct": 0.99921,
|
|
"name": "Metabase < 0.46.6.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38646.yaml"
|
|
},
|
|
"CVE-2023-38875": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00824,
|
|
"epss_pct": 0.54828,
|
|
"name": "PHP Login System 2.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38875.yaml"
|
|
},
|
|
"CVE-2023-38879": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03663,
|
|
"epss_pct": 0.88839,
|
|
"name": "openSIS v9.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38879.yaml"
|
|
},
|
|
"CVE-2023-38950": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.84702,
|
|
"epss_pct": 0.9969,
|
|
"name": "ZKTeco BioTime v8.5.5 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38950.yaml"
|
|
},
|
|
"CVE-2023-38952": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.0266,
|
|
"epss_pct": 0.84625,
|
|
"name": "ZKTeco BioTime <= 9.0.1 - Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38952.yaml"
|
|
},
|
|
"CVE-2023-38964": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01101,
|
|
"epss_pct": 0.63369,
|
|
"name": "Academy LMS 6.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38964.yaml"
|
|
},
|
|
"CVE-2023-38992": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.73579,
|
|
"epss_pct": 0.99428,
|
|
"name": "Jeecg-Boot v3.5.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38992.yaml"
|
|
},
|
|
"CVE-2023-39002": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01212,
|
|
"epss_pct": 0.66349,
|
|
"name": "OPNsense - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39002.yaml"
|
|
},
|
|
"CVE-2023-39007": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02608,
|
|
"epss_pct": 0.84298,
|
|
"name": "OPNsense - Cross-Site Scripting to RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39007.yaml"
|
|
},
|
|
"CVE-2023-39026": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.17919,
|
|
"epss_pct": 0.9696,
|
|
"name": "FileMage Gateway - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39026.yaml"
|
|
},
|
|
"CVE-2023-39108": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03361,
|
|
"epss_pct": 0.87864,
|
|
"name": "rConfig 3.9.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39108.yaml"
|
|
},
|
|
"CVE-2023-39109": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03361,
|
|
"epss_pct": 0.87864,
|
|
"name": "rConfig 3.9.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39109.yaml"
|
|
},
|
|
"CVE-2023-39110": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03651,
|
|
"epss_pct": 0.888,
|
|
"name": "rConfig 3.9.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39110.yaml"
|
|
},
|
|
"CVE-2023-39121": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02513,
|
|
"epss_pct": 0.83654,
|
|
"name": "Emlog 2.1.9 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39121.yaml"
|
|
},
|
|
"CVE-2023-39141": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03367,
|
|
"epss_pct": 0.87885,
|
|
"name": "Aria2 WebUI - Path traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39141.yaml"
|
|
},
|
|
"CVE-2023-39143": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.80623,
|
|
"epss_pct": 0.99595,
|
|
"name": "PaperCut < 22.1.3 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39143.yaml"
|
|
},
|
|
"CVE-2023-3936": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00902,
|
|
"epss_pct": 0.57241,
|
|
"name": "Blog2Social < 7.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3936.yaml"
|
|
},
|
|
"CVE-2023-39361": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.87688,
|
|
"epss_pct": 0.99747,
|
|
"name": "Cacti 1.2.24 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39361.yaml"
|
|
},
|
|
"CVE-2023-39560": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04684,
|
|
"epss_pct": 0.91133,
|
|
"name": "ECTouch v2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39560.yaml"
|
|
},
|
|
"CVE-2023-39598": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0139,
|
|
"epss_pct": 0.70398,
|
|
"name": "IceWarp Email Client - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39598.yaml"
|
|
},
|
|
"CVE-2023-39600": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01215,
|
|
"epss_pct": 0.66423,
|
|
"name": "IceWarp 11.4.6.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39600.yaml"
|
|
},
|
|
"CVE-2023-39650": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04065,
|
|
"epss_pct": 0.89943,
|
|
"name": "PrestaShop Theme Volty CMS Blog - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39650.yaml"
|
|
},
|
|
"CVE-2023-39676": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01332,
|
|
"epss_pct": 0.69105,
|
|
"name": "PrestaShop fieldpopupnewsletter Module - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39676.yaml"
|
|
},
|
|
"CVE-2023-39677": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.30806,
|
|
"epss_pct": 0.98116,
|
|
"name": "PrestaShop MyPrestaModules - PhpInfo Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39677.yaml"
|
|
},
|
|
"CVE-2023-39700": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0148,
|
|
"epss_pct": 0.72096,
|
|
"name": "IceWarp Mail Server v10.4.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39700.yaml"
|
|
},
|
|
"CVE-2023-39796": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06146,
|
|
"epss_pct": 0.9295,
|
|
"name": "WBCE 1.6.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39796.yaml"
|
|
},
|
|
"CVE-2023-3990": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01421,
|
|
"epss_pct": 0.70964,
|
|
"name": "Mingsoft MCMS < 5.3.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3990.yaml"
|
|
},
|
|
"CVE-2023-40000": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.54872,
|
|
"epss_pct": 0.9895,
|
|
"name": "LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40000.yaml"
|
|
},
|
|
"CVE-2023-40044": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.9015,
|
|
"epss_pct": 0.99787,
|
|
"name": "WS_FTP Server - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40044.yaml"
|
|
},
|
|
"CVE-2023-40208": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00726,
|
|
"epss_pct": 0.51572,
|
|
"name": "Stock Ticker <= 3.23.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40208.yaml"
|
|
},
|
|
"CVE-2023-40211": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02071,
|
|
"epss_pct": 0.80092,
|
|
"name": "Post Grid <= 2.2.50 - Information Exposure via REST API",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40211.yaml"
|
|
},
|
|
"CVE-2023-40355": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01081,
|
|
"epss_pct": 0.62756,
|
|
"name": "Axigen WebMail - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40355.yaml"
|
|
},
|
|
"CVE-2023-40504": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.88728,
|
|
"epss_pct": 0.99764,
|
|
"name": "LG Simple Editor <= v3.21.0 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40504.yaml"
|
|
},
|
|
"CVE-2023-40600": {
|
|
"name": "EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40600.yaml"
|
|
},
|
|
"CVE-2023-40748": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03318,
|
|
"epss_pct": 0.87715,
|
|
"name": "PHPJabbers Food Delivery Script - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40748.yaml"
|
|
},
|
|
"CVE-2023-40749": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03682,
|
|
"epss_pct": 0.88892,
|
|
"name": "PHPJabbers Food Delivery Script v3.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40749.yaml"
|
|
},
|
|
"CVE-2023-40750": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01034,
|
|
"epss_pct": 0.61432,
|
|
"name": "PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40750.yaml"
|
|
},
|
|
"CVE-2023-40751": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01088,
|
|
"epss_pct": 0.62967,
|
|
"name": "PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40751.yaml"
|
|
},
|
|
"CVE-2023-40752": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01043,
|
|
"epss_pct": 0.6168,
|
|
"name": "PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40752.yaml"
|
|
},
|
|
"CVE-2023-40753": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01109,
|
|
"epss_pct": 0.63581,
|
|
"name": "PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40753.yaml"
|
|
},
|
|
"CVE-2023-40755": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01254,
|
|
"epss_pct": 0.67369,
|
|
"name": "PHPJabbers Callback Widget v1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40755.yaml"
|
|
},
|
|
"CVE-2023-40779": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01355,
|
|
"epss_pct": 0.69653,
|
|
"name": "IceWarp Mail Server Deep Castle 2 v.13.0.1.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40779.yaml"
|
|
},
|
|
"CVE-2023-40924": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02885,
|
|
"epss_pct": 0.85891,
|
|
"name": "SolarView Compact < 6.00 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40924.yaml"
|
|
},
|
|
"CVE-2023-40931": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11278,
|
|
"epss_pct": 0.95655,
|
|
"name": "Nagios XI v5.11.0 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40931.yaml"
|
|
},
|
|
"CVE-2023-4110": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01792,
|
|
"epss_pct": 0.76816,
|
|
"name": "PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4110.yaml"
|
|
},
|
|
"CVE-2023-41109": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.64754,
|
|
"epss_pct": 0.99184,
|
|
"name": "SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41109.yaml"
|
|
},
|
|
"CVE-2023-4111": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02535,
|
|
"epss_pct": 0.83809,
|
|
"name": "PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4111.yaml"
|
|
},
|
|
"CVE-2023-4112": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08422,
|
|
"epss_pct": 0.94589,
|
|
"name": "PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4112.yaml"
|
|
},
|
|
"CVE-2023-4113": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08422,
|
|
"epss_pct": 0.94589,
|
|
"name": "PHPJabbers Service Booking Script 1.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4113.yaml"
|
|
},
|
|
"CVE-2023-4114": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08312,
|
|
"epss_pct": 0.94531,
|
|
"name": "PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4114.yaml"
|
|
},
|
|
"CVE-2023-4115": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08422,
|
|
"epss_pct": 0.94589,
|
|
"name": "PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4115.yaml"
|
|
},
|
|
"CVE-2023-4116": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08422,
|
|
"epss_pct": 0.94589,
|
|
"name": "PHPJabbers Taxi Booking 2.0 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4116.yaml"
|
|
},
|
|
"CVE-2023-41265": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-444",
|
|
"epss": 0.88215,
|
|
"epss_pct": 0.99756,
|
|
"name": "Qlik Sense Enterprise - HTTP Request Smuggling",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41265.yaml"
|
|
},
|
|
"CVE-2023-41266": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.84843,
|
|
"epss_pct": 0.99694,
|
|
"name": "Qlik Sense Enterprise - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41266.yaml"
|
|
},
|
|
"CVE-2023-4136": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0142,
|
|
"epss_pct": 0.70954,
|
|
"name": "CrafterCMS Engine - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4136.yaml"
|
|
},
|
|
"CVE-2023-4148": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00812,
|
|
"epss_pct": 0.54454,
|
|
"name": "Ditty < 3.1.25 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4148.yaml"
|
|
},
|
|
"CVE-2023-4151": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00645,
|
|
"epss_pct": 0.48416,
|
|
"name": "Store Locator WordPress < 1.4.13 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4151.yaml"
|
|
},
|
|
"CVE-2023-41538": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01139,
|
|
"epss_pct": 0.64339,
|
|
"name": "PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41538.yaml"
|
|
},
|
|
"CVE-2023-41597": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01224,
|
|
"epss_pct": 0.66669,
|
|
"name": "EyouCms v1.6.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41597.yaml"
|
|
},
|
|
"CVE-2023-41599": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11215,
|
|
"epss_pct": 0.95643,
|
|
"name": "JFinalCMS v5.0.0 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41599.yaml"
|
|
},
|
|
"CVE-2023-41621": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01146,
|
|
"epss_pct": 0.64506,
|
|
"name": "Emlog Pro v2.1.14 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41621.yaml"
|
|
},
|
|
"CVE-2023-41642": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01071,
|
|
"epss_pct": 0.62507,
|
|
"name": "RealGimm by GruppoSCAI v1.1.37p38 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41642.yaml"
|
|
},
|
|
"CVE-2023-4168": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.45972,
|
|
"epss_pct": 0.98717,
|
|
"name": "Adlisting Classified Ads 2.14.0 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4168.yaml"
|
|
},
|
|
"CVE-2023-4169": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.4923,
|
|
"epss_pct": 0.98797,
|
|
"name": "Ruijie RG-EW1200G Router - Password Reset",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4169.yaml"
|
|
},
|
|
"CVE-2023-4173": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05449,
|
|
"epss_pct": 0.92166,
|
|
"name": "mooSocial 3.1.8 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4173.yaml"
|
|
},
|
|
"CVE-2023-4174": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.09138,
|
|
"epss_pct": 0.94942,
|
|
"name": "mooSocial 3.1.6 - Reflected Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4174.yaml"
|
|
},
|
|
"CVE-2023-41763": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.90353,
|
|
"epss_pct": 0.99789,
|
|
"name": "Skype for Business 2019 (SfB) - Blind Server-side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41763.yaml"
|
|
},
|
|
"CVE-2023-41892": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.92555,
|
|
"epss_pct": 0.99819,
|
|
"name": "CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41892.yaml"
|
|
},
|
|
"CVE-2023-41954": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.01397,
|
|
"epss_pct": 0.70506,
|
|
"name": "ProfilePress <= 4.13.1 \u2014 Unauthenticated Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41954.yaml"
|
|
},
|
|
"CVE-2023-4220": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.76084,
|
|
"epss_pct": 0.99494,
|
|
"name": "Chamilo LMS <= 1.11.24 - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4220.yaml"
|
|
},
|
|
"CVE-2023-42343": {
|
|
"epss": 0.0059,
|
|
"epss_pct": 0.45854,
|
|
"name": "OpenCMS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42343.yaml"
|
|
},
|
|
"CVE-2023-42344": {
|
|
"name": "OpenCMS - XML external entity (XXE)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42344.yaml"
|
|
},
|
|
"CVE-2023-42442": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.55861,
|
|
"epss_pct": 0.98969,
|
|
"name": "JumpServer > 3.6.4 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42442.yaml"
|
|
},
|
|
"CVE-2023-42793": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.99979,
|
|
"epss_pct": 0.99981,
|
|
"name": "JetBrains TeamCity < 2023.05.4 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42793.yaml"
|
|
},
|
|
"CVE-2023-4284": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00759,
|
|
"epss_pct": 0.5273,
|
|
"name": "WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4284.yaml"
|
|
},
|
|
"CVE-2023-43177": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-913",
|
|
"epss": 0.81801,
|
|
"epss_pct": 0.9962,
|
|
"name": "CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43177.yaml"
|
|
},
|
|
"CVE-2023-43187": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-91",
|
|
"epss": 0.45401,
|
|
"epss_pct": 0.98699,
|
|
"name": "NodeBB XML-RPC Request xmlrpc.php - XML Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43187.yaml"
|
|
},
|
|
"CVE-2023-43208": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.82708,
|
|
"epss_pct": 0.99643,
|
|
"name": "NextGen Healthcare Mirth Connect - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43208.yaml"
|
|
},
|
|
"CVE-2023-43261": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.59609,
|
|
"epss_pct": 0.99058,
|
|
"name": "Milesight Routers - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43261.yaml"
|
|
},
|
|
"CVE-2023-43323": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"epss": 0.0186,
|
|
"epss_pct": 0.77734,
|
|
"name": "mooSocial 3.1.8 - External Service Interaction",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43323.yaml"
|
|
},
|
|
"CVE-2023-43325": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01857,
|
|
"epss_pct": 0.77703,
|
|
"name": "MooSocial 3.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43325.yaml"
|
|
},
|
|
"CVE-2023-43326": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01615,
|
|
"epss_pct": 0.74288,
|
|
"name": "MooSocial 3.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43326.yaml"
|
|
},
|
|
"CVE-2023-43373": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03753,
|
|
"epss_pct": 0.89098,
|
|
"name": "Hoteldruid v3.0.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43373.yaml"
|
|
},
|
|
"CVE-2023-43374": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03272,
|
|
"epss_pct": 0.87535,
|
|
"name": "Hoteldruid v3.0.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43374.yaml"
|
|
},
|
|
"CVE-2023-43472": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.36582,
|
|
"epss_pct": 0.98382,
|
|
"name": "MLFlow < 2.8.1 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43472.yaml"
|
|
},
|
|
"CVE-2023-43654": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.355,
|
|
"epss_pct": 0.98334,
|
|
"name": "PyTorch TorchServe SSRF",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43654.yaml"
|
|
},
|
|
"CVE-2023-43662": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08147,
|
|
"epss_pct": 0.94436,
|
|
"name": "ShokoServer System - Local File Inclusion (LFI)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43662.yaml"
|
|
},
|
|
"CVE-2023-43795": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.67715,
|
|
"epss_pct": 0.99261,
|
|
"name": "GeoServer WPS - Server Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43795.yaml"
|
|
},
|
|
"CVE-2023-44012": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01258,
|
|
"epss_pct": 0.67479,
|
|
"name": "mojoPortal v.2.7.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44012.yaml"
|
|
},
|
|
"CVE-2023-4415": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.58296,
|
|
"epss_pct": 0.99026,
|
|
"name": "Ruijie RG-EW1200G Router Background - Login Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4415.yaml"
|
|
},
|
|
"CVE-2023-44352": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.84811,
|
|
"epss_pct": 0.99692,
|
|
"name": "Adobe Coldfusion - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44352.yaml"
|
|
},
|
|
"CVE-2023-44353": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.80178,
|
|
"epss_pct": 0.99586,
|
|
"name": "Adobe ColdFusion WDDX Deserialization Gadgets",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44353.yaml"
|
|
},
|
|
"CVE-2023-44393": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01277,
|
|
"epss_pct": 0.67942,
|
|
"name": "Piwigo - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44393.yaml"
|
|
},
|
|
"CVE-2023-4450": {
|
|
"epss": 0.11503,
|
|
"epss_pct": 0.95708,
|
|
"name": "JeecgBoot JimuReport - Template injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4450.yaml"
|
|
},
|
|
"CVE-2023-4451": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02499,
|
|
"epss_pct": 0.83553,
|
|
"name": "Cockpit - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4451.yaml"
|
|
},
|
|
"CVE-2023-44812": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01897,
|
|
"epss_pct": 0.78183,
|
|
"name": "mooSocial v.3.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44812.yaml"
|
|
},
|
|
"CVE-2023-44813": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01754,
|
|
"epss_pct": 0.76322,
|
|
"name": "mooSocial v.3.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44813.yaml"
|
|
},
|
|
"CVE-2023-4490": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03122,
|
|
"epss_pct": 0.86921,
|
|
"name": "WordPress Job Portal < 2.0.6 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4490.yaml"
|
|
},
|
|
"CVE-2023-44982": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01425,
|
|
"epss_pct": 0.71046,
|
|
"name": "WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-44982.yaml"
|
|
},
|
|
"CVE-2023-45038": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.01243,
|
|
"epss_pct": 0.67135,
|
|
"name": "QNAP Music Station < 5.4.0 - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45038.yaml"
|
|
},
|
|
"CVE-2023-45136": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.05124,
|
|
"epss_pct": 0.9179,
|
|
"name": "XWiki < 14.10.14 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45136.yaml"
|
|
},
|
|
"CVE-2023-4521": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.39294,
|
|
"epss_pct": 0.98496,
|
|
"name": "Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4521.yaml"
|
|
},
|
|
"CVE-2023-45249": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.53255,
|
|
"epss_pct": 0.98904,
|
|
"name": "Acronis Cyber Infrastructure - Default Password",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-45249.yaml"
|
|
},
|
|
"CVE-2023-45375": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.38457,
|
|
"epss_pct": 0.98463,
|
|
"name": "PrestaShop PireosPay - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45375.yaml"
|
|
},
|
|
"CVE-2023-4542": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.85443,
|
|
"epss_pct": 0.99704,
|
|
"name": "D-Link DAR-8000-10 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4542.yaml"
|
|
},
|
|
"CVE-2023-4547": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.61308,
|
|
"epss_pct": 0.99099,
|
|
"name": "SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4547.yaml"
|
|
},
|
|
"CVE-2023-45542": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01635,
|
|
"epss_pct": 0.74597,
|
|
"name": "MooSocial 3.1.8 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45542.yaml"
|
|
},
|
|
"CVE-2023-45648": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-444",
|
|
"epss": 0.05848,
|
|
"epss_pct": 0.92648,
|
|
"name": "Apache Tomcat - HTTP Request Smuggling",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45648.yaml"
|
|
},
|
|
"CVE-2023-45671": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01425,
|
|
"epss_pct": 0.71062,
|
|
"name": "Frigate < 0.13.0 Beta 3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45671.yaml"
|
|
},
|
|
"CVE-2023-4568": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.03568,
|
|
"epss_pct": 0.88534,
|
|
"name": "PaperCut NG Unauthenticated XMLRPC Functionality",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4568.yaml"
|
|
},
|
|
"CVE-2023-45826": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01872,
|
|
"epss_pct": 0.77878,
|
|
"name": "Leantime < 2.4 - Authenticated SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45826.yaml"
|
|
},
|
|
"CVE-2023-45852": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.14003,
|
|
"epss_pct": 0.96281,
|
|
"name": "Viessmann Vitogate 300 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45852.yaml"
|
|
},
|
|
"CVE-2023-45855": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0333,
|
|
"epss_pct": 0.87756,
|
|
"name": "qdPM 9.2 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45855.yaml"
|
|
},
|
|
"CVE-2023-45878": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.63113,
|
|
"epss_pct": 0.99142,
|
|
"name": "Gibbon LMS <= v25.0.01 - File Upload to RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45878.yaml"
|
|
},
|
|
"CVE-2023-4596": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.14321,
|
|
"epss_pct": 0.96343,
|
|
"name": "WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4596.yaml"
|
|
},
|
|
"CVE-2023-4634": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-73",
|
|
"epss": 0.82585,
|
|
"epss_pct": 0.99641,
|
|
"name": "Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4634.yaml"
|
|
},
|
|
"CVE-2023-46347": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.49885,
|
|
"epss_pct": 0.98813,
|
|
"name": "PrestaShop Step by Step products Pack - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46347.yaml"
|
|
},
|
|
"CVE-2023-46359": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.87495,
|
|
"epss_pct": 0.99744,
|
|
"name": "cPH2 Charging Station v1.87.0 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46359.yaml"
|
|
},
|
|
"CVE-2023-46455": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.46966,
|
|
"epss_pct": 0.98743,
|
|
"name": "GL.iNet <= 4.3.7 - Arbitrary File Write",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46455.yaml"
|
|
},
|
|
"CVE-2023-46574": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.65412,
|
|
"epss_pct": 0.99201,
|
|
"name": "TOTOLINK A3700R - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46574.yaml"
|
|
},
|
|
"CVE-2023-46604": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99723,
|
|
"epss_pct": 0.99951,
|
|
"name": "Apache ActiveMQ - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml"
|
|
},
|
|
"CVE-2023-4666": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.03283,
|
|
"epss_pct": 0.87576,
|
|
"name": "Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4666.yaml"
|
|
},
|
|
"CVE-2023-46732": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02191,
|
|
"epss_pct": 0.8117,
|
|
"name": "XWiki < 14.10.14 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46732.yaml"
|
|
},
|
|
"CVE-2023-46747": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.96515,
|
|
"epss_pct": 0.99877,
|
|
"name": "F5 BIG-IP - Unauthenticated RCE via AJP Smuggling",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46747.yaml"
|
|
},
|
|
"CVE-2023-46805": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99986,
|
|
"epss_pct": 0.99983,
|
|
"name": "Ivanti ICS - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46805.yaml"
|
|
},
|
|
"CVE-2023-46818": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.15856,
|
|
"epss_pct": 0.9664,
|
|
"name": "ISPConfig - PHP Code Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46818.yaml"
|
|
},
|
|
"CVE-2023-47105": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.01669,
|
|
"epss_pct": 0.7511,
|
|
"name": "Chaosblade < 1.7.4 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47105.yaml"
|
|
},
|
|
"CVE-2023-47115": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01448,
|
|
"epss_pct": 0.71474,
|
|
"name": "Label Studio - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47115.yaml"
|
|
},
|
|
"CVE-2023-47117": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.04055,
|
|
"epss_pct": 0.89923,
|
|
"name": "Label Studio - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47117.yaml"
|
|
},
|
|
"CVE-2023-4714": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.0521,
|
|
"epss_pct": 0.91908,
|
|
"name": "PlayTube 3.0.1 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4714.yaml"
|
|
},
|
|
"CVE-2023-47211": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.47024,
|
|
"epss_pct": 0.98745,
|
|
"name": "ManageEngine OpManager - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47211.yaml"
|
|
},
|
|
"CVE-2023-47218": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.8992,
|
|
"epss_pct": 0.99782,
|
|
"name": "QNAP QTS and QuTS Hero - OS Command Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47218.yaml"
|
|
},
|
|
"CVE-2023-47246": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.98851,
|
|
"epss_pct": 0.99924,
|
|
"name": "SysAid Server - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47246.yaml"
|
|
},
|
|
"CVE-2023-47248": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.14528,
|
|
"epss_pct": 0.96382,
|
|
"name": "PyArrow Flight RPC - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47248.yaml"
|
|
},
|
|
"CVE-2023-47253": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.14308,
|
|
"epss_pct": 0.9634,
|
|
"name": "Qualitor <= 8.20 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47253.yaml"
|
|
},
|
|
"CVE-2023-47643": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03002,
|
|
"epss_pct": 0.86422,
|
|
"name": "SuiteCRM Unauthenticated Graphql Introspection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47643.yaml"
|
|
},
|
|
"CVE-2023-47684": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00838,
|
|
"epss_pct": 0.55271,
|
|
"name": "Essential Grid <= 3.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47684.yaml"
|
|
},
|
|
"CVE-2023-47873": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.02276,
|
|
"epss_pct": 0.81881,
|
|
"name": "WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47873.yaml"
|
|
},
|
|
"CVE-2023-48022": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.83942,
|
|
"epss_pct": 0.99672,
|
|
"name": "Anyscale Ray - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48022.yaml"
|
|
},
|
|
"CVE-2023-48023": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"epss": 0.35296,
|
|
"epss_pct": 0.98328,
|
|
"name": "Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48023.yaml"
|
|
},
|
|
"CVE-2023-48084": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.3374,
|
|
"epss_pct": 0.98268,
|
|
"name": "Nagios XI < 5.11.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48084.yaml"
|
|
},
|
|
"CVE-2023-48241": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.7282,
|
|
"epss_pct": 0.99408,
|
|
"name": "XWiki < 4.10.15 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48241.yaml"
|
|
},
|
|
"CVE-2023-48728": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02268,
|
|
"epss_pct": 0.81812,
|
|
"name": "WWBN AVideo 11.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48728.yaml"
|
|
},
|
|
"CVE-2023-48777": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.041,
|
|
"epss_pct": 0.90021,
|
|
"name": "WordPress Elementor 3.18.1 - File Upload/Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48777.yaml"
|
|
},
|
|
"CVE-2023-48788": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.98446,
|
|
"epss_pct": 0.99914,
|
|
"name": "Fortinet Forticlient Endpoint Management Server - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-48788.yaml"
|
|
},
|
|
"CVE-2023-48795": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-354",
|
|
"epss": 0.93305,
|
|
"epss_pct": 0.9983,
|
|
"name": "OpenSSH Terrapin Attack - Detection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-48795.yaml"
|
|
},
|
|
"CVE-2023-49070": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.95368,
|
|
"epss_pct": 0.99862,
|
|
"name": "Apache OFBiz < 18.12.10 - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49070.yaml"
|
|
},
|
|
"CVE-2023-49103": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.78428,
|
|
"epss_pct": 0.9955,
|
|
"name": "OwnCloud - Phpinfo Configuration",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49103.yaml"
|
|
},
|
|
"CVE-2023-49105": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.43205,
|
|
"epss_pct": 0.98628,
|
|
"name": "OwnCloud - WebDAV API Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-49105.yaml"
|
|
},
|
|
"CVE-2023-4911": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.81422,
|
|
"epss_pct": 0.9961,
|
|
"name": "Looney Tunables Linux - Local Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-4911.yaml"
|
|
},
|
|
"CVE-2023-49230": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.0205,
|
|
"epss_pct": 0.79871,
|
|
"name": "Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49230.yaml"
|
|
},
|
|
"CVE-2023-49293": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.00997,
|
|
"epss_pct": 0.60266,
|
|
"name": "Vite dev server - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49293.yaml"
|
|
},
|
|
"CVE-2023-49438": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01079,
|
|
"epss_pct": 0.62711,
|
|
"name": "Python Flask-Security-Too <=5.3.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49438.yaml"
|
|
},
|
|
"CVE-2023-49489": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0072,
|
|
"epss_pct": 0.51383,
|
|
"name": "KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49489.yaml"
|
|
},
|
|
"CVE-2023-49494": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01147,
|
|
"epss_pct": 0.64542,
|
|
"name": "DedeCMS v5.7.111 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49494.yaml"
|
|
},
|
|
"CVE-2023-4966": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99998,
|
|
"name": "Citrix Bleed - Leaking Session Tokens",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4966.yaml"
|
|
},
|
|
"CVE-2023-4973": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01835,
|
|
"epss_pct": 0.77398,
|
|
"name": "Academy LMS 6.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4973.yaml"
|
|
},
|
|
"CVE-2023-4974": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04886,
|
|
"epss_pct": 0.91446,
|
|
"name": "Academy LMS 6.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4974.yaml"
|
|
},
|
|
"CVE-2023-49785": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.83163,
|
|
"epss_pct": 0.99653,
|
|
"name": "ChatGPT-Next-Web - SSRF/XSS",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49785.yaml"
|
|
},
|
|
"CVE-2023-5003": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.25855,
|
|
"epss_pct": 0.97824,
|
|
"name": "Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5003.yaml"
|
|
},
|
|
"CVE-2023-50094": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.1354,
|
|
"epss_pct": 0.96177,
|
|
"name": "reNgine 2.2.0 - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50094.yaml"
|
|
},
|
|
"CVE-2023-50290": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.68446,
|
|
"epss_pct": 0.99281,
|
|
"name": "Apache Solr - Host Environment Variables Leak via Metrics API",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50290.yaml"
|
|
},
|
|
"CVE-2023-50578": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0224,
|
|
"epss_pct": 0.81607,
|
|
"name": "Mingsoft MCMS 5.2.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50578.yaml"
|
|
},
|
|
"CVE-2023-50719": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-359",
|
|
"epss": 0.83548,
|
|
"epss_pct": 0.99663,
|
|
"name": "XWiki < 4.10.15 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50719.yaml"
|
|
},
|
|
"CVE-2023-50720": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.59119,
|
|
"epss_pct": 0.99044,
|
|
"name": "XWiki < 4.10.15 - Email Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50720.yaml"
|
|
},
|
|
"CVE-2023-5074": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.67914,
|
|
"epss_pct": 0.99265,
|
|
"name": "D-Link D-View 8 v2.0.1.28 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5074.yaml"
|
|
},
|
|
"CVE-2023-50839": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02041,
|
|
"epss_pct": 0.79785,
|
|
"name": "JS Help Desk <= 2.8.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50839.yaml"
|
|
},
|
|
"CVE-2023-5089": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.02217,
|
|
"epss_pct": 0.81412,
|
|
"name": "Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5089.yaml"
|
|
},
|
|
"CVE-2023-50917": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.38007,
|
|
"epss_pct": 0.98444,
|
|
"name": "MajorDoMo thumb.php - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50917.yaml"
|
|
},
|
|
"CVE-2023-50968": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.63373,
|
|
"epss_pct": 0.99148,
|
|
"name": "Apache OFBiz < 18.12.11 - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50968.yaml"
|
|
},
|
|
"CVE-2023-51409": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.63077,
|
|
"epss_pct": 0.99141,
|
|
"name": "Jordy Meow AI Engine - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51409.yaml"
|
|
},
|
|
"CVE-2023-51449": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.28336,
|
|
"epss_pct": 0.97982,
|
|
"name": "Gradio Hugging Face - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51449.yaml"
|
|
},
|
|
"CVE-2023-51467": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.96001,
|
|
"epss_pct": 0.9987,
|
|
"name": "Apache OFBiz < 18.12.11 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51467.yaml"
|
|
},
|
|
"CVE-2023-51713": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-125",
|
|
"epss": 0.04249,
|
|
"epss_pct": 0.90344,
|
|
"name": "ProFTPD < 1.3.8a - DoS via Out-of-Bounds Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-51713.yaml"
|
|
},
|
|
"CVE-2023-5203": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02202,
|
|
"epss_pct": 0.81292,
|
|
"name": "WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5203.yaml"
|
|
},
|
|
"CVE-2023-5204": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06888,
|
|
"epss_pct": 0.93591,
|
|
"name": "WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5204.yaml"
|
|
},
|
|
"CVE-2023-52085": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.30166,
|
|
"epss_pct": 0.98087,
|
|
"name": "Winter CMS Local File Inclusion - (LFI)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52085.yaml"
|
|
},
|
|
"CVE-2023-52163": {
|
|
"name": "Digiever DS-2105 Pro - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52163.yaml"
|
|
},
|
|
"CVE-2023-5222": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-259",
|
|
"epss": 0.74525,
|
|
"epss_pct": 0.99458,
|
|
"name": "Viessmann Vitogate 300 - Hardcoded Password",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5222.yaml"
|
|
},
|
|
"CVE-2023-52251": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.85025,
|
|
"epss_pct": 0.99697,
|
|
"name": "Kafka UI 0.7.1 Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52251.yaml"
|
|
},
|
|
"CVE-2023-5244": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01061,
|
|
"epss_pct": 0.62203,
|
|
"name": "Microweber < V.2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5244.yaml"
|
|
},
|
|
"CVE-2023-5360": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.81695,
|
|
"epss_pct": 0.99617,
|
|
"name": "WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5360.yaml"
|
|
},
|
|
"CVE-2023-5375": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.35128,
|
|
"epss_pct": 0.98323,
|
|
"name": "Mosparo < 1.0.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5375.yaml"
|
|
},
|
|
"CVE-2023-5556": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01222,
|
|
"epss_pct": 0.66591,
|
|
"name": "Structurizr on-premises - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5556.yaml"
|
|
},
|
|
"CVE-2023-5558": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00908,
|
|
"epss_pct": 0.57456,
|
|
"name": "LearnPress < 4.2.5.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5558.yaml"
|
|
},
|
|
"CVE-2023-5559": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"epss": 0.02788,
|
|
"epss_pct": 0.85398,
|
|
"name": "10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5559.yaml"
|
|
},
|
|
"CVE-2023-5561": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03862,
|
|
"epss_pct": 0.89427,
|
|
"name": "WordPress Core - Post Author Email Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5561.yaml"
|
|
},
|
|
"CVE-2023-5652": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.63711,
|
|
"epss_pct": 0.99158,
|
|
"name": "WP Hotel Booking <= 2.0.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5652.yaml"
|
|
},
|
|
"CVE-2023-5815": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.04262,
|
|
"epss_pct": 0.90367,
|
|
"name": "News & Blog Designer Pack \u2013 WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5815.yaml"
|
|
},
|
|
"CVE-2023-5830": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.60782,
|
|
"epss_pct": 0.99085,
|
|
"name": "ColumbiaSoft DocumentLocator - Improper Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5830.yaml"
|
|
},
|
|
"CVE-2023-5863": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01096,
|
|
"epss_pct": 0.63229,
|
|
"name": "phpMyFAQ < 3.2.0 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5863.yaml"
|
|
},
|
|
"CVE-2023-5914": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.73142,
|
|
"epss_pct": 0.99416,
|
|
"name": "Citrix StoreFront - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5914.yaml"
|
|
},
|
|
"CVE-2023-5974": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.0315,
|
|
"epss_pct": 0.87029,
|
|
"name": "WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5974.yaml"
|
|
},
|
|
"CVE-2023-5991": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03313,
|
|
"epss_pct": 0.87697,
|
|
"name": "Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5991.yaml"
|
|
},
|
|
"CVE-2023-6000": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01999,
|
|
"epss_pct": 0.79324,
|
|
"name": "WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6000.yaml"
|
|
},
|
|
"CVE-2023-6018": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.47594,
|
|
"epss_pct": 0.98758,
|
|
"name": "Mlflow - Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6018.yaml"
|
|
},
|
|
"CVE-2023-6020": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.14652,
|
|
"epss_pct": 0.96406,
|
|
"name": "Ray Static File - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6020.yaml"
|
|
},
|
|
"CVE-2023-6021": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.37076,
|
|
"epss_pct": 0.98407,
|
|
"name": "Ray API - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6021.yaml"
|
|
},
|
|
"CVE-2023-6023": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02975,
|
|
"epss_pct": 0.86299,
|
|
"name": "VertaAI ModelDB - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6023.yaml"
|
|
},
|
|
"CVE-2023-6030": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.00821,
|
|
"epss_pct": 0.5476,
|
|
"name": "LogDash Activity Log <= 1.1.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6030.yaml"
|
|
},
|
|
"CVE-2023-6038": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.0434,
|
|
"epss_pct": 0.90515,
|
|
"name": "H2O ImportFiles - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6038.yaml"
|
|
},
|
|
"CVE-2023-6063": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.73708,
|
|
"epss_pct": 0.99434,
|
|
"name": "WP Fastest Cache 1.2.2 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6063.yaml"
|
|
},
|
|
"CVE-2023-6065": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.18552,
|
|
"epss_pct": 0.97045,
|
|
"name": "Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6065.yaml"
|
|
},
|
|
"CVE-2023-6114": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.30894,
|
|
"epss_pct": 0.98121,
|
|
"name": "Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6114.yaml"
|
|
},
|
|
"CVE-2023-6246": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.04794,
|
|
"epss_pct": 0.91305,
|
|
"name": "glibc's syslog - Local Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-6246.yaml"
|
|
},
|
|
"CVE-2023-6266": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.02072,
|
|
"epss_pct": 0.80109,
|
|
"name": "WordPress Backup Migration <= 1.3.6 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6266.yaml"
|
|
},
|
|
"CVE-2023-6275": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02379,
|
|
"epss_pct": 0.82692,
|
|
"name": "TOTVS Fluig Platform - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6275.yaml"
|
|
},
|
|
"CVE-2023-6329": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.64996,
|
|
"epss_pct": 0.9919,
|
|
"name": "Control iD iDSecure - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6329.yaml"
|
|
},
|
|
"CVE-2023-6360": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.63141,
|
|
"epss_pct": 0.99143,
|
|
"name": "WordPress My Calendar <3.4.22 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6360.yaml"
|
|
},
|
|
"CVE-2023-6379": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01752,
|
|
"epss_pct": 0.76293,
|
|
"name": "OpenCMS 14 & 15 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6379.yaml"
|
|
},
|
|
"CVE-2023-6380": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01594,
|
|
"epss_pct": 0.73966,
|
|
"name": "OpenCms 14 & 15 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6380.yaml"
|
|
},
|
|
"CVE-2023-6389": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.26798,
|
|
"epss_pct": 0.97884,
|
|
"name": "WordPress Toolbar <= 2.2.6 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6389.yaml"
|
|
},
|
|
"CVE-2023-6421": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02437,
|
|
"epss_pct": 0.83127,
|
|
"name": "WordPress Download Manager - File Password Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6421.yaml"
|
|
},
|
|
"CVE-2023-6444": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.02463,
|
|
"epss_pct": 0.8332,
|
|
"name": "Seriously Simple Podcasting < 3.0.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6444.yaml"
|
|
},
|
|
"CVE-2023-6505": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.39867,
|
|
"epss_pct": 0.9852,
|
|
"name": "Prime Mover < 1.9.3 - Sensitive Data Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6505.yaml"
|
|
},
|
|
"CVE-2023-6549": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-125",
|
|
"epss": 0.57633,
|
|
"epss_pct": 0.99011,
|
|
"name": "Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6549.yaml"
|
|
},
|
|
"CVE-2023-6553": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.97846,
|
|
"epss_pct": 0.99902,
|
|
"name": "Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6553.yaml"
|
|
},
|
|
"CVE-2023-6567": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.51394,
|
|
"epss_pct": 0.98856,
|
|
"name": "LearnPress <= 4.2.5.7 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6567.yaml"
|
|
},
|
|
"CVE-2023-6568": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01662,
|
|
"epss_pct": 0.75014,
|
|
"name": "Mlflow - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6568.yaml"
|
|
},
|
|
"CVE-2023-6592": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-548",
|
|
"epss": 0.00913,
|
|
"epss_pct": 0.57571,
|
|
"name": "WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6592.yaml"
|
|
},
|
|
"CVE-2023-6623": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.50673,
|
|
"epss_pct": 0.98836,
|
|
"name": "Essential Blocks < 4.4.3 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6623.yaml"
|
|
},
|
|
"CVE-2023-6634": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.08544,
|
|
"epss_pct": 0.94662,
|
|
"name": "LearnPress < 4.2.5.8 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6634.yaml"
|
|
},
|
|
"CVE-2023-6655": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03766,
|
|
"epss_pct": 0.89138,
|
|
"name": "Hongjing e-HR 2020 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6655.yaml"
|
|
},
|
|
"CVE-2023-6697": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0104,
|
|
"epss_pct": 0.61596,
|
|
"name": "WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6697.yaml"
|
|
},
|
|
"CVE-2023-6750": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01961,
|
|
"epss_pct": 0.78911,
|
|
"name": "WordPress WP Clone <= 2.4.2 - Database Backup Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6750.yaml"
|
|
},
|
|
"CVE-2023-6786": {
|
|
"epss": 0.00513,
|
|
"epss_pct": 0.41654,
|
|
"name": "Payment Gateway for Telcell < 2.0.4 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6786.yaml"
|
|
},
|
|
"CVE-2023-6825": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06009,
|
|
"epss_pct": 0.92811,
|
|
"name": "WordPress File Manager <= 7.2.1 - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6825.yaml"
|
|
},
|
|
"CVE-2023-6831": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
|
|
"epss": 0.0329,
|
|
"epss_pct": 0.87611,
|
|
"name": "mlflow - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6831.yaml"
|
|
},
|
|
"CVE-2023-6875": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.90339,
|
|
"epss_pct": 0.99789,
|
|
"name": "WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6875.yaml"
|
|
},
|
|
"CVE-2023-6895": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.89138,
|
|
"epss_pct": 0.99769,
|
|
"name": "Hikvision IP ping.php - Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6895.yaml"
|
|
},
|
|
"CVE-2023-6909": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.89716,
|
|
"epss_pct": 0.99777,
|
|
"name": "Mlflow <2.9.2 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6909.yaml"
|
|
},
|
|
"CVE-2023-6933": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.68047,
|
|
"epss_pct": 0.9927,
|
|
"name": "Better Search Replace < 1.4.5 - PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6933.yaml"
|
|
},
|
|
"CVE-2023-6970": {
|
|
"name": "WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6970.yaml"
|
|
},
|
|
"CVE-2023-6977": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.03924,
|
|
"epss_pct": 0.89601,
|
|
"name": "Mlflow <2.8.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6977.yaml"
|
|
},
|
|
"CVE-2023-6989": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.56567,
|
|
"epss_pct": 0.98986,
|
|
"name": "Shield Security WP Plugin <= 18.5.9 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6989.yaml"
|
|
},
|
|
"CVE-2023-7028": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.94647,
|
|
"epss_pct": 0.99849,
|
|
"name": "GitLab - Account Takeover via Password Reset",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7028.yaml"
|
|
},
|
|
"CVE-2023-7116": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.09026,
|
|
"epss_pct": 0.94902,
|
|
"name": "WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7116.yaml"
|
|
},
|
|
"CVE-2023-7164": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02261,
|
|
"epss_pct": 0.81758,
|
|
"name": "WordPress BackWPup < 4.0.4 - Backup File Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7164.yaml"
|
|
},
|
|
"CVE-2023-7165": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-548",
|
|
"epss": 0.01915,
|
|
"epss_pct": 0.78388,
|
|
"name": "JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7165.yaml"
|
|
},
|
|
"CVE-2023-7246": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00813,
|
|
"epss_pct": 0.54479,
|
|
"name": "System Dashboard < 2.8.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7246.yaml"
|
|
},
|
|
"CVE-2023-7327": {
|
|
"epss": 0.02111,
|
|
"epss_pct": 0.80494,
|
|
"name": "Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7327.yaml"
|
|
},
|
|
"CVE-2023-7337": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01317,
|
|
"epss_pct": 0.68775,
|
|
"name": "JS Help Desk <= 2.8.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7337.yaml"
|
|
},
|
|
"CVE-2024-0012": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.99717,
|
|
"epss_pct": 0.9995,
|
|
"name": "PAN-OS Management Web Interface - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0012.yaml"
|
|
},
|
|
"CVE-2024-0195": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.19403,
|
|
"epss_pct": 0.97163,
|
|
"name": "SpiderFlow Crawler Platform - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0195.yaml"
|
|
},
|
|
"CVE-2024-0200": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-470",
|
|
"epss": 0.71725,
|
|
"epss_pct": 0.99375,
|
|
"name": "Github Enterprise - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0200.yaml"
|
|
},
|
|
"CVE-2024-0204": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.95086,
|
|
"epss_pct": 0.99857,
|
|
"name": "Fortra GoAnywhere MFT - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0204.yaml"
|
|
},
|
|
"CVE-2024-0235": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.37957,
|
|
"epss_pct": 0.98441,
|
|
"name": "EventON (Free < 2.2.8, Premium < 4.5.5) - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0235.yaml"
|
|
},
|
|
"CVE-2024-0250": {
|
|
"epss": 0.01254,
|
|
"epss_pct": 0.6738,
|
|
"name": "Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0250.yaml"
|
|
},
|
|
"CVE-2024-0305": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.66932,
|
|
"epss_pct": 0.99238,
|
|
"name": "Ncast busiFacade - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0305.yaml"
|
|
},
|
|
"CVE-2024-0337": {
|
|
"epss": 0.00891,
|
|
"epss_pct": 0.56919,
|
|
"name": "Travelpayouts <= 1.1.16 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0337.yaml"
|
|
},
|
|
"CVE-2024-0352": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.72917,
|
|
"epss_pct": 0.9941,
|
|
"name": "Likeshop < 2.5.7.20210311 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0352.yaml"
|
|
},
|
|
"CVE-2024-0593": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00909,
|
|
"epss_pct": 0.57486,
|
|
"name": "WordPress Simple Job Board - Unauthorized Data Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0593.yaml"
|
|
},
|
|
"CVE-2024-0692": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.92245,
|
|
"epss_pct": 0.99815,
|
|
"name": "SolarWinds Security Event Manager - Unauthenticated RCE",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0692.yaml"
|
|
},
|
|
"CVE-2024-0705": {
|
|
"name": "Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0705.yaml"
|
|
},
|
|
"CVE-2024-0799": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.04342,
|
|
"epss_pct": 0.90517,
|
|
"name": "Arcserve Unified Data Protection - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0799.yaml"
|
|
},
|
|
"CVE-2024-0801": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-75",
|
|
"epss": 0.41843,
|
|
"epss_pct": 0.98585,
|
|
"name": "Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0801.yaml"
|
|
},
|
|
"CVE-2024-0881": {
|
|
"cwe": "CWE-284",
|
|
"epss": 0.16906,
|
|
"epss_pct": 0.96828,
|
|
"name": "Combo Blocks < 2.2.76 - Improper Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0881.yaml"
|
|
},
|
|
"CVE-2024-0939": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.43777,
|
|
"epss_pct": 0.98648,
|
|
"name": "Smart S210 Management Platform - Arbitary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0939.yaml"
|
|
},
|
|
"CVE-2024-0986": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.58153,
|
|
"epss_pct": 0.99024,
|
|
"name": "Issabel Authenticated - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0986.yaml"
|
|
},
|
|
"CVE-2024-10081": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.39122,
|
|
"epss_pct": 0.98487,
|
|
"name": "CodeChecker <= 6.24.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10081.yaml"
|
|
},
|
|
"CVE-2024-10146": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00585,
|
|
"epss_pct": 0.45618,
|
|
"name": "Simple File List < 6.1.13 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10146.yaml"
|
|
},
|
|
"CVE-2024-10152": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00618,
|
|
"epss_pct": 0.47166,
|
|
"name": "Simple Certain Time to Show Content - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10152.yaml"
|
|
},
|
|
"CVE-2024-1021": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.34713,
|
|
"epss_pct": 0.98307,
|
|
"name": "Rebuild <= 3.5.5 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1021.yaml"
|
|
},
|
|
"CVE-2024-10400": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.8312,
|
|
"epss_pct": 0.99651,
|
|
"name": "Tutor LMS <= 2.7.6 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10400.yaml"
|
|
},
|
|
"CVE-2024-10443": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.28006,
|
|
"epss_pct": 0.97962,
|
|
"name": "Synology BeeStation BST150-4T - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-10443.yaml"
|
|
},
|
|
"CVE-2024-10486": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00861,
|
|
"epss_pct": 0.55997,
|
|
"name": "Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10486.yaml"
|
|
},
|
|
"CVE-2024-10516": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.06479,
|
|
"epss_pct": 0.93257,
|
|
"name": "Swift Performance Lite < 2.3.7.2 - Local PHP File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10516.yaml"
|
|
},
|
|
"CVE-2024-10571": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.04809,
|
|
"epss_pct": 0.91327,
|
|
"name": "Chartify \u2013 WordPress Chart Plugin < 2.9.6 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10571.yaml"
|
|
},
|
|
"CVE-2024-1061": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11215,
|
|
"epss_pct": 0.95642,
|
|
"name": "WordPress HTML5 Video Player - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1061.yaml"
|
|
},
|
|
"CVE-2024-10708": {
|
|
"cvss": 4.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0203,
|
|
"epss_pct": 0.79665,
|
|
"name": "System Dashboard < 2.8.15 - Admin+ Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10708.yaml"
|
|
},
|
|
"CVE-2024-1071": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.89431,
|
|
"epss_pct": 0.99773,
|
|
"name": "WordPress Ultimate Member 2.1.3 - 2.8.2 \u2013 SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1071.yaml"
|
|
},
|
|
"CVE-2024-10763": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.03655,
|
|
"epss_pct": 0.88812,
|
|
"name": "WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10763.yaml"
|
|
},
|
|
"CVE-2024-10783": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02369,
|
|
"epss_pct": 0.82624,
|
|
"name": "WordPress Plugin MainWP Child - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10783.yaml"
|
|
},
|
|
"CVE-2024-10812": {
|
|
"epss": 0.00568,
|
|
"epss_pct": 0.44771,
|
|
"name": "GPT Academic v1.3.9 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10812.yaml"
|
|
},
|
|
"CVE-2024-10908": {
|
|
"epss": 0.00762,
|
|
"epss_pct": 0.52832,
|
|
"name": "FastChat - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10908.yaml"
|
|
},
|
|
"CVE-2024-10914": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-707",
|
|
"epss": 0.96183,
|
|
"epss_pct": 0.99874,
|
|
"name": "D-Link NAS - Command Injection via Name Parameter",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10914.yaml"
|
|
},
|
|
"CVE-2024-10915": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.79407,
|
|
"epss_pct": 0.99572,
|
|
"name": "D-Link NAS - Command Injection via Group Parameter",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10915.yaml"
|
|
},
|
|
"CVE-2024-10924": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.82025,
|
|
"epss_pct": 0.99627,
|
|
"name": "Really Simple Security < 9.1.2 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-10924.yaml"
|
|
},
|
|
"CVE-2024-11044": {
|
|
"epss": 0.00807,
|
|
"epss_pct": 0.54301,
|
|
"name": "Stable Diffusion Webui 1.10.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11044.yaml"
|
|
},
|
|
"CVE-2024-11238": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05747,
|
|
"epss_pct": 0.92526,
|
|
"name": "Landray EKP - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11238.yaml"
|
|
},
|
|
"CVE-2024-11303": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01783,
|
|
"epss_pct": 0.76708,
|
|
"name": "Korenix JetPort 5601v3 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11303.yaml"
|
|
},
|
|
"CVE-2024-11305": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.0367,
|
|
"epss_pct": 0.88857,
|
|
"name": "Altenergy Power Control Software - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11305.yaml"
|
|
},
|
|
"CVE-2024-11320": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.91046,
|
|
"epss_pct": 0.99799,
|
|
"name": "Pandora v7.0NG.777.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11320.yaml"
|
|
},
|
|
"CVE-2024-11396": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-359",
|
|
"epss": 0.02015,
|
|
"epss_pct": 0.79513,
|
|
"name": "Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11396.yaml"
|
|
},
|
|
"CVE-2024-11587": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0091,
|
|
"epss_pct": 0.57489,
|
|
"name": "idcCMS V1.60 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11587.yaml"
|
|
},
|
|
"CVE-2024-11680": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.91458,
|
|
"epss_pct": 0.99804,
|
|
"name": "ProjectSend <= r1605 - Improper Authorization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11680.yaml"
|
|
},
|
|
"CVE-2024-11728": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13515,
|
|
"epss_pct": 0.96169,
|
|
"name": "KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11728.yaml"
|
|
},
|
|
"CVE-2024-11740": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.01888,
|
|
"epss_pct": 0.78063,
|
|
"name": "Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11740.yaml"
|
|
},
|
|
"CVE-2024-1183": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01799,
|
|
"epss_pct": 0.7692,
|
|
"name": "Gradio - Server Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1183.yaml"
|
|
},
|
|
"CVE-2024-11868": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.01131,
|
|
"epss_pct": 0.6415,
|
|
"name": "LearnPress < 4.2.7.4 - Course Material - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11868.yaml"
|
|
},
|
|
"CVE-2024-11921": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00803,
|
|
"epss_pct": 0.54151,
|
|
"name": "Give WP Plugin < 3.19.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11921.yaml"
|
|
},
|
|
"CVE-2024-11972": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.54475,
|
|
"epss_pct": 0.98938,
|
|
"name": "Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11972.yaml"
|
|
},
|
|
"CVE-2024-12008": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.02269,
|
|
"epss_pct": 0.81821,
|
|
"name": "W3 Total Cache < 2.8.2 - Log File Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12008.yaml"
|
|
},
|
|
"CVE-2024-12025": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02572,
|
|
"epss_pct": 0.84056,
|
|
"name": "WordPress Collapsing Categories <= 3.0.8 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12025.yaml"
|
|
},
|
|
"CVE-2024-1208": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.05285,
|
|
"epss_pct": 0.91993,
|
|
"name": "LearnDash LMS < 4.10.3 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1208.yaml"
|
|
},
|
|
"CVE-2024-1209": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.02419,
|
|
"epss_pct": 0.82999,
|
|
"name": "LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1209.yaml"
|
|
},
|
|
"CVE-2024-1210": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.02027,
|
|
"epss_pct": 0.79638,
|
|
"name": "LearnDash LMS < 4.10.2 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1210.yaml"
|
|
},
|
|
"CVE-2024-1212": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.95388,
|
|
"epss_pct": 0.99862,
|
|
"name": "Progress Kemp LoadMaster - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1212.yaml"
|
|
},
|
|
"CVE-2024-12209": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.23364,
|
|
"epss_pct": 0.97616,
|
|
"name": "WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12209.yaml"
|
|
},
|
|
"CVE-2024-12356": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.87991,
|
|
"epss_pct": 0.99753,
|
|
"name": "Privileged Remote Access & Remote Support - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-12356.yaml"
|
|
},
|
|
"CVE-2024-12585": {
|
|
"name": "PropertyHive < 2.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12585.yaml"
|
|
},
|
|
"CVE-2024-12638": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00548,
|
|
"epss_pct": 0.43704,
|
|
"name": "Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12638.yaml"
|
|
},
|
|
"CVE-2024-12724": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00573,
|
|
"epss_pct": 0.45008,
|
|
"name": "WP DeskLite - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12724.yaml"
|
|
},
|
|
"CVE-2024-12732": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00573,
|
|
"epss_pct": 0.45008,
|
|
"name": "AffiliateImporterEb <= 1.0.6 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12732.yaml"
|
|
},
|
|
"CVE-2024-12734": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00573,
|
|
"epss_pct": 0.45008,
|
|
"name": "Advance Post Prefix WordPress plugin - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12734.yaml"
|
|
},
|
|
"CVE-2024-12737": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00589,
|
|
"epss_pct": 0.45809,
|
|
"name": "WP BASE Booking - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12737.yaml"
|
|
},
|
|
"CVE-2024-12749": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00582,
|
|
"epss_pct": 0.45475,
|
|
"name": "WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12749.yaml"
|
|
},
|
|
"CVE-2024-12824": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-620",
|
|
"epss": 0.02303,
|
|
"epss_pct": 0.82112,
|
|
"name": "Nokri \u2013 Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12824.yaml"
|
|
},
|
|
"CVE-2024-12849": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.46858,
|
|
"epss_pct": 0.9874,
|
|
"name": "Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12849.yaml"
|
|
},
|
|
"CVE-2024-12873": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00583,
|
|
"epss_pct": 0.4548,
|
|
"name": "Custom Field Manager WordPress - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12873.yaml"
|
|
},
|
|
"CVE-2024-12878": {
|
|
"name": "Lazy Blocks <= 3.8.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12878.yaml"
|
|
},
|
|
"CVE-2024-12987": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.98084,
|
|
"epss_pct": 0.99908,
|
|
"name": "DrayTek Vigor - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-12987.yaml"
|
|
},
|
|
"CVE-2024-13055": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00537,
|
|
"epss_pct": 0.43106,
|
|
"name": "Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13055.yaml"
|
|
},
|
|
"CVE-2024-13094": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00571,
|
|
"epss_pct": 0.44916,
|
|
"name": "WP Triggers Lite - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13094.yaml"
|
|
},
|
|
"CVE-2024-13097": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00693,
|
|
"epss_pct": 0.50409,
|
|
"name": "WP Finance Plugin <= 1.3.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13097.yaml"
|
|
},
|
|
"CVE-2024-13098": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00708,
|
|
"epss_pct": 0.50951,
|
|
"name": "WordPress Email Newsletter - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13098.yaml"
|
|
},
|
|
"CVE-2024-13099": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00693,
|
|
"epss_pct": 0.50409,
|
|
"name": "Widget4Call WordPress - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13099.yaml"
|
|
},
|
|
"CVE-2024-13112": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00594,
|
|
"epss_pct": 0.45995,
|
|
"name": "WP MediaTagger <= 4.1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13112.yaml"
|
|
},
|
|
"CVE-2024-13114": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45547,
|
|
"name": "WP Projects Portfolio <= 3.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13114.yaml"
|
|
},
|
|
"CVE-2024-13126": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.00465,
|
|
"epss_pct": 0.38471,
|
|
"name": "WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13126.yaml"
|
|
},
|
|
"CVE-2024-13159": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-36",
|
|
"epss": 0.99992,
|
|
"epss_pct": 0.99986,
|
|
"name": "Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13159.yaml"
|
|
},
|
|
"CVE-2024-13160": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-36",
|
|
"epss": 0.91247,
|
|
"epss_pct": 0.99801,
|
|
"name": "Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13160.yaml"
|
|
},
|
|
"CVE-2024-13161": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-36",
|
|
"epss": 0.90081,
|
|
"epss_pct": 0.99786,
|
|
"name": "Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13161.yaml"
|
|
},
|
|
"CVE-2024-13219": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00581,
|
|
"epss_pct": 0.45425,
|
|
"name": "Privacy Policy Genius - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13219.yaml"
|
|
},
|
|
"CVE-2024-13220": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00581,
|
|
"epss_pct": 0.45425,
|
|
"name": "WordPress Google Map Professional - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13220.yaml"
|
|
},
|
|
"CVE-2024-13221": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00594,
|
|
"epss_pct": 0.45995,
|
|
"name": "Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13221.yaml"
|
|
},
|
|
"CVE-2024-13222": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45545,
|
|
"name": "WordPress User Messages <= 1.2.4 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13222.yaml"
|
|
},
|
|
"CVE-2024-13224": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00594,
|
|
"epss_pct": 0.45994,
|
|
"name": "SlideDeck 1 Lite Content Slider - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13224.yaml"
|
|
},
|
|
"CVE-2024-13225": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00594,
|
|
"epss_pct": 0.45995,
|
|
"name": "ECT Home Page Products - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13225.yaml"
|
|
},
|
|
"CVE-2024-13226": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00594,
|
|
"epss_pct": 0.45995,
|
|
"name": "A5 Custom Login Page - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13226.yaml"
|
|
},
|
|
"CVE-2024-13322": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01735,
|
|
"epss_pct": 0.76041,
|
|
"name": "Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13322.yaml"
|
|
},
|
|
"CVE-2024-13325": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45546,
|
|
"name": "Glossy WordPress - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13325.yaml"
|
|
},
|
|
"CVE-2024-13326": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45546,
|
|
"name": "iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13326.yaml"
|
|
},
|
|
"CVE-2024-13327": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45546,
|
|
"name": "Musicbox WordPress - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13327.yaml"
|
|
},
|
|
"CVE-2024-13328": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45545,
|
|
"name": "Giga Messenger WordPress - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13328.yaml"
|
|
},
|
|
"CVE-2024-13330": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00573,
|
|
"epss_pct": 0.45002,
|
|
"name": "JustRows WordPress - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13330.yaml"
|
|
},
|
|
"CVE-2024-13331": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00584,
|
|
"epss_pct": 0.45546,
|
|
"name": "WP Dream Carousel < 1.0.1b - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13331.yaml"
|
|
},
|
|
"CVE-2024-13352": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0055,
|
|
"epss_pct": 0.43852,
|
|
"name": "Legull WordPress - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13352.yaml"
|
|
},
|
|
"CVE-2024-13492": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00573,
|
|
"epss_pct": 0.45011,
|
|
"name": "Guten Free Options - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13492.yaml"
|
|
},
|
|
"CVE-2024-13496": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02231,
|
|
"epss_pct": 0.81522,
|
|
"name": "GamiPress <= 2.8.9 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13496.yaml"
|
|
},
|
|
"CVE-2024-13543": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00576,
|
|
"epss_pct": 0.45141,
|
|
"name": "Zarinpal Paid Download - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13543.yaml"
|
|
},
|
|
"CVE-2024-13569": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00533,
|
|
"epss_pct": 0.42901,
|
|
"name": "WordPress Front End Users - Reflected XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13569.yaml"
|
|
},
|
|
"CVE-2024-13570": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00576,
|
|
"epss_pct": 0.45141,
|
|
"name": "WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13570.yaml"
|
|
},
|
|
"CVE-2024-13609": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01607,
|
|
"epss_pct": 0.7417,
|
|
"name": "WordPress 1 Click Migration Plugin < 2.3 - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13609.yaml"
|
|
},
|
|
"CVE-2024-13619": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00573,
|
|
"epss_pct": 0.45009,
|
|
"name": "LifterLMS < 8.0.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13619.yaml"
|
|
},
|
|
"CVE-2024-13624": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00668,
|
|
"epss_pct": 0.49379,
|
|
"name": "WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13624.yaml"
|
|
},
|
|
"CVE-2024-13625": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00562,
|
|
"epss_pct": 0.44463,
|
|
"name": "Tube Video Ads Lite - Reflected XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13625.yaml"
|
|
},
|
|
"CVE-2024-13627": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00821,
|
|
"epss_pct": 0.54758,
|
|
"name": "OWL Carousel Slider - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13627.yaml"
|
|
},
|
|
"CVE-2024-13628": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0064,
|
|
"epss_pct": 0.48173,
|
|
"name": "WP Pricing Table - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13628.yaml"
|
|
},
|
|
"CVE-2024-13630": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00589,
|
|
"epss_pct": 0.45808,
|
|
"name": "NewsTicker <= 1.0 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13630.yaml"
|
|
},
|
|
"CVE-2024-13634": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00609,
|
|
"epss_pct": 0.46714,
|
|
"name": "Post Sync Plugin <= 1.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13634.yaml"
|
|
},
|
|
"CVE-2024-13726": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01948,
|
|
"epss_pct": 0.78774,
|
|
"name": "Themes Coder Ecommerce <= 1.3.4 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13726.yaml"
|
|
},
|
|
"CVE-2024-13727": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0062,
|
|
"epss_pct": 0.47252,
|
|
"name": "MemberSpace WordPress - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13727.yaml"
|
|
},
|
|
"CVE-2024-1380": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.50192,
|
|
"epss_pct": 0.98821,
|
|
"name": "Relevanssi (A Better Search) <= 4.22.0 - Query Log Export",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1380.yaml"
|
|
},
|
|
"CVE-2024-13853": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.006,
|
|
"epss_pct": 0.46327,
|
|
"name": "WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13853.yaml"
|
|
},
|
|
"CVE-2024-13888": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00745,
|
|
"epss_pct": 0.52242,
|
|
"name": "WPMobile.App <= 11.56 - Open Redirect",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13888.yaml"
|
|
},
|
|
"CVE-2024-13979": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03106,
|
|
"epss_pct": 0.86841,
|
|
"name": "St. Joe ERP system - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13979.yaml"
|
|
},
|
|
"CVE-2024-13985": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.14607,
|
|
"epss_pct": 0.96397,
|
|
"name": "Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13985.yaml"
|
|
},
|
|
"CVE-2024-14015": {
|
|
"name": "Studiocart <= 2.9.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-14015.yaml"
|
|
},
|
|
"CVE-2024-1483": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.02718,
|
|
"epss_pct": 0.84975,
|
|
"name": "Mlflow < 2.9.2 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1483.yaml"
|
|
},
|
|
"CVE-2024-1512": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.77729,
|
|
"epss_pct": 0.99531,
|
|
"name": "MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1512.yaml"
|
|
},
|
|
"CVE-2024-1561": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.09314,
|
|
"epss_pct": 0.95011,
|
|
"name": "Gradio 4.3-4.12 - Local File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1561.yaml"
|
|
},
|
|
"CVE-2024-1698": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.77585,
|
|
"epss_pct": 0.99526,
|
|
"name": "NotificationX <= 2.8.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1698.yaml"
|
|
},
|
|
"CVE-2024-1708": {
|
|
"cvss": 8.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.9549,
|
|
"epss_pct": 0.99864,
|
|
"name": "ConnectWise ScreenConnect <= 23.9.7 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1708.yaml"
|
|
},
|
|
"CVE-2024-1709": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.9998,
|
|
"epss_pct": 0.9998,
|
|
"name": "ConnectWise ScreenConnect 23.9.7 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1709.yaml"
|
|
},
|
|
"CVE-2024-1728": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.85393,
|
|
"epss_pct": 0.99703,
|
|
"name": "Gradio > 4.19.1 UploadButton - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1728.yaml"
|
|
},
|
|
"CVE-2024-1751": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03109,
|
|
"epss_pct": 0.86854,
|
|
"name": "Tutor LMS <= 2.1.10 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1751.yaml"
|
|
},
|
|
"CVE-2024-20404": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.22644,
|
|
"epss_pct": 0.97552,
|
|
"name": "Cisco Finesse - Server-Side Request Forgery (SSRF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20404.yaml"
|
|
},
|
|
"CVE-2024-20419": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-620",
|
|
"epss": 0.80635,
|
|
"epss_pct": 0.99595,
|
|
"name": "Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20419.yaml"
|
|
},
|
|
"CVE-2024-20439": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-912",
|
|
"epss": 0.92062,
|
|
"epss_pct": 0.99812,
|
|
"name": "Hardcoded Admin Credentials For Cisco Smart Licensing Utility API",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20439.yaml"
|
|
},
|
|
"CVE-2024-20440": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.51897,
|
|
"epss_pct": 0.98867,
|
|
"name": "Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20440.yaml"
|
|
},
|
|
"CVE-2024-2053": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.44579,
|
|
"epss_pct": 0.98675,
|
|
"name": "Artica Proxy - Unauthenticated LFI",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2053.yaml"
|
|
},
|
|
"CVE-2024-20767": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.98514,
|
|
"epss_pct": 0.99916,
|
|
"name": "Adobe ColdFusion - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20767.yaml"
|
|
},
|
|
"CVE-2024-21136": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"epss": 0.01783,
|
|
"epss_pct": 0.76701,
|
|
"name": "Oracle Retail Xstore Suite - Pre-authenticated Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21136.yaml"
|
|
},
|
|
"CVE-2024-21485": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01487,
|
|
"epss_pct": 0.7222,
|
|
"name": "Dash Framework - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21485.yaml"
|
|
},
|
|
"CVE-2024-21633": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0132,
|
|
"epss_pct": 0.6885,
|
|
"name": "MobSF - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21633.yaml"
|
|
},
|
|
"CVE-2024-21641": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01067,
|
|
"epss_pct": 0.62405,
|
|
"name": "Flarum < 1.8.5 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21641.yaml"
|
|
},
|
|
"CVE-2024-21644": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.42443,
|
|
"epss_pct": 0.98604,
|
|
"name": "pyLoad Flask Config - Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21644.yaml"
|
|
},
|
|
"CVE-2024-21645": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.24698,
|
|
"epss_pct": 0.97731,
|
|
"name": "pyload - Log Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21645.yaml"
|
|
},
|
|
"CVE-2024-21650": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-95",
|
|
"epss": 0.9348,
|
|
"epss_pct": 0.99833,
|
|
"name": "XWiki < 4.10.20 - Remote code execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21650.yaml"
|
|
},
|
|
"CVE-2024-21683": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.88267,
|
|
"epss_pct": 0.99758,
|
|
"name": "Atlassian Confluence Data Center and Server - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21683.yaml"
|
|
},
|
|
"CVE-2024-21887": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99999,
|
|
"epss_pct": 1.0,
|
|
"name": "Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21887.yaml"
|
|
},
|
|
"CVE-2024-21893": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99999,
|
|
"name": "Ivanti SAML - Server Side Request Forgery (SSRF)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21893.yaml"
|
|
},
|
|
"CVE-2024-22024": {
|
|
"epss": 0.94721,
|
|
"epss_pct": 0.99852,
|
|
"name": "Ivanti Connect Secure - XXE",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22024.yaml"
|
|
},
|
|
"CVE-2024-22120": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.76618,
|
|
"epss_pct": 0.99505,
|
|
"name": "Zabbix Server - Time-Based Blind SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-22120.yaml"
|
|
},
|
|
"CVE-2024-22207": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.0229,
|
|
"epss_pct": 0.82007,
|
|
"name": "Fastify Swagger-UI - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22207.yaml"
|
|
},
|
|
"CVE-2024-22319": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.764,
|
|
"epss_pct": 0.99501,
|
|
"name": "IBM Operational Decision Manager - JNDI Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22319.yaml"
|
|
},
|
|
"CVE-2024-22320": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.73398,
|
|
"epss_pct": 0.99424,
|
|
"name": "IBM Operational Decision Manager - Java Deserialization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22320.yaml"
|
|
},
|
|
"CVE-2024-22476": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.35723,
|
|
"epss_pct": 0.98346,
|
|
"name": "Intel Neural Compressor <2.5.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22476.yaml"
|
|
},
|
|
"CVE-2024-22729": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.70779,
|
|
"epss_pct": 0.9935,
|
|
"name": "Netis MW5360 V1.0.1.3031 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22729.yaml"
|
|
},
|
|
"CVE-2024-22927": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01028,
|
|
"epss_pct": 0.6122,
|
|
"name": "eyoucms v.1.6.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22927.yaml"
|
|
},
|
|
"CVE-2024-23055": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00918,
|
|
"epss_pct": 0.57754,
|
|
"name": "Plone Docker - Host Header Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23055.yaml"
|
|
},
|
|
"CVE-2024-23108": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.78375,
|
|
"epss_pct": 0.99548,
|
|
"name": "Fortinet FortiSIEM - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-23108.yaml"
|
|
},
|
|
"CVE-2024-2330": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.17622,
|
|
"epss_pct": 0.96926,
|
|
"name": "NS-ASG Application Security Gateway 6.3 - Sql Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2330.yaml"
|
|
},
|
|
"CVE-2024-23334": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.76875,
|
|
"epss_pct": 0.99511,
|
|
"name": "aiohttp - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23334.yaml"
|
|
},
|
|
"CVE-2024-2340": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.27997,
|
|
"epss_pct": 0.97962,
|
|
"name": "Avada < 7.11.7 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2340.yaml"
|
|
},
|
|
"CVE-2024-23692": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1336",
|
|
"epss": 0.99471,
|
|
"epss_pct": 0.99941,
|
|
"name": "Rejetto HTTP File Server - Template injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23692.yaml"
|
|
},
|
|
"CVE-2024-2389": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.93037,
|
|
"epss_pct": 0.99824,
|
|
"name": "Progress Kemp Flowmon - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2389.yaml"
|
|
},
|
|
"CVE-2024-23897": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.99999,
|
|
"epss_pct": 0.99995,
|
|
"name": "Jenkins < 2.441 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-23897.yaml"
|
|
},
|
|
"CVE-2024-23917": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.5373,
|
|
"epss_pct": 0.98921,
|
|
"name": "JetBrains TeamCity > 2023.11.3 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23917.yaml"
|
|
},
|
|
"CVE-2024-24112": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03348,
|
|
"epss_pct": 0.87819,
|
|
"name": "Exrick XMall - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24112.yaml"
|
|
},
|
|
"CVE-2024-24116": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.28411,
|
|
"epss_pct": 0.97985,
|
|
"name": "Ruijie RG-NBS2009G-P - Improper Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24116.yaml"
|
|
},
|
|
"CVE-2024-24131": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00924,
|
|
"epss_pct": 0.57917,
|
|
"name": "SuperWebMailer 9.31.0.01799 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24131.yaml"
|
|
},
|
|
"CVE-2024-24328": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.06172,
|
|
"epss_pct": 0.92978,
|
|
"name": "TotoLink Router setMacFilterRules - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24328.yaml"
|
|
},
|
|
"CVE-2024-24329": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.06172,
|
|
"epss_pct": 0.92978,
|
|
"name": "TotoLink Router setPortForwardRules - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24329.yaml"
|
|
},
|
|
"CVE-2024-24565": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03084,
|
|
"epss_pct": 0.8676,
|
|
"name": "CrateDB Database - Arbitrary File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24565.yaml"
|
|
},
|
|
"CVE-2024-2473": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01235,
|
|
"epss_pct": 0.66939,
|
|
"name": "WPS Hide Login <= 1.9.15.2 - Login Page Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2473.yaml"
|
|
},
|
|
"CVE-2024-24759": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.04936,
|
|
"epss_pct": 0.91524,
|
|
"name": "MindsDB -DNS Rebinding SSRF Protection Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24759.yaml"
|
|
},
|
|
"CVE-2024-24763": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01057,
|
|
"epss_pct": 0.62063,
|
|
"name": "JumpServer < 3.10.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24763.yaml"
|
|
},
|
|
"CVE-2024-24809": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
|
|
"cwe": "CWE-27",
|
|
"epss": 0.54413,
|
|
"epss_pct": 0.98936,
|
|
"name": "Traccar - Unrestricted File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24809.yaml"
|
|
},
|
|
"CVE-2024-24882": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.02094,
|
|
"epss_pct": 0.80335,
|
|
"name": "Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24882.yaml"
|
|
},
|
|
"CVE-2024-24919": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.99978,
|
|
"epss_pct": 0.99979,
|
|
"name": "Check Point Quantum Gateway - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24919.yaml"
|
|
},
|
|
"CVE-2024-25600": {
|
|
"epss": 0.88234,
|
|
"epss_pct": 0.99756,
|
|
"name": "Unauthenticated Remote Code Execution \u2013 Bricks <= 1.9.6",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25600.yaml"
|
|
},
|
|
"CVE-2024-25608": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0096,
|
|
"epss_pct": 0.59068,
|
|
"name": "Liferay Portal - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25608.yaml"
|
|
},
|
|
"CVE-2024-25723": {
|
|
"epss": 0.70785,
|
|
"epss_pct": 0.9935,
|
|
"name": "ZenML ZenML Server - Improper Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25723.yaml"
|
|
},
|
|
"CVE-2024-25735": {
|
|
"epss": 0.50622,
|
|
"epss_pct": 0.98833,
|
|
"name": "WyreStorm Apollo VX20 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25735.yaml"
|
|
},
|
|
"CVE-2024-25852": {
|
|
"epss": 0.16519,
|
|
"epss_pct": 0.96765,
|
|
"name": "Linksys RE7000 - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25852.yaml"
|
|
},
|
|
"CVE-2024-2621": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.0194,
|
|
"epss_pct": 0.78688,
|
|
"name": "Fujian Kelixin Communication - Command Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2621.yaml"
|
|
},
|
|
"CVE-2024-26291": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.01083,
|
|
"epss_pct": 0.62825,
|
|
"name": "Avid NEXIS Agent - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-26291.yaml"
|
|
},
|
|
"CVE-2024-26331": {
|
|
"epss": 0.51284,
|
|
"epss_pct": 0.98853,
|
|
"name": "ReCrystallize Server - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-26331.yaml"
|
|
},
|
|
"CVE-2024-2667": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.05794,
|
|
"epss_pct": 0.92582,
|
|
"name": "InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2667.yaml"
|
|
},
|
|
"CVE-2024-27115": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:I/V:C/RE:M/U:Red",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.0459,
|
|
"epss_pct": 0.90981,
|
|
"name": "SOPlanning - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27115.yaml"
|
|
},
|
|
"CVE-2024-27198": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.99938,
|
|
"epss_pct": 0.9997,
|
|
"name": "TeamCity < 2023.11.4 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27198.yaml"
|
|
},
|
|
"CVE-2024-27199": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.99991,
|
|
"epss_pct": 0.99985,
|
|
"name": "TeamCity < 2023.11.4 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27199.yaml"
|
|
},
|
|
"CVE-2024-27292": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-706",
|
|
"epss": 0.69486,
|
|
"epss_pct": 0.9931,
|
|
"name": "Docassemble - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27292.yaml"
|
|
},
|
|
"CVE-2024-27348": {
|
|
"cwe": "CWE-77",
|
|
"epss": 0.9921,
|
|
"epss_pct": 0.99933,
|
|
"name": "Apache HugeGraph-Server - Remote Command Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27348.yaml"
|
|
},
|
|
"CVE-2024-27443": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.23632,
|
|
"epss_pct": 0.97639,
|
|
"name": "Zimbra Collaboration - Cross-Site Scripting (XSS)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27443.yaml"
|
|
},
|
|
"CVE-2024-27497": {
|
|
"epss": 0.26657,
|
|
"epss_pct": 0.97874,
|
|
"name": "Linksys E2000 1.0.06 position.js Improper Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27497.yaml"
|
|
},
|
|
"CVE-2024-27564": {
|
|
"epss": 0.40637,
|
|
"epss_pct": 0.98548,
|
|
"name": "ChatGPT\u4e2a\u4eba\u4e13\u7528\u7248 - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27564.yaml"
|
|
},
|
|
"CVE-2024-2771": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02333,
|
|
"epss_pct": 0.82349,
|
|
"name": "Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2771.yaml"
|
|
},
|
|
"CVE-2024-27718": {
|
|
"epss": 0.01101,
|
|
"epss_pct": 0.6336,
|
|
"name": "Smart s200 Management Platform v.S200 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27718.yaml"
|
|
},
|
|
"CVE-2024-2782": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.0123,
|
|
"epss_pct": 0.66818,
|
|
"name": "WordPress FluentForms <= 5.1.16 - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2782.yaml"
|
|
},
|
|
"CVE-2024-27954": {
|
|
"cvss": 9.8,
|
|
"cwe": "CWE-918",
|
|
"epss": 0.72953,
|
|
"epss_pct": 0.99411,
|
|
"name": "WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27954.yaml"
|
|
},
|
|
"CVE-2024-27956": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.93971,
|
|
"epss_pct": 0.99838,
|
|
"name": "WordPress Automatic Plugin <= 3.92.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27956.yaml"
|
|
},
|
|
"CVE-2024-28000": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.68266,
|
|
"epss_pct": 0.99276,
|
|
"name": "WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28000.yaml"
|
|
},
|
|
"CVE-2024-28200": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.01946,
|
|
"epss_pct": 0.78744,
|
|
"name": "N-able N-central < 2024.2 - Authentication Bypass Detection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28200.yaml"
|
|
},
|
|
"CVE-2024-28253": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.12527,
|
|
"epss_pct": 0.95936,
|
|
"name": "OpenMetaData - SpEL Injection in PUT /api/v1/policies",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28253.yaml"
|
|
},
|
|
"CVE-2024-28255": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.73255,
|
|
"epss_pct": 0.99418,
|
|
"name": "OpenMetadata - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28255.yaml"
|
|
},
|
|
"CVE-2024-28397": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.04548,
|
|
"epss_pct": 0.9091,
|
|
"name": "pyload-ng js2py - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28397.yaml"
|
|
},
|
|
"CVE-2024-2862": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-640",
|
|
"epss": 0.51001,
|
|
"epss_pct": 0.98845,
|
|
"name": "LG LED Assistant - Unauthenticated Password Reset",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2862.yaml"
|
|
},
|
|
"CVE-2024-28623": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01317,
|
|
"epss_pct": 0.68786,
|
|
"name": "RiteCMS 3.0.0 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28623.yaml"
|
|
},
|
|
"CVE-2024-2863": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.63999,
|
|
"epss_pct": 0.99163,
|
|
"name": "LG LED Assistant - Thumbnail Path Traversal File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2863.yaml"
|
|
},
|
|
"CVE-2024-28734": {
|
|
"epss": 0.01791,
|
|
"epss_pct": 0.76802,
|
|
"name": "Coda v.2024Q1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28734.yaml"
|
|
},
|
|
"CVE-2024-2876": {
|
|
"epss": 0.80596,
|
|
"epss_pct": 0.99594,
|
|
"name": "Wordpress Email Subscribers by Icegram Express - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2876.yaml"
|
|
},
|
|
"CVE-2024-2879": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.18402,
|
|
"epss_pct": 0.97023,
|
|
"name": "WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2879.yaml"
|
|
},
|
|
"CVE-2024-28986": {
|
|
"cvss": 9.8,
|
|
"cwe": "CWE-502",
|
|
"name": "SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28986.yaml"
|
|
},
|
|
"CVE-2024-28987": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.93208,
|
|
"epss_pct": 0.99827,
|
|
"name": "SolarWinds Web Help Desk - Hardcoded Credential",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28987.yaml"
|
|
},
|
|
"CVE-2024-28995": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99614,
|
|
"epss_pct": 0.99946,
|
|
"name": "SolarWinds Serv-U - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28995.yaml"
|
|
},
|
|
"CVE-2024-29028": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01049,
|
|
"epss_pct": 0.61848,
|
|
"name": "Memos 0.13.2 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29028.yaml"
|
|
},
|
|
"CVE-2024-29029": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"name": "Memos 0.13.2 - Cross-Site Scripting & SSRF",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29029.yaml"
|
|
},
|
|
"CVE-2024-29030": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"name": "Memos 0.13.2 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29030.yaml"
|
|
},
|
|
"CVE-2024-29059": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.98624,
|
|
"epss_pct": 0.99921,
|
|
"name": ".NET Framework - Leaking ObjRefs via HTTP .NET Remoting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29059.yaml"
|
|
},
|
|
"CVE-2024-29137": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00617,
|
|
"epss_pct": 0.47108,
|
|
"name": "WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29137.yaml"
|
|
},
|
|
"CVE-2024-29138": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00617,
|
|
"epss_pct": 0.47108,
|
|
"name": "WordPress Restrict User Access <= 2.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29138.yaml"
|
|
},
|
|
"CVE-2024-29198": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02199,
|
|
"epss_pct": 0.81263,
|
|
"name": "GeoServer Demo Request Endpoint - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29198.yaml"
|
|
},
|
|
"CVE-2024-29269": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.06294,
|
|
"epss_pct": 0.93096,
|
|
"name": "Telesquare TLR-2005KSH - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29269.yaml"
|
|
},
|
|
"CVE-2024-29272": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.09366,
|
|
"epss_pct": 0.95032,
|
|
"name": "VvvebJs < 1.7.5 - Arbitrary File Upload",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29272.yaml"
|
|
},
|
|
"CVE-2024-2928": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.21847,
|
|
"epss_pct": 0.9747,
|
|
"name": "MLflow < 2.11.3 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2928.yaml"
|
|
},
|
|
"CVE-2024-2961": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
|
|
"cwe": "CWE-787",
|
|
"epss": 0.8833,
|
|
"epss_pct": 0.99758,
|
|
"name": "PHP - LFR to Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2024/CVE-2024-2961.yaml"
|
|
},
|
|
"CVE-2024-29792": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0074,
|
|
"epss_pct": 0.52094,
|
|
"name": "Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29792.yaml"
|
|
},
|
|
"CVE-2024-29824": {
|
|
"cvss": 9.6,
|
|
"cvss_vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99951,
|
|
"epss_pct": 0.99974,
|
|
"name": "Ivanti EPM - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29824.yaml"
|
|
},
|
|
"CVE-2024-29868": {
|
|
"cwe": "CWE-338",
|
|
"epss": 0.05995,
|
|
"epss_pct": 0.92799,
|
|
"name": "Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29868.yaml"
|
|
},
|
|
"CVE-2024-29882": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01086,
|
|
"epss_pct": 0.62914,
|
|
"name": "HTTP API DOM - XSS on JSONP callback",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2024/CVE-2024-29882.yaml"
|
|
},
|
|
"CVE-2024-29889": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.6296,
|
|
"epss_pct": 0.99137,
|
|
"name": "GLPI 10.0.10-10.0.14 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29889.yaml"
|
|
},
|
|
"CVE-2024-29895": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.98455,
|
|
"epss_pct": 0.99916,
|
|
"name": "Cacti cmd_realtime.php - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29895.yaml"
|
|
},
|
|
"CVE-2024-29931": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00753,
|
|
"epss_pct": 0.52514,
|
|
"name": "WP Go Maps <= 9.0.29 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29931.yaml"
|
|
},
|
|
"CVE-2024-29972": {
|
|
"cvss": 9.88,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.89326,
|
|
"epss_pct": 0.9977,
|
|
"name": "Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29972.yaml"
|
|
},
|
|
"CVE-2024-29973": {
|
|
"cvss": 9.88,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.86089,
|
|
"epss_pct": 0.99715,
|
|
"name": "Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29973.yaml"
|
|
},
|
|
"CVE-2024-30163": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.08676,
|
|
"epss_pct": 0.94735,
|
|
"name": "IPS Community Suite - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30163.yaml"
|
|
},
|
|
"CVE-2024-30188": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"epss": 0.05987,
|
|
"epss_pct": 0.9279,
|
|
"name": "Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30188.yaml"
|
|
},
|
|
"CVE-2024-30194": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00721,
|
|
"epss_pct": 0.51414,
|
|
"name": "Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30194.yaml"
|
|
},
|
|
"CVE-2024-30269": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.15875,
|
|
"epss_pct": 0.96644,
|
|
"name": "DataEase <= 2.4.1 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30269.yaml"
|
|
},
|
|
"CVE-2024-3032": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00816,
|
|
"epss_pct": 0.54577,
|
|
"name": "WordPress Themify Builder < 7.5.8 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3032.yaml"
|
|
},
|
|
"CVE-2024-30464": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01504,
|
|
"epss_pct": 0.72525,
|
|
"name": "WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30464.yaml"
|
|
},
|
|
"CVE-2024-30490": {
|
|
"name": "ProfileGrid <= 5.7.8 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30490.yaml"
|
|
},
|
|
"CVE-2024-30498": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02248,
|
|
"epss_pct": 0.81663,
|
|
"name": "CRM Perks Forms <= 1.1.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30498.yaml"
|
|
},
|
|
"CVE-2024-30502": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02248,
|
|
"epss_pct": 0.81662,
|
|
"name": "WP Travel Engine <= 5.7.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30502.yaml"
|
|
},
|
|
"CVE-2024-30568": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.46918,
|
|
"epss_pct": 0.98741,
|
|
"name": "Netgear R6850 V1.1.0.88 - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30568.yaml"
|
|
},
|
|
"CVE-2024-30569": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01907,
|
|
"epss_pct": 0.78291,
|
|
"name": "Netgear R6850 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30569.yaml"
|
|
},
|
|
"CVE-2024-30570": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01221,
|
|
"epss_pct": 0.6657,
|
|
"name": "Netgear R6850 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30570.yaml"
|
|
},
|
|
"CVE-2024-3080": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.43456,
|
|
"epss_pct": 0.98642,
|
|
"name": "ASUS DSL-AC88U - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3080.yaml"
|
|
},
|
|
"CVE-2024-3094": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-506",
|
|
"epss": 0.85974,
|
|
"epss_pct": 0.99714,
|
|
"name": "XZ - Embedded Malicious Code",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-3094.yaml"
|
|
},
|
|
"CVE-2024-3097": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.38023,
|
|
"epss_pct": 0.98445,
|
|
"name": "NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3097.yaml"
|
|
},
|
|
"CVE-2024-31223": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-497",
|
|
"epss": 0.01105,
|
|
"epss_pct": 0.63461,
|
|
"name": "Fides Privacy Center \u2264 2.39.1 - Server-Side URL Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31223.yaml"
|
|
},
|
|
"CVE-2024-3136": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.05018,
|
|
"epss_pct": 0.91643,
|
|
"name": "MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3136.yaml"
|
|
},
|
|
"CVE-2024-31621": {
|
|
"cvss": 7.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.59867,
|
|
"epss_pct": 0.99064,
|
|
"name": "Flowise 1.6.5 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31621.yaml"
|
|
},
|
|
"CVE-2024-31750": {
|
|
"epss": 0.1927,
|
|
"epss_pct": 0.97141,
|
|
"name": "F-logic DataCube3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31750.yaml"
|
|
},
|
|
"CVE-2024-31839": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.08038,
|
|
"epss_pct": 0.9437,
|
|
"name": "CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31839.yaml"
|
|
},
|
|
"CVE-2024-31848": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.08086,
|
|
"epss_pct": 0.94399,
|
|
"name": "CData API Server < 23.4.8844 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31848.yaml"
|
|
},
|
|
"CVE-2024-31849": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06076,
|
|
"epss_pct": 0.92883,
|
|
"name": "CData Connect < 23.4.8846 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31849.yaml"
|
|
},
|
|
"CVE-2024-31850": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03037,
|
|
"epss_pct": 0.8657,
|
|
"name": "CData Arc < 23.4.8839 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31850.yaml"
|
|
},
|
|
"CVE-2024-31851": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02885,
|
|
"epss_pct": 0.85891,
|
|
"name": "CData Sync < 23.4.8843 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31851.yaml"
|
|
},
|
|
"CVE-2024-31982": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-95",
|
|
"epss": 0.3428,
|
|
"epss_pct": 0.98288,
|
|
"name": "XWiki < 4.10.20 - Remote code execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31982.yaml"
|
|
},
|
|
"CVE-2024-32113": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99442,
|
|
"epss_pct": 0.9994,
|
|
"name": "Apache OFBiz Directory Traversal - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32113.yaml"
|
|
},
|
|
"CVE-2024-32114": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.07148,
|
|
"epss_pct": 0.93811,
|
|
"name": "Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32114.yaml"
|
|
},
|
|
"CVE-2024-32128": {
|
|
"name": "WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32128.yaml"
|
|
},
|
|
"CVE-2024-32231": {
|
|
"epss": 0.0117,
|
|
"epss_pct": 0.652,
|
|
"name": "Stash < 0.26.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32231.yaml"
|
|
},
|
|
"CVE-2024-32238": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.52948,
|
|
"epss_pct": 0.98896,
|
|
"name": "H3C ER8300G2-X - Password Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32238.yaml"
|
|
},
|
|
"CVE-2024-3231": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00678,
|
|
"epss_pct": 0.49828,
|
|
"name": "Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3231.yaml"
|
|
},
|
|
"CVE-2024-3234": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03726,
|
|
"epss_pct": 0.89017,
|
|
"name": "Chuanhu Chat - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3234.yaml"
|
|
},
|
|
"CVE-2024-32399": {
|
|
"cvss": 7.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0316,
|
|
"epss_pct": 0.87073,
|
|
"name": "RaidenMAILD Mail Server v.4.9.4 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32399.yaml"
|
|
},
|
|
"CVE-2024-32640": {
|
|
"name": "Mura/Masa CMS - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32640.yaml"
|
|
},
|
|
"CVE-2024-32651": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-1336",
|
|
"epss": 0.83601,
|
|
"epss_pct": 0.99665,
|
|
"name": "Change Detection - Server Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32651.yaml"
|
|
},
|
|
"CVE-2024-32709": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05803,
|
|
"epss_pct": 0.92594,
|
|
"name": "WP-Recall <= 16.26.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32709.yaml"
|
|
},
|
|
"CVE-2024-3272": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.98038,
|
|
"epss_pct": 0.99907,
|
|
"name": "D-Link Network Attached Storage - Backdoor Account",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3272.yaml"
|
|
},
|
|
"CVE-2024-3273": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.99997,
|
|
"epss_pct": 0.99988,
|
|
"name": "D-Link Network Attached Storage - Command Injection and Backdoor Account",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3273.yaml"
|
|
},
|
|
"CVE-2024-32735": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.06765,
|
|
"epss_pct": 0.93498,
|
|
"name": "CyberPower - Missing Authentication",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32735.yaml"
|
|
},
|
|
"CVE-2024-32736": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.05408,
|
|
"epss_pct": 0.92124,
|
|
"name": "CyberPower < v2.8.3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32736.yaml"
|
|
},
|
|
"CVE-2024-32737": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05408,
|
|
"epss_pct": 0.92123,
|
|
"name": "CyberPower - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32737.yaml"
|
|
},
|
|
"CVE-2024-32738": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04553,
|
|
"epss_pct": 0.90921,
|
|
"name": "CyberPower - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32738.yaml"
|
|
},
|
|
"CVE-2024-32739": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.05408,
|
|
"epss_pct": 0.92124,
|
|
"name": "CyberPower < v2.8.3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32739.yaml"
|
|
},
|
|
"CVE-2024-3274": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.33484,
|
|
"epss_pct": 0.98257,
|
|
"name": "D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3274.yaml"
|
|
},
|
|
"CVE-2024-32825": {
|
|
"name": "Simply Static - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32825.yaml"
|
|
},
|
|
"CVE-2024-32870": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00751,
|
|
"epss_pct": 0.52442,
|
|
"name": "iTop Hub Connector - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32870.yaml"
|
|
},
|
|
"CVE-2024-32964": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.52964,
|
|
"epss_pct": 0.98897,
|
|
"name": "Lobe Chat <= v0.150.5 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32964.yaml"
|
|
},
|
|
"CVE-2024-3300": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.02761,
|
|
"epss_pct": 0.85235,
|
|
"name": "Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3300.yaml"
|
|
},
|
|
"CVE-2024-33113": {
|
|
"epss": 0.03419,
|
|
"epss_pct": 0.88053,
|
|
"name": "D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33113.yaml"
|
|
},
|
|
"CVE-2024-33288": {
|
|
"name": "Prison Management System - SQL Injection Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33288.yaml"
|
|
},
|
|
"CVE-2024-33326": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0081,
|
|
"epss_pct": 0.5438,
|
|
"name": "LumisXP - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33326.yaml"
|
|
},
|
|
"CVE-2024-33575": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01121,
|
|
"epss_pct": 0.63884,
|
|
"name": "User Meta WP Plugin < 3.1 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33575.yaml"
|
|
},
|
|
"CVE-2024-33605": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06175,
|
|
"epss_pct": 0.92981,
|
|
"name": "Sharp Multifunction Printers - Directory Listing",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33605.yaml"
|
|
},
|
|
"CVE-2024-33610": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.45842,
|
|
"epss_pct": 0.98712,
|
|
"name": "Sharp Multifunction Printers - Cookie Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33610.yaml"
|
|
},
|
|
"CVE-2024-33724": {
|
|
"name": "SOPlanning 1.52.00 Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33724.yaml"
|
|
},
|
|
"CVE-2024-3378": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.22002,
|
|
"epss_pct": 0.97485,
|
|
"name": "iboss Secure Web Gateway - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3378.yaml"
|
|
},
|
|
"CVE-2024-33832": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.0072,
|
|
"epss_pct": 0.51378,
|
|
"name": "OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33832.yaml"
|
|
},
|
|
"CVE-2024-33939": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.00934,
|
|
"epss_pct": 0.58286,
|
|
"name": "Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-33939.yaml"
|
|
},
|
|
"CVE-2024-3400": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99999,
|
|
"epss_pct": 1.0,
|
|
"name": "GlobalProtect - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3400.yaml"
|
|
},
|
|
"CVE-2024-34061": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01281,
|
|
"epss_pct": 0.68012,
|
|
"name": "Changedetection.io <=v0.45.21 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34061.yaml"
|
|
},
|
|
"CVE-2024-3408": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.77951,
|
|
"epss_pct": 0.99539,
|
|
"name": "D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3408.yaml"
|
|
},
|
|
"CVE-2024-34102": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.99994,
|
|
"epss_pct": 0.99987,
|
|
"name": "Adobe Commerce & Magento - CosmicSting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34102.yaml"
|
|
},
|
|
"CVE-2024-34257": {
|
|
"epss": 0.03817,
|
|
"epss_pct": 0.893,
|
|
"name": "TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34257.yaml"
|
|
},
|
|
"CVE-2024-34351": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.05453,
|
|
"epss_pct": 0.92169,
|
|
"name": "Next.js - Server Side Request Forgery (SSRF)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34351.yaml"
|
|
},
|
|
"CVE-2024-34470": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06699,
|
|
"epss_pct": 0.93435,
|
|
"name": "HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34470.yaml"
|
|
},
|
|
"CVE-2024-3469": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00637,
|
|
"epss_pct": 0.48052,
|
|
"name": "GP Premium <= 2.4.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3469.yaml"
|
|
},
|
|
"CVE-2024-3495": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.13618,
|
|
"epss_pct": 0.96194,
|
|
"name": "Wordpress Country State City Dropdown <=2.7.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3495.yaml"
|
|
},
|
|
"CVE-2024-34982": {
|
|
"epss": 0.04675,
|
|
"epss_pct": 0.91122,
|
|
"name": "LyLme-Spage - Arbitary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34982.yaml"
|
|
},
|
|
"CVE-2024-35219": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03592,
|
|
"epss_pct": 0.88612,
|
|
"name": "OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35219.yaml"
|
|
},
|
|
"CVE-2024-35286": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.65367,
|
|
"epss_pct": 0.992,
|
|
"name": "Mitel MiCollab <= 9.8.0.33 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35286.yaml"
|
|
},
|
|
"CVE-2024-3552": {
|
|
"epss": 0.67288,
|
|
"epss_pct": 0.99248,
|
|
"name": "Web Directory Free < 1.7.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3552.yaml"
|
|
},
|
|
"CVE-2024-35584": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05857,
|
|
"epss_pct": 0.92662,
|
|
"name": "openSIS < 9.1 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35584.yaml"
|
|
},
|
|
"CVE-2024-35627": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00957,
|
|
"epss_pct": 0.59002,
|
|
"name": "TileServer API - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35627.yaml"
|
|
},
|
|
"CVE-2024-35693": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0059,
|
|
"epss_pct": 0.45837,
|
|
"name": "WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35693.yaml"
|
|
},
|
|
"CVE-2024-35694": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00668,
|
|
"epss_pct": 0.494,
|
|
"name": "Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-35694.yaml"
|
|
},
|
|
"CVE-2024-3605": {
|
|
"name": "WP Hotel Booking <= 2.1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3605.yaml"
|
|
},
|
|
"CVE-2024-36104": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.87883,
|
|
"epss_pct": 0.9975,
|
|
"name": "Apache OFBiz - Directory Traversal & Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36104.yaml"
|
|
},
|
|
"CVE-2024-36117": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03145,
|
|
"epss_pct": 0.87007,
|
|
"name": "Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36117.yaml"
|
|
},
|
|
"CVE-2024-36401": {
|
|
"epss": 0.99813,
|
|
"epss_pct": 0.99957,
|
|
"name": "GeoServer RCE in Evaluating Property Name Expressions",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36401.yaml"
|
|
},
|
|
"CVE-2024-36404": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-95",
|
|
"epss": 0.76065,
|
|
"epss_pct": 0.99494,
|
|
"name": "GeoServer and GeoTools - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36404.yaml"
|
|
},
|
|
"CVE-2024-36412": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05692,
|
|
"epss_pct": 0.92464,
|
|
"name": "SuiteCRM - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36412.yaml"
|
|
},
|
|
"CVE-2024-36420": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01776,
|
|
"epss_pct": 0.76629,
|
|
"name": "Flowise 1.4.3 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36420.yaml"
|
|
},
|
|
"CVE-2024-36527": {
|
|
"name": "Puppeteer Renderer - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36527.yaml"
|
|
},
|
|
"CVE-2024-3656": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02862,
|
|
"epss_pct": 0.85778,
|
|
"name": "Keycloak < 24.0.5 - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3656.yaml"
|
|
},
|
|
"CVE-2024-36675": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01438,
|
|
"epss_pct": 0.71284,
|
|
"name": "LyLme spage v1.9.5 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36675.yaml"
|
|
},
|
|
"CVE-2024-36683": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.00963,
|
|
"epss_pct": 0.5918,
|
|
"name": "PrestaShop productsalert - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36683.yaml"
|
|
},
|
|
"CVE-2024-3673": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"epss": 0.05578,
|
|
"epss_pct": 0.92322,
|
|
"name": "Web Directory Free < 1.7.3 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3673.yaml"
|
|
},
|
|
"CVE-2024-36837": {
|
|
"epss": 0.08306,
|
|
"epss_pct": 0.94527,
|
|
"name": "CRMEB v.5.2.2 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36837.yaml"
|
|
},
|
|
"CVE-2024-36857": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02054,
|
|
"epss_pct": 0.79921,
|
|
"name": "Jan v0.4.12 'readFileSync' - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36857.yaml"
|
|
},
|
|
"CVE-2024-36858": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.03035,
|
|
"epss_pct": 0.86562,
|
|
"name": "Jan v0.4.12 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36858.yaml"
|
|
},
|
|
"CVE-2024-36991": {
|
|
"epss": 0.13006,
|
|
"epss_pct": 0.96046,
|
|
"name": "Splunk Enterprise - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36991.yaml"
|
|
},
|
|
"CVE-2024-37014": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.63037,
|
|
"epss_pct": 0.99139,
|
|
"name": "Langflow <= 1.0.12 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37014.yaml"
|
|
},
|
|
"CVE-2024-37032": {
|
|
"epss": 0.89633,
|
|
"epss_pct": 0.99776,
|
|
"name": "Ollama - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37032.yaml"
|
|
},
|
|
"CVE-2024-37152": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.02348,
|
|
"epss_pct": 0.82483,
|
|
"name": "Argo CD Unauthenticated Access to sensitive setting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37152.yaml"
|
|
},
|
|
"CVE-2024-37259": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00624,
|
|
"epss_pct": 0.47511,
|
|
"name": "WP Extended < 3.0.0 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37259.yaml"
|
|
},
|
|
"CVE-2024-37261": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00624,
|
|
"epss_pct": 0.47511,
|
|
"name": "WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37261.yaml"
|
|
},
|
|
"CVE-2024-37393": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03304,
|
|
"epss_pct": 0.87662,
|
|
"name": "SecurEnvoy Two Factor Authentication - LDAP Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37393.yaml"
|
|
},
|
|
"CVE-2024-3742": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-312",
|
|
"epss": 0.01418,
|
|
"epss_pct": 0.70917,
|
|
"name": "Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3742.yaml"
|
|
},
|
|
"CVE-2024-3753": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00801,
|
|
"epss_pct": 0.54068,
|
|
"name": "Hostel < 1.1.5.3 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3753.yaml"
|
|
},
|
|
"CVE-2024-37656": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0049,
|
|
"epss_pct": 0.40199,
|
|
"name": "GnuBoard5 5.5.16 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37656.yaml"
|
|
},
|
|
"CVE-2024-37728": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01852,
|
|
"epss_pct": 0.77616,
|
|
"name": "OfficeWeb365 Indexs Interface - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37728.yaml"
|
|
},
|
|
"CVE-2024-37843": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.53242,
|
|
"epss_pct": 0.98904,
|
|
"name": "Craft CMS <=v3.7.31 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37843.yaml"
|
|
},
|
|
"CVE-2024-37881": {
|
|
"epss": 0.01184,
|
|
"epss_pct": 0.65588,
|
|
"name": "SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37881.yaml"
|
|
},
|
|
"CVE-2024-3822": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00741,
|
|
"epss_pct": 0.52105,
|
|
"name": "Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3822.yaml"
|
|
},
|
|
"CVE-2024-38288": {
|
|
"epss": 0.03216,
|
|
"epss_pct": 0.87311,
|
|
"name": "TurboMeeting - Post-Authentication Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38288.yaml"
|
|
},
|
|
"CVE-2024-38289": {
|
|
"epss": 0.40874,
|
|
"epss_pct": 0.98553,
|
|
"name": "TurboMeeting - Boolean-based SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38289.yaml"
|
|
},
|
|
"CVE-2024-38353": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-338",
|
|
"epss": 0.01158,
|
|
"epss_pct": 0.64861,
|
|
"name": "CodiMD <2.5.4 - Insecure Filename Randomization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38353.yaml"
|
|
},
|
|
"CVE-2024-38472": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.6947,
|
|
"epss_pct": 0.99309,
|
|
"name": "Apache HTTPd Windows UNC - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38472.yaml"
|
|
},
|
|
"CVE-2024-38473": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-116",
|
|
"epss": 0.25878,
|
|
"epss_pct": 0.97826,
|
|
"name": "Apache HTTP Server - ACL Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38473.yaml"
|
|
},
|
|
"CVE-2024-38475": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-116",
|
|
"epss": 0.99957,
|
|
"epss_pct": 0.99974,
|
|
"name": "Sonicwall - Pre-Authentication Arbitrary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38475.yaml"
|
|
},
|
|
"CVE-2024-3848": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.43284,
|
|
"epss_pct": 0.98631,
|
|
"name": "Mlflow < 2.11.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3848.yaml"
|
|
},
|
|
"CVE-2024-3850": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.009,
|
|
"epss_pct": 0.57183,
|
|
"name": "Uniview NVR301-04S2-P4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3850.yaml"
|
|
},
|
|
"CVE-2024-38514": {
|
|
"cvss": 7.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02186,
|
|
"epss_pct": 0.81134,
|
|
"name": "NextChat - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38514.yaml"
|
|
},
|
|
"CVE-2024-38526": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
|
|
"epss": 0.03832,
|
|
"epss_pct": 0.89341,
|
|
"name": "Polyfill Supply Chain Attack Malicious Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2024/CVE-2024-38526.yaml"
|
|
},
|
|
"CVE-2024-38653": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.91984,
|
|
"epss_pct": 0.99811,
|
|
"name": "Ivanti Avalanche SmartDeviceServer - XML External Entity",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38653.yaml"
|
|
},
|
|
"CVE-2024-38773": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02004,
|
|
"epss_pct": 0.7938,
|
|
"name": "FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38773.yaml"
|
|
},
|
|
"CVE-2024-38816": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.14718,
|
|
"epss_pct": 0.96421,
|
|
"name": "WebMvc.fn/WebFlux.fn - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38816.yaml"
|
|
},
|
|
"CVE-2024-38819": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.54862,
|
|
"epss_pct": 0.98949,
|
|
"name": "Spring Framework Path Traversal in Functional Web Frameworks",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml"
|
|
},
|
|
"CVE-2024-38856": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99427,
|
|
"epss_pct": 0.99938,
|
|
"name": "Apache OFBiz - Improper Authorization & Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38856.yaml"
|
|
},
|
|
"CVE-2024-3922": {
|
|
"epss": 0.53196,
|
|
"epss_pct": 0.98902,
|
|
"name": "Dokan Pro <= 3.10.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3922.yaml"
|
|
},
|
|
"CVE-2024-39250": {
|
|
"epss": 0.04927,
|
|
"epss_pct": 0.91509,
|
|
"name": "EfroTech Timetrax v8.3 - Sql Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39250.yaml"
|
|
},
|
|
"CVE-2024-39646": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00624,
|
|
"epss_pct": 0.47468,
|
|
"name": "WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39646.yaml"
|
|
},
|
|
"CVE-2024-39713": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03201,
|
|
"epss_pct": 0.87237,
|
|
"name": "Rocket.Chat - Server-Side Request Forgery (SSRF)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39713.yaml"
|
|
},
|
|
"CVE-2024-39887": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04433,
|
|
"epss_pct": 0.9069,
|
|
"name": "Apache Superset < 4.0.2 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39887.yaml"
|
|
},
|
|
"CVE-2024-39903": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02884,
|
|
"epss_pct": 0.85886,
|
|
"name": "Solara <1.35.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39903.yaml"
|
|
},
|
|
"CVE-2024-39907": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.29183,
|
|
"epss_pct": 0.98033,
|
|
"name": "1Panel SQL Injection - Authenticated",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39907.yaml"
|
|
},
|
|
"CVE-2024-39914": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.23237,
|
|
"epss_pct": 0.97606,
|
|
"name": "FOG Project < 1.5.10.34 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39914.yaml"
|
|
},
|
|
"CVE-2024-40348": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0829,
|
|
"epss_pct": 0.94518,
|
|
"name": "Bazarr < 1.4.3 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40348.yaml"
|
|
},
|
|
"CVE-2024-4040": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99539,
|
|
"epss_pct": 0.99943,
|
|
"name": "CrushFTP VFS - Sandbox Escape LFR",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4040.yaml"
|
|
},
|
|
"CVE-2024-40422": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11323,
|
|
"epss_pct": 0.95665,
|
|
"name": "Devika v1 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40422.yaml"
|
|
},
|
|
"CVE-2024-40711": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.90369,
|
|
"epss_pct": 0.9979,
|
|
"name": "Veeam Backup & Replication - Unauthenticated",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40711.yaml"
|
|
},
|
|
"CVE-2024-41107": {
|
|
"epss": 0.1776,
|
|
"epss_pct": 0.96943,
|
|
"name": "Apache CloudStack - SAML Signature Exclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41107.yaml"
|
|
},
|
|
"CVE-2024-41628": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.06517,
|
|
"epss_pct": 0.93286,
|
|
"name": "Cluster Control CMON API - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41628.yaml"
|
|
},
|
|
"CVE-2024-41667": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.03536,
|
|
"epss_pct": 0.88439,
|
|
"name": "OpenAM<=15.0.3 FreeMarker - Template Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41667.yaml"
|
|
},
|
|
"CVE-2024-41713": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.9811,
|
|
"epss_pct": 0.99909,
|
|
"name": "Mitel MiCollab - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41713.yaml"
|
|
},
|
|
"CVE-2024-4180": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01834,
|
|
"epss_pct": 0.77395,
|
|
"name": "The Events Calendar < 6.4.0.1 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4180.yaml"
|
|
},
|
|
"CVE-2024-41810": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.01176,
|
|
"epss_pct": 0.65368,
|
|
"name": "Twisted - Open Redirect & XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41810.yaml"
|
|
},
|
|
"CVE-2024-41955": {
|
|
"cvss": 5.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01,
|
|
"epss_pct": 0.60382,
|
|
"name": "Open Redirect in Login Redirect - MobSF",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41955.yaml"
|
|
},
|
|
"CVE-2024-42009": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.82882,
|
|
"epss_pct": 0.99648,
|
|
"name": "Roundcube Webmail - Cross-Site Scripting",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42009.yaml"
|
|
},
|
|
"CVE-2024-42323": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.08322,
|
|
"epss_pct": 0.94536,
|
|
"name": "Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42323.yaml"
|
|
},
|
|
"CVE-2024-4257": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12051,
|
|
"epss_pct": 0.9584,
|
|
"name": "BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4257.yaml"
|
|
},
|
|
"CVE-2024-42640": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.45374,
|
|
"epss_pct": 0.98699,
|
|
"name": "Angular-Base64-Upload - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42640.yaml"
|
|
},
|
|
"CVE-2024-42852": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00768,
|
|
"epss_pct": 0.53029,
|
|
"name": "AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42852.yaml"
|
|
},
|
|
"CVE-2024-4295": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.10161,
|
|
"epss_pct": 0.95316,
|
|
"name": "Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4295.yaml"
|
|
},
|
|
"CVE-2024-43144": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02002,
|
|
"epss_pct": 0.79354,
|
|
"name": "Cost Calculator Builder <= 3.2.15 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43144.yaml"
|
|
},
|
|
"CVE-2024-43160": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04624,
|
|
"epss_pct": 0.9104,
|
|
"name": "BerqWP <= 1.7.6 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43160.yaml"
|
|
},
|
|
"CVE-2024-4322": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.30987,
|
|
"epss_pct": 0.98128,
|
|
"name": "LoLLMS WebUI < 9.8 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4322.yaml"
|
|
},
|
|
"CVE-2024-4325": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.37366,
|
|
"epss_pct": 0.98418,
|
|
"name": "Gradio - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4325.yaml"
|
|
},
|
|
"CVE-2024-43283": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01104,
|
|
"epss_pct": 0.63454,
|
|
"name": "Contest Gallery - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43283.yaml"
|
|
},
|
|
"CVE-2024-43360": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.06222,
|
|
"epss_pct": 0.93024,
|
|
"name": "ZoneMinder - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43360.yaml"
|
|
},
|
|
"CVE-2024-4340": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"epss": 0.03237,
|
|
"epss_pct": 0.87394,
|
|
"name": "sqlparse - Denial of Service",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-4340.yaml"
|
|
},
|
|
"CVE-2024-43425": {
|
|
"cvss": 9.8,
|
|
"epss": 0.83122,
|
|
"epss_pct": 0.99651,
|
|
"name": "Moodle - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43425.yaml"
|
|
},
|
|
"CVE-2024-43441": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-302",
|
|
"epss": 0.69439,
|
|
"epss_pct": 0.99308,
|
|
"name": "Apache HugeGraph-Server <1.5.0 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43441.yaml"
|
|
},
|
|
"CVE-2024-4348": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01828,
|
|
"epss_pct": 0.77313,
|
|
"name": "osCommerce v4.0 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4348.yaml"
|
|
},
|
|
"CVE-2024-4358": {
|
|
"epss": 0.97482,
|
|
"epss_pct": 0.99895,
|
|
"name": "Progress Telerik Report Server - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4358.yaml"
|
|
},
|
|
"CVE-2024-43917": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.22955,
|
|
"epss_pct": 0.97583,
|
|
"name": "WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43917.yaml"
|
|
},
|
|
"CVE-2024-43919": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.44475,
|
|
"epss_pct": 0.98671,
|
|
"name": "YARPP <= 5.30.10 - Missing Authorization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43919.yaml"
|
|
},
|
|
"CVE-2024-43965": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02019,
|
|
"epss_pct": 0.79553,
|
|
"name": "SendGrid for WordPress <= 1.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43965.yaml"
|
|
},
|
|
"CVE-2024-43971": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00624,
|
|
"epss_pct": 0.47468,
|
|
"name": "Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43971.yaml"
|
|
},
|
|
"CVE-2024-4399": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01821,
|
|
"epss_pct": 0.7722,
|
|
"name": "WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4399.yaml"
|
|
},
|
|
"CVE-2024-44000": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.82143,
|
|
"epss_pct": 0.9963,
|
|
"name": "LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44000.yaml"
|
|
},
|
|
"CVE-2024-4434": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.36925,
|
|
"epss_pct": 0.98401,
|
|
"name": "LearnPress WordPress LMS Plugin <= 4.2.6.5 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4434.yaml"
|
|
},
|
|
"CVE-2024-44349": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.05778,
|
|
"epss_pct": 0.92558,
|
|
"name": "AnteeoWMS < v4.7.34 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44349.yaml"
|
|
},
|
|
"CVE-2024-4439": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.70822,
|
|
"epss_pct": 0.99351,
|
|
"name": "WordPress Core <6.5.2 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4439.yaml"
|
|
},
|
|
"CVE-2024-4443": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.10355,
|
|
"epss_pct": 0.95383,
|
|
"name": "Business Directory Plugin <= 6.4.2 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4443.yaml"
|
|
},
|
|
"CVE-2024-4455": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0101,
|
|
"epss_pct": 0.60686,
|
|
"name": "YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4455.yaml"
|
|
},
|
|
"CVE-2024-44762": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.02566,
|
|
"epss_pct": 0.84018,
|
|
"name": "Usermin 2.100 - Username Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44762.yaml"
|
|
},
|
|
"CVE-2024-44849": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.46287,
|
|
"epss_pct": 0.98726,
|
|
"name": "Qualitor <= 8.24 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-44849.yaml"
|
|
},
|
|
"CVE-2024-45195": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-425",
|
|
"epss": 0.99983,
|
|
"epss_pct": 0.99981,
|
|
"name": "Apache OFBiz - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45195.yaml"
|
|
},
|
|
"CVE-2024-45216": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.91714,
|
|
"epss_pct": 0.99807,
|
|
"name": "Apache Solr - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45216.yaml"
|
|
},
|
|
"CVE-2024-45241": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.13623,
|
|
"epss_pct": 0.96197,
|
|
"name": "CentralSquare CryWolf - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45241.yaml"
|
|
},
|
|
"CVE-2024-45293": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.02799,
|
|
"epss_pct": 0.8546,
|
|
"name": "TablePress < 2.4.3 - XXE Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45293.yaml"
|
|
},
|
|
"CVE-2024-45309": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.24531,
|
|
"epss_pct": 0.97717,
|
|
"name": "OneDev.io < 11.0.9 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45309.yaml"
|
|
},
|
|
"CVE-2024-45388": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.5585,
|
|
"epss_pct": 0.98968,
|
|
"name": "Hoverfly < 1.10.3 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45388.yaml"
|
|
},
|
|
"CVE-2024-45409": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-347",
|
|
"epss": 0.10684,
|
|
"epss_pct": 0.95483,
|
|
"name": "GitLab - SAML Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-45409.yaml"
|
|
},
|
|
"CVE-2024-45440": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.09269,
|
|
"epss_pct": 0.94996,
|
|
"name": "Drupal 11.x-dev - Full Path Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45440.yaml"
|
|
},
|
|
"CVE-2024-45488": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.50603,
|
|
"epss_pct": 0.98833,
|
|
"name": "SafeGuard for Privileged Passwords < 7.5.2 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45488.yaml"
|
|
},
|
|
"CVE-2024-45507": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.93229,
|
|
"epss_pct": 0.99827,
|
|
"name": "Apache OFBiz - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45507.yaml"
|
|
},
|
|
"CVE-2024-45519": {
|
|
"epss": 0.99907,
|
|
"epss_pct": 0.99965,
|
|
"name": "Zimbra Collaboration Suite < 9.0.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-45519.yaml"
|
|
},
|
|
"CVE-2024-45591": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.03417,
|
|
"epss_pct": 0.88049,
|
|
"name": "XWiki Platform - Unauthorized Document History Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45591.yaml"
|
|
},
|
|
"CVE-2024-45622": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.36679,
|
|
"epss_pct": 0.98387,
|
|
"name": "ASIS - SQL Injection Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45622.yaml"
|
|
},
|
|
"CVE-2024-4577": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99987,
|
|
"epss_pct": 0.99983,
|
|
"name": "PHP CGI - Argument Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml"
|
|
},
|
|
"CVE-2024-4620": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.03345,
|
|
"epss_pct": 0.87811,
|
|
"name": "ArForms < 6.6 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4620.yaml"
|
|
},
|
|
"CVE-2024-46310": {
|
|
"epss": 0.02482,
|
|
"epss_pct": 0.83443,
|
|
"name": "FXServer < v9601 - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46310.yaml"
|
|
},
|
|
"CVE-2024-46506": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.62045,
|
|
"epss_pct": 0.99114,
|
|
"name": "NetAlertX 23.01.14\u201324.x < 24.10.12 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46506.yaml"
|
|
},
|
|
"CVE-2024-46507": {
|
|
"name": "Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46507.yaml"
|
|
},
|
|
"CVE-2024-46627": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.04099,
|
|
"epss_pct": 0.9002,
|
|
"name": "DATAGERRY - REST API Auth Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46627.yaml"
|
|
},
|
|
"CVE-2024-46938": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.46063,
|
|
"epss_pct": 0.98719,
|
|
"name": "Sitecore Experience Platform <= 10.4 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46938.yaml"
|
|
},
|
|
"CVE-2024-46986": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.37358,
|
|
"epss_pct": 0.98418,
|
|
"name": "Camaleon CMS < 2.8.1 Arbitrary File Write to RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46986.yaml"
|
|
},
|
|
"CVE-2024-47062": {
|
|
"epss": 0.04457,
|
|
"epss_pct": 0.9074,
|
|
"name": "Navidrome < 0.53.0 - Authenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47062.yaml"
|
|
},
|
|
"CVE-2024-47073": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-347",
|
|
"epss": 0.0125,
|
|
"epss_pct": 0.67316,
|
|
"name": "DataEase v2.10.2 - JWT Signature Verification Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47073.yaml"
|
|
},
|
|
"CVE-2024-47176": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-1327",
|
|
"epss": 0.50605,
|
|
"epss_pct": 0.98833,
|
|
"name": "CUPS - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-47176.yaml"
|
|
},
|
|
"CVE-2024-47308": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01744,
|
|
"epss_pct": 0.76167,
|
|
"name": "Templately <= 3.1.2 - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47308.yaml"
|
|
},
|
|
"CVE-2024-47374": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0138,
|
|
"epss_pct": 0.70189,
|
|
"name": "LiteSpeed Cache <= 6.5.0.2 - Stored XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47374.yaml"
|
|
},
|
|
"CVE-2024-47533": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.04003,
|
|
"epss_pct": 0.89809,
|
|
"name": "Cobbler 'XML-RPC' - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-47533.yaml"
|
|
},
|
|
"CVE-2024-47575": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.9495,
|
|
"epss_pct": 0.99854,
|
|
"name": "FortiManager Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-47575.yaml"
|
|
},
|
|
"CVE-2024-48208": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
|
|
"cwe": "CWE-125",
|
|
"epss": 0.01575,
|
|
"epss_pct": 0.73698,
|
|
"name": "Pure-FTPd < 1.0.52 - Buffer Overflow",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-48208.yaml"
|
|
},
|
|
"CVE-2024-48248": {
|
|
"epss": 0.94356,
|
|
"epss_pct": 0.99845,
|
|
"name": "NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48248.yaml"
|
|
},
|
|
"CVE-2024-48259": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.00907,
|
|
"epss_pct": 0.57406,
|
|
"name": "Cloudlog - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48259.yaml"
|
|
},
|
|
"CVE-2024-48307": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.44349,
|
|
"epss_pct": 0.98666,
|
|
"name": "JeecgBoot v3.7.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48307.yaml"
|
|
},
|
|
"CVE-2024-4836": {
|
|
"epss": 0.02651,
|
|
"epss_pct": 0.8456,
|
|
"name": "Edito CMS - Sensitive Data Leak",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4836.yaml"
|
|
},
|
|
"CVE-2024-48360": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.03939,
|
|
"epss_pct": 0.89646,
|
|
"name": "Qualitor <= v8.24 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48360.yaml"
|
|
},
|
|
"CVE-2024-4841": {
|
|
"cvss": 4.0,
|
|
"cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.00668,
|
|
"epss_pct": 0.49409,
|
|
"name": "LoLLMS WebUI - Subfolder Prediction via Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4841.yaml"
|
|
},
|
|
"CVE-2024-48455": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.06427,
|
|
"epss_pct": 0.93209,
|
|
"name": "Netis Wifi Router - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48455.yaml"
|
|
},
|
|
"CVE-2024-48651": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.02204,
|
|
"epss_pct": 0.81311,
|
|
"name": "ProFTPD \u2264 1.3.8b - Privilege Escalation via mod_sql",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-48651.yaml"
|
|
},
|
|
"CVE-2024-48766": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.69697,
|
|
"epss_pct": 0.99317,
|
|
"name": "NetAlert X - Arbitary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48766.yaml"
|
|
},
|
|
"CVE-2024-4879": {
|
|
"epss": 0.99976,
|
|
"epss_pct": 0.99979,
|
|
"name": "ServiceNow UI Macros - Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4879.yaml"
|
|
},
|
|
"CVE-2024-4885": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.99288,
|
|
"epss_pct": 0.99935,
|
|
"name": "Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4885.yaml"
|
|
},
|
|
"CVE-2024-48914": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.60416,
|
|
"epss_pct": 0.99076,
|
|
"name": "Vendure - Arbitrary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-48914.yaml"
|
|
},
|
|
"CVE-2024-4898": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.04156,
|
|
"epss_pct": 0.90147,
|
|
"name": "WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4898.yaml"
|
|
},
|
|
"CVE-2024-49357": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.23843,
|
|
"epss_pct": 0.97657,
|
|
"name": "ZimaOS <= v1.2.4 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-49357.yaml"
|
|
},
|
|
"CVE-2024-49380": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.02705,
|
|
"epss_pct": 0.84893,
|
|
"name": "Plenti < v0.7.2 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-49380.yaml"
|
|
},
|
|
"CVE-2024-4940": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01021,
|
|
"epss_pct": 0.60997,
|
|
"name": "Gradio - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4940.yaml"
|
|
},
|
|
"CVE-2024-4956": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.18245,
|
|
"epss_pct": 0.97006,
|
|
"name": "Sonatype Nexus Repository Manager 3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4956.yaml"
|
|
},
|
|
"CVE-2024-49757": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.02518,
|
|
"epss_pct": 0.837,
|
|
"name": "Zitadel - User Registration Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-49757.yaml"
|
|
},
|
|
"CVE-2024-50334": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.01035,
|
|
"epss_pct": 0.61463,
|
|
"name": "Scoold < 1.64.0 - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50334.yaml"
|
|
},
|
|
"CVE-2024-50340": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.6322,
|
|
"epss_pct": 0.99145,
|
|
"name": "Symfony Profiler - Remote Access via Injected Arguments",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50340.yaml"
|
|
},
|
|
"CVE-2024-50477": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.08184,
|
|
"epss_pct": 0.9446,
|
|
"name": "WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50477.yaml"
|
|
},
|
|
"CVE-2024-50498": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.53135,
|
|
"epss_pct": 0.98901,
|
|
"name": "WP Query Console <= 1.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50498.yaml"
|
|
},
|
|
"CVE-2024-5057": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02588,
|
|
"epss_pct": 0.84161,
|
|
"name": "WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5057.yaml"
|
|
},
|
|
"CVE-2024-50603": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.98545,
|
|
"epss_pct": 0.99919,
|
|
"name": "Aviatrix Controller - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50603.yaml"
|
|
},
|
|
"CVE-2024-50623": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.98607,
|
|
"epss_pct": 0.9992,
|
|
"name": "Cleo Harmony < 5.8.0.21 - Arbitary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50623.yaml"
|
|
},
|
|
"CVE-2024-5082": {
|
|
"epss": 0.01943,
|
|
"epss_pct": 0.78711,
|
|
"name": "Nexus Repository 2 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5082.yaml"
|
|
},
|
|
"CVE-2024-5084": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.50653,
|
|
"epss_pct": 0.98834,
|
|
"name": "Hash Form <= 1.1.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5084.yaml"
|
|
},
|
|
"CVE-2024-50857": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01216,
|
|
"epss_pct": 0.66441,
|
|
"name": "GestioIP - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50857.yaml"
|
|
},
|
|
"CVE-2024-50967": {
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01677,
|
|
"epss_pct": 0.75225,
|
|
"name": "DATAGERRY - Improper Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50967.yaml"
|
|
},
|
|
"CVE-2024-51211": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02256,
|
|
"epss_pct": 0.81719,
|
|
"name": "openSIS Classic v9.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51211.yaml"
|
|
},
|
|
"CVE-2024-51228": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.0379,
|
|
"epss_pct": 0.8921,
|
|
"name": "TOTOLINK CX-A3002RU - Remote Code Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51228.yaml"
|
|
},
|
|
"CVE-2024-51378": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.94734,
|
|
"epss_pct": 0.99852,
|
|
"name": "CyberPanel - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51378.yaml"
|
|
},
|
|
"CVE-2024-51482": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.34979,
|
|
"epss_pct": 0.98318,
|
|
"name": "ZoneMinder v1.37.* <= 1.37.64 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51482.yaml"
|
|
},
|
|
"CVE-2024-51483": {
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02274,
|
|
"epss_pct": 0.81865,
|
|
"name": "Changedetection.io <= 0.47.4 - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51483.yaml"
|
|
},
|
|
"CVE-2024-51567": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.86518,
|
|
"epss_pct": 0.99723,
|
|
"name": "CyberPanel v2.3.6 Pre-Auth Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51567.yaml"
|
|
},
|
|
"CVE-2024-51568": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.4546,
|
|
"epss_pct": 0.98701,
|
|
"name": "CyberPanel - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51568.yaml"
|
|
},
|
|
"CVE-2024-51739": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01232,
|
|
"epss_pct": 0.66864,
|
|
"name": "iTop - User Enumeration via REST Endpoint",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51739.yaml"
|
|
},
|
|
"CVE-2024-51977": {
|
|
"epss": 0.72618,
|
|
"epss_pct": 0.99401,
|
|
"name": "Brother MFC-L9570CDW - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51977.yaml"
|
|
},
|
|
"CVE-2024-51978": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1391",
|
|
"epss": 0.18699,
|
|
"epss_pct": 0.97062,
|
|
"name": "Brother Printers \u2013 Authentication Bypass via Default Admin Password",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml"
|
|
},
|
|
"CVE-2024-5217": {
|
|
"epss": 0.99628,
|
|
"epss_pct": 0.99947,
|
|
"name": "ServiceNow - Incomplete Input Validation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5217.yaml"
|
|
},
|
|
"CVE-2024-5230": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.18768,
|
|
"epss_pct": 0.9707,
|
|
"name": "FleetCart 4.1.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5230.yaml"
|
|
},
|
|
"CVE-2024-52433": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.03049,
|
|
"epss_pct": 0.86611,
|
|
"name": "My Geo Posts Free <= 1.2 - PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52433.yaml"
|
|
},
|
|
"CVE-2024-5276": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.90067,
|
|
"epss_pct": 0.99785,
|
|
"name": "Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5276.yaml"
|
|
},
|
|
"CVE-2024-52762": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00736,
|
|
"epss_pct": 0.51948,
|
|
"name": "Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52762.yaml"
|
|
},
|
|
"CVE-2024-52763": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00615,
|
|
"epss_pct": 0.47021,
|
|
"name": "Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52763.yaml"
|
|
},
|
|
"CVE-2024-52875": {
|
|
"cwe": "CWE-74",
|
|
"epss": 0.29558,
|
|
"epss_pct": 0.98054,
|
|
"name": "Kerio Control v9.2.5 - CRLF Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52875.yaml"
|
|
},
|
|
"CVE-2024-5315": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.34522,
|
|
"epss_pct": 0.98299,
|
|
"name": "Dolibarr ERP CMS `list.php` - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5315.yaml"
|
|
},
|
|
"CVE-2024-5333": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.01092,
|
|
"epss_pct": 0.63066,
|
|
"name": "WordPress Events Calendar 6.8.2.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5333.yaml"
|
|
},
|
|
"CVE-2024-5334": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-73",
|
|
"epss": 0.02073,
|
|
"epss_pct": 0.80116,
|
|
"name": "Devika - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5334.yaml"
|
|
},
|
|
"CVE-2024-53704": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.95132,
|
|
"epss_pct": 0.99858,
|
|
"name": "SSL VPN Session Hijacking",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53704.yaml"
|
|
},
|
|
"CVE-2024-53900": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03988,
|
|
"epss_pct": 0.89772,
|
|
"name": "Mongoose < 8.8.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53900.yaml"
|
|
},
|
|
"CVE-2024-53991": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.26788,
|
|
"epss_pct": 0.97882,
|
|
"name": "Discourse Backup File Disclosure Via Default Nginx Configuration",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53991.yaml"
|
|
},
|
|
"CVE-2024-53995": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0097,
|
|
"epss_pct": 0.59447,
|
|
"name": "SickChill - Open Redirect",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-53995.yaml"
|
|
},
|
|
"CVE-2024-5420": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.055,
|
|
"epss_pct": 0.92223,
|
|
"name": "SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5420.yaml"
|
|
},
|
|
"CVE-2024-5421": {
|
|
"cvss": 8.7,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.03692,
|
|
"epss_pct": 0.88919,
|
|
"name": "SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5421.yaml"
|
|
},
|
|
"CVE-2024-54330": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01461,
|
|
"epss_pct": 0.71731,
|
|
"name": "Hurrakify <= 2.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54330.yaml"
|
|
},
|
|
"CVE-2024-54385": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.05213,
|
|
"epss_pct": 0.91912,
|
|
"name": "Radio Player <= 2.0.82 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54385.yaml"
|
|
},
|
|
"CVE-2024-54763": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.00768,
|
|
"epss_pct": 0.5302,
|
|
"name": "ipTIME A2004 - Unauthorized Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54763.yaml"
|
|
},
|
|
"CVE-2024-54764": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.01035,
|
|
"epss_pct": 0.61463,
|
|
"name": "ipTIME A2004 - Unauthorized Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54764.yaml"
|
|
},
|
|
"CVE-2024-54767": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.01823,
|
|
"epss_pct": 0.77249,
|
|
"name": "AVM FRITZ!Box 7530 AX - Unauthorized Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-54767.yaml"
|
|
},
|
|
"CVE-2024-5483": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01008,
|
|
"epss_pct": 0.60632,
|
|
"name": "LearnPress < 4.2.6.8.1 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5483.yaml"
|
|
},
|
|
"CVE-2024-5488": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.03744,
|
|
"epss_pct": 0.89074,
|
|
"name": "SEOPress < 7.9 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5488.yaml"
|
|
},
|
|
"CVE-2024-55218": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00699,
|
|
"epss_pct": 0.50607,
|
|
"name": "IceWarp Server 10.2.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55218.yaml"
|
|
},
|
|
"CVE-2024-5522": {
|
|
"cvss": 9.8,
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02618,
|
|
"epss_pct": 0.84355,
|
|
"name": "WordPress HTML5 Video Player < 2.5.27 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5522.yaml"
|
|
},
|
|
"CVE-2024-55415": {
|
|
"epss": 0.15543,
|
|
"epss_pct": 0.96575,
|
|
"name": "DevDojo Voyager <=1.8.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55415.yaml"
|
|
},
|
|
"CVE-2024-55416": {
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
|
|
"epss": 0.20273,
|
|
"epss_pct": 0.97287,
|
|
"name": "DevDojo Voyager <=1.8.0 - Cross-Site Scripting",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55416.yaml"
|
|
},
|
|
"CVE-2024-55417": {
|
|
"epss": 0.13066,
|
|
"epss_pct": 0.96067,
|
|
"name": "DevDojo Voyager <= 1.8.0 - Arbitrary File Write vulnerability",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55417.yaml"
|
|
},
|
|
"CVE-2024-55457": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03059,
|
|
"epss_pct": 0.86666,
|
|
"name": "MasterSAM Star Gate v11 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55457.yaml"
|
|
},
|
|
"CVE-2024-55550": {
|
|
"cvss": 4.4,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.37848,
|
|
"epss_pct": 0.98438,
|
|
"name": "Mitel MiCollab - Arbitary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55550.yaml"
|
|
},
|
|
"CVE-2024-55556": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.44126,
|
|
"epss_pct": 0.9866,
|
|
"name": "InvoiceShelf <= 1.3.0 - PHP Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-55556.yaml"
|
|
},
|
|
"CVE-2024-55591": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.98259,
|
|
"epss_pct": 0.99911,
|
|
"name": "Fortinet - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55591.yaml"
|
|
},
|
|
"CVE-2024-55890": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-95",
|
|
"epss": 0.02303,
|
|
"epss_pct": 0.82114,
|
|
"name": "D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55890.yaml"
|
|
},
|
|
"CVE-2024-55956": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-276",
|
|
"epss": 0.94037,
|
|
"epss_pct": 0.99839,
|
|
"name": "Cleo Harmony < 5.8.0.24 - File Upload Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55956.yaml"
|
|
},
|
|
"CVE-2024-56064": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.30783,
|
|
"epss_pct": 0.98114,
|
|
"name": "WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56064.yaml"
|
|
},
|
|
"CVE-2024-56145": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.97446,
|
|
"epss_pct": 0.99894,
|
|
"name": "Craft CMS - Remote Code Execution via Template Path Manipulation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56145.yaml"
|
|
},
|
|
"CVE-2024-56159": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-219",
|
|
"epss": 0.01495,
|
|
"epss_pct": 0.72358,
|
|
"name": "Astro - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56159.yaml"
|
|
},
|
|
"CVE-2024-56325": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.79369,
|
|
"epss_pct": 0.99572,
|
|
"name": "Apache Pinot < 1.3.0 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56325.yaml"
|
|
},
|
|
"CVE-2024-56331": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01829,
|
|
"epss_pct": 0.77319,
|
|
"name": "Uptime-Kuma - Local File Inclusion (LFI)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-56331.yaml"
|
|
},
|
|
"CVE-2024-56511": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-289",
|
|
"epss": 0.44458,
|
|
"epss_pct": 0.9867,
|
|
"name": "DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56511.yaml"
|
|
},
|
|
"CVE-2024-56512": {
|
|
"epss": 0.0313,
|
|
"epss_pct": 0.86951,
|
|
"name": "Apache NiFi - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56512.yaml"
|
|
},
|
|
"CVE-2024-57045": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.32222,
|
|
"epss_pct": 0.98194,
|
|
"name": "D-Link DIR-859 - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57045.yaml"
|
|
},
|
|
"CVE-2024-57046": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.02084,
|
|
"epss_pct": 0.80222,
|
|
"name": "Netgear DGN2200 - Improper Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57046.yaml"
|
|
},
|
|
"CVE-2024-57049": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.03211,
|
|
"epss_pct": 0.86579,
|
|
"name": "TP-Link Archer C20 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57049.yaml"
|
|
},
|
|
"CVE-2024-57241": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.01135,
|
|
"epss_pct": 0.6422,
|
|
"name": "DedeCMS - Open Redirect via download.php",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57241.yaml"
|
|
},
|
|
"CVE-2024-57514": {
|
|
"cvss": 4.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00885,
|
|
"epss_pct": 0.56727,
|
|
"name": "TP-Link Archer A20 v3 Router - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57514.yaml"
|
|
},
|
|
"CVE-2024-5765": {
|
|
"cwe": "CWE-89",
|
|
"epss": 0.27232,
|
|
"epss_pct": 0.97911,
|
|
"name": "WpStickyBar <= 2.1.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5765.yaml"
|
|
},
|
|
"CVE-2024-57726": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.66601,
|
|
"epss_pct": 0.9923,
|
|
"name": "SimpleHelp <= 5.5.7 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57726.yaml"
|
|
},
|
|
"CVE-2024-57727": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.95151,
|
|
"epss_pct": 0.99859,
|
|
"name": "SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57727.yaml"
|
|
},
|
|
"CVE-2024-58136": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.8464,
|
|
"epss_pct": 0.99688,
|
|
"name": "Yii2 PHP Framework < 2.0.52 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-58136.yaml"
|
|
},
|
|
"CVE-2024-5827": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.03424,
|
|
"epss_pct": 0.88069,
|
|
"name": "Vanna - SQL injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5827.yaml"
|
|
},
|
|
"CVE-2024-5910": {
|
|
"cvss": 9.3,
|
|
"cwe": "CWE-306",
|
|
"epss": 0.91783,
|
|
"epss_pct": 0.99808,
|
|
"name": "Palo Alto Expedition - Admin Account Takeover",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5910.yaml"
|
|
},
|
|
"CVE-2024-5932": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.74283,
|
|
"epss_pct": 0.9945,
|
|
"name": "GiveWP - PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5932.yaml"
|
|
},
|
|
"CVE-2024-5936": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.30074,
|
|
"epss_pct": 0.9808,
|
|
"name": "PrivateGPT < 0.5.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5936.yaml"
|
|
},
|
|
"CVE-2024-5947": {
|
|
"epss": 0.02418,
|
|
"epss_pct": 0.82993,
|
|
"name": "Deep Sea Electronics DSE855 - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5947.yaml"
|
|
},
|
|
"CVE-2024-5975": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"epss": 0.01958,
|
|
"epss_pct": 0.78873,
|
|
"name": "CZ Loan Management <= 1.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5975.yaml"
|
|
},
|
|
"CVE-2024-6028": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11755,
|
|
"epss_pct": 0.95764,
|
|
"name": "Quiz Maker <= 6.5.8.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6028.yaml"
|
|
},
|
|
"CVE-2024-6049": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-32",
|
|
"epss": 0.04235,
|
|
"epss_pct": 0.90317,
|
|
"name": "Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6049.yaml"
|
|
},
|
|
"CVE-2024-6095": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.0265,
|
|
"epss_pct": 0.84555,
|
|
"name": "LocalAI - Partial Local File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6095.yaml"
|
|
},
|
|
"CVE-2024-6159": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.02758,
|
|
"epss_pct": 0.85214,
|
|
"name": "Push Notification for Post and BuddyPress <= 1.93 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6159.yaml"
|
|
},
|
|
"CVE-2024-6188": {
|
|
"epss": 0.02036,
|
|
"epss_pct": 0.7972,
|
|
"name": "TrakSYS 11.x.x - Sensitive Data Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6188.yaml"
|
|
},
|
|
"CVE-2024-6205": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04134,
|
|
"epss_pct": 0.90104,
|
|
"name": "PayPlus Payment Gateway < 6.6.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6205.yaml"
|
|
},
|
|
"CVE-2024-6220": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.35708,
|
|
"epss_pct": 0.98345,
|
|
"name": "WordPress Keydatas \u2264 2.5.2 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6220.yaml"
|
|
},
|
|
"CVE-2024-6235": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.21168,
|
|
"epss_pct": 0.97407,
|
|
"name": "NetScaler Console - Sensitive Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6235.yaml"
|
|
},
|
|
"CVE-2024-6250": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-36",
|
|
"epss": 0.01941,
|
|
"epss_pct": 0.7869,
|
|
"name": "LOLLMS WebUI - Absolute Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6250.yaml"
|
|
},
|
|
"CVE-2024-6265": {
|
|
"name": "UsersWP <= 1.2.10 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6265.yaml"
|
|
},
|
|
"CVE-2024-6289": {
|
|
"epss": 0.00904,
|
|
"epss_pct": 0.57293,
|
|
"name": "WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6289.yaml"
|
|
},
|
|
"CVE-2024-6366": {
|
|
"epss": 0.28993,
|
|
"epss_pct": 0.98023,
|
|
"name": "User Profile Builder < 3.11.8 - File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6366.yaml"
|
|
},
|
|
"CVE-2024-6396": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-29",
|
|
"epss": 0.53113,
|
|
"epss_pct": 0.989,
|
|
"name": "Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6396.yaml"
|
|
},
|
|
"CVE-2024-6420": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"epss": 0.018,
|
|
"epss_pct": 0.76932,
|
|
"name": "Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6420.yaml"
|
|
},
|
|
"CVE-2024-6460": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04826,
|
|
"epss_pct": 0.91353,
|
|
"name": "WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6460.yaml"
|
|
},
|
|
"CVE-2024-6517": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00665,
|
|
"epss_pct": 0.49296,
|
|
"name": "Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6517.yaml"
|
|
},
|
|
"CVE-2024-6555": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.00927,
|
|
"epss_pct": 0.58004,
|
|
"name": "WP Popups - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6555.yaml"
|
|
},
|
|
"CVE-2024-6569": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00856,
|
|
"epss_pct": 0.55846,
|
|
"name": "Campaign Monitor for WordPress - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6569.yaml"
|
|
},
|
|
"CVE-2024-6586": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-201",
|
|
"epss": 0.01933,
|
|
"epss_pct": 0.78599,
|
|
"name": "Lightdash v0.1024.6 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6586.yaml"
|
|
},
|
|
"CVE-2024-6587": {
|
|
"epss": 0.35316,
|
|
"epss_pct": 0.98329,
|
|
"name": "LiteLLM - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6587.yaml"
|
|
},
|
|
"CVE-2024-6646": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.45681,
|
|
"epss_pct": 0.98707,
|
|
"name": "Netgear-WN604 downloadFile.php - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6646.yaml"
|
|
},
|
|
"CVE-2024-6651": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.15012,
|
|
"epss_pct": 0.96467,
|
|
"name": "WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6651.yaml"
|
|
},
|
|
"CVE-2024-6670": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.93,
|
|
"epss_pct": 0.99824,
|
|
"name": "WhatsUp Gold HasErrors SQL Injection - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6670.yaml"
|
|
},
|
|
"CVE-2024-6671": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.18988,
|
|
"epss_pct": 0.97097,
|
|
"name": "WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6671.yaml"
|
|
},
|
|
"CVE-2024-6690": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0052,
|
|
"epss_pct": 0.42114,
|
|
"name": "WP Content Copy Protection & No Right Click - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6690.yaml"
|
|
},
|
|
"CVE-2024-6746": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-24",
|
|
"epss": 0.03305,
|
|
"epss_pct": 0.8767,
|
|
"name": "EasySpider 0.6.2 - Arbitrary File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6746.yaml"
|
|
},
|
|
"CVE-2024-6753": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00822,
|
|
"epss_pct": 0.54781,
|
|
"name": "Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6753.yaml"
|
|
},
|
|
"CVE-2024-6781": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.62442,
|
|
"epss_pct": 0.99123,
|
|
"name": "Calibre <= 7.14.0 Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6781.yaml"
|
|
},
|
|
"CVE-2024-6782": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.84116,
|
|
"epss_pct": 0.99675,
|
|
"name": "Calibre <= 7.14.0 Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6782.yaml"
|
|
},
|
|
"CVE-2024-6842": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.31102,
|
|
"epss_pct": 0.98136,
|
|
"name": "AnythingLLM - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6842.yaml"
|
|
},
|
|
"CVE-2024-6845": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01104,
|
|
"epss_pct": 0.63445,
|
|
"name": "SmartSearchWP < 2.4.6 - OpenAI Key Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6845.yaml"
|
|
},
|
|
"CVE-2024-6846": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"epss": 0.01252,
|
|
"epss_pct": 0.67351,
|
|
"name": "SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6846.yaml"
|
|
},
|
|
"CVE-2024-6886": {
|
|
"cvss": 6.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.32968,
|
|
"epss_pct": 0.98236,
|
|
"name": "Gitea 1.22.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6886.yaml"
|
|
},
|
|
"CVE-2024-6892": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.0075,
|
|
"epss_pct": 0.52408,
|
|
"name": "Journyx 11.5.4 - Reflected Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6892.yaml"
|
|
},
|
|
"CVE-2024-6893": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.32916,
|
|
"epss_pct": 0.98233,
|
|
"name": "Journyx - XML External Entities Injection (XXE)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6893.yaml"
|
|
},
|
|
"CVE-2024-6911": {
|
|
"cvss": 8.7,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.04944,
|
|
"epss_pct": 0.91538,
|
|
"name": "PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6911.yaml"
|
|
},
|
|
"CVE-2024-6922": {
|
|
"epss": 0.30172,
|
|
"epss_pct": 0.98087,
|
|
"name": "Automation Anywhere Automation 360 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6922.yaml"
|
|
},
|
|
"CVE-2024-6924": {
|
|
"epss": 0.03292,
|
|
"epss_pct": 0.87622,
|
|
"name": "TrueBooker <= 1.0.2 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6924.yaml"
|
|
},
|
|
"CVE-2024-6926": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.03292,
|
|
"epss_pct": 0.87622,
|
|
"name": "Viral Signup <= 2.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6926.yaml"
|
|
},
|
|
"CVE-2024-6928": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.03292,
|
|
"epss_pct": 0.87622,
|
|
"name": "Opti Marketing <= 2.0.9 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6928.yaml"
|
|
},
|
|
"CVE-2024-7008": {
|
|
"epss": 0.25607,
|
|
"epss_pct": 0.97806,
|
|
"name": "Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7008.yaml"
|
|
},
|
|
"CVE-2024-7029": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.38739,
|
|
"epss_pct": 0.98475,
|
|
"name": "AVTECH IP Camera - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7029.yaml"
|
|
},
|
|
"CVE-2024-7097": {
|
|
"epss": 0.00665,
|
|
"epss_pct": 0.49273,
|
|
"name": "WSO2 User Registration - Arbitrary Account Creation",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7097.yaml"
|
|
},
|
|
"CVE-2024-7120": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.934,
|
|
"epss_pct": 0.99832,
|
|
"name": "Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7120.yaml"
|
|
},
|
|
"CVE-2024-7188": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07016,
|
|
"epss_pct": 0.93705,
|
|
"name": "Bylancer Quicklancer 2.4 G - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7188.yaml"
|
|
},
|
|
"CVE-2024-7313": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01551,
|
|
"epss_pct": 0.73337,
|
|
"name": "Shield Security Plugin < 20.0.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7313.yaml"
|
|
},
|
|
"CVE-2024-7314": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-280",
|
|
"epss": 0.51468,
|
|
"epss_pct": 0.98858,
|
|
"name": "AJ-Report < 1.4.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7314.yaml"
|
|
},
|
|
"CVE-2024-7332": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-259",
|
|
"epss": 0.20737,
|
|
"epss_pct": 0.97357,
|
|
"name": "TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7332.yaml"
|
|
},
|
|
"CVE-2024-7339": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.32028,
|
|
"epss_pct": 0.98183,
|
|
"name": "TVT DVR Sensitive Device - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7339.yaml"
|
|
},
|
|
"CVE-2024-7340": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.05015,
|
|
"epss_pct": 0.91641,
|
|
"name": "W&B Weave Server - Remote Arbitrary File Leak",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7340.yaml"
|
|
},
|
|
"CVE-2024-7354": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00702,
|
|
"epss_pct": 0.50738,
|
|
"name": "Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7354.yaml"
|
|
},
|
|
"CVE-2024-7399": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.91941,
|
|
"epss_pct": 0.9981,
|
|
"name": "Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7399.yaml"
|
|
},
|
|
"CVE-2024-7591": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.43844,
|
|
"epss_pct": 0.98651,
|
|
"name": "Kemp LoadMaster Load Balancer - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7591.yaml"
|
|
},
|
|
"CVE-2024-7593": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.9999,
|
|
"epss_pct": 0.99984,
|
|
"name": "Ivanti vTM - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7593.yaml"
|
|
},
|
|
"CVE-2024-7714": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.00848,
|
|
"epss_pct": 0.55568,
|
|
"name": "AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7714.yaml"
|
|
},
|
|
"CVE-2024-7786": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.01745,
|
|
"epss_pct": 0.76184,
|
|
"name": "Sensei LMS < 4.24.2 - Email Template Leak",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7786.yaml"
|
|
},
|
|
"CVE-2024-7854": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.04317,
|
|
"epss_pct": 0.90471,
|
|
"name": "Woo Inquiry <= 0.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7854.yaml"
|
|
},
|
|
"CVE-2024-7928": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.16882,
|
|
"epss_pct": 0.96824,
|
|
"name": "FastAdmin < V1.3.4.20220530 - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7928.yaml"
|
|
},
|
|
"CVE-2024-7954": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.90053,
|
|
"epss_pct": 0.99785,
|
|
"name": "SPIP Porte Plume Plugin - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7954.yaml"
|
|
},
|
|
"CVE-2024-8021": {
|
|
"epss": 0.00731,
|
|
"epss_pct": 0.51782,
|
|
"name": "Gradio - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8021.yaml"
|
|
},
|
|
"CVE-2024-8181": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
|
|
"epss": 0.4505,
|
|
"epss_pct": 0.98689,
|
|
"name": "Flowise <= 1.8.2 Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8181.yaml"
|
|
},
|
|
"CVE-2024-8252": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"name": "WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8252.yaml"
|
|
},
|
|
"CVE-2024-8353": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.2872,
|
|
"epss_pct": 0.98002,
|
|
"name": "GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8353.yaml"
|
|
},
|
|
"CVE-2024-8425": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04082,
|
|
"epss_pct": 0.89983,
|
|
"name": "WooCommerce Ultimate Gift Card \u2264 2.6.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8425.yaml"
|
|
},
|
|
"CVE-2024-8484": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.03792,
|
|
"epss_pct": 0.8922,
|
|
"name": "REST API TO MiniProgram <= 4.7.1 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8484.yaml"
|
|
},
|
|
"CVE-2024-8503": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.8023,
|
|
"epss_pct": 0.99587,
|
|
"name": "VICIdial - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8503.yaml"
|
|
},
|
|
"CVE-2024-8517": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-646",
|
|
"epss": 0.94614,
|
|
"epss_pct": 0.99848,
|
|
"name": "SPIP BigUp Plugin - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8517.yaml"
|
|
},
|
|
"CVE-2024-8522": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.62882,
|
|
"epss_pct": 0.99134,
|
|
"name": "LearnPress < 4.2.7.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8522.yaml"
|
|
},
|
|
"CVE-2024-8529": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.11831,
|
|
"epss_pct": 0.95787,
|
|
"name": "LearnPress < 4.2.7.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8529.yaml"
|
|
},
|
|
"CVE-2024-8625": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02323,
|
|
"epss_pct": 0.82272,
|
|
"name": "WordPress TS Poll < 2.4.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8625.yaml"
|
|
},
|
|
"CVE-2024-8673": {
|
|
"cvss": 3.5,
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01792,
|
|
"epss_pct": 0.76824,
|
|
"name": "Z-Downloads < 1.11.7 - Cross-Site Scripting",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8673.yaml"
|
|
},
|
|
"CVE-2024-8698": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
|
|
"cwe": "CWE-347",
|
|
"epss": 0.0203,
|
|
"epss_pct": 0.79663,
|
|
"name": "Keycloak - SAML Core Package Signature Validation Flaw",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8698.yaml"
|
|
},
|
|
"CVE-2024-8752": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.11759,
|
|
"epss_pct": 0.95765,
|
|
"name": "WebIQ 2.15.9 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8752.yaml"
|
|
},
|
|
"CVE-2024-8852": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.01207,
|
|
"epss_pct": 0.66159,
|
|
"name": "All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8852.yaml"
|
|
},
|
|
"CVE-2024-8856": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.94004,
|
|
"epss_pct": 0.99838,
|
|
"name": "WP Time Capsule Plugin - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8856.yaml"
|
|
},
|
|
"CVE-2024-8859": {
|
|
"epss": 0.02669,
|
|
"epss_pct": 0.84684,
|
|
"name": "Mlflow < 2.17.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8859.yaml"
|
|
},
|
|
"CVE-2024-8877": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.77265,
|
|
"epss_pct": 0.99519,
|
|
"name": "Riello Netman 204 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8877.yaml"
|
|
},
|
|
"CVE-2024-8883": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.02076,
|
|
"epss_pct": 0.8014,
|
|
"name": "Keycloak - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8883.yaml"
|
|
},
|
|
"CVE-2024-8911": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02904,
|
|
"epss_pct": 0.85986,
|
|
"name": "LatePoint <= 5.0.11 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8911.yaml"
|
|
},
|
|
"CVE-2024-8943": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.0308,
|
|
"epss_pct": 0.86739,
|
|
"name": "LatePoint <= 5.0.12 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8943.yaml"
|
|
},
|
|
"CVE-2024-8963": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.98607,
|
|
"epss_pct": 0.9992,
|
|
"name": "Ivanti Cloud Services Appliance - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8963.yaml"
|
|
},
|
|
"CVE-2024-9007": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01006,
|
|
"epss_pct": 0.60571,
|
|
"name": "123Solar 1.8.4.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9007.yaml"
|
|
},
|
|
"CVE-2024-9014": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.09685,
|
|
"epss_pct": 0.95153,
|
|
"name": "pgAdmin 4 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9014.yaml"
|
|
},
|
|
"CVE-2024-9047": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.93339,
|
|
"epss_pct": 0.99831,
|
|
"name": "WordPress File Upload <= 4.24.11 - Arbitrary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9047.yaml"
|
|
},
|
|
"CVE-2024-9061": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.52266,
|
|
"epss_pct": 0.98877,
|
|
"name": "WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9061.yaml"
|
|
},
|
|
"CVE-2024-9161": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02131,
|
|
"epss_pct": 0.8066,
|
|
"name": "Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9161.yaml"
|
|
},
|
|
"CVE-2024-9166": {
|
|
"cwe": "CWE-78",
|
|
"epss": 0.01578,
|
|
"epss_pct": 0.73734,
|
|
"name": "TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9166.yaml"
|
|
},
|
|
"CVE-2024-9186": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02291,
|
|
"epss_pct": 0.82009,
|
|
"name": "Automation By Autonami < 3.3.0 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9186.yaml"
|
|
},
|
|
"CVE-2024-9193": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.03292,
|
|
"epss_pct": 0.87621,
|
|
"name": "WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9193.yaml"
|
|
},
|
|
"CVE-2024-9234": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.10446,
|
|
"epss_pct": 0.95409,
|
|
"name": "GutenKit <= 2.1.0 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9234.yaml"
|
|
},
|
|
"CVE-2024-9264": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.94864,
|
|
"epss_pct": 0.99853,
|
|
"name": "Grafana Post-Auth DuckDB - SQL Injection To File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9264.yaml"
|
|
},
|
|
"CVE-2024-9362": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04274,
|
|
"epss_pct": 0.90392,
|
|
"name": "Polyaxon - Unauthenticated Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9362.yaml"
|
|
},
|
|
"CVE-2024-9463": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/S",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.98546,
|
|
"epss_pct": 0.99919,
|
|
"name": "PaloAlto Networks Expedition - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9463.yaml"
|
|
},
|
|
"CVE-2024-9465": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99626,
|
|
"epss_pct": 0.99946,
|
|
"name": "Palo Alto Expedition - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9465.yaml"
|
|
},
|
|
"CVE-2024-9474": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.94701,
|
|
"epss_pct": 0.9985,
|
|
"name": "PAN-OS Management Web Interface - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9474.yaml"
|
|
},
|
|
"CVE-2024-9487": {
|
|
"epss": 0.25607,
|
|
"epss_pct": 0.97806,
|
|
"name": "GitHub Enterprise - SAML Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-9487.yaml"
|
|
},
|
|
"CVE-2024-9593": {
|
|
"cvss": 8.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.12312,
|
|
"epss_pct": 0.95898,
|
|
"name": "Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9593.yaml"
|
|
},
|
|
"CVE-2024-9617": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.0166,
|
|
"epss_pct": 0.74969,
|
|
"name": "Danswer - Insecure Direct Object Reference",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9617.yaml"
|
|
},
|
|
"CVE-2024-9643": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.03039,
|
|
"epss_pct": 0.86575,
|
|
"name": "Four-Faith F3x36 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9643.yaml"
|
|
},
|
|
"CVE-2024-9707": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.09078,
|
|
"epss_pct": 0.9492,
|
|
"name": "Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9707.yaml"
|
|
},
|
|
"CVE-2024-9765": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.01554,
|
|
"epss_pct": 0.73382,
|
|
"name": "EKC Tournament Manager WordPress plugin - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9765.yaml"
|
|
},
|
|
"CVE-2024-9772": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.01458,
|
|
"epss_pct": 0.7167,
|
|
"name": "WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9772.yaml"
|
|
},
|
|
"CVE-2024-9796": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02996,
|
|
"epss_pct": 0.86393,
|
|
"name": "WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9796.yaml"
|
|
},
|
|
"CVE-2024-9916": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.73617,
|
|
"epss_pct": 0.99429,
|
|
"name": "HuangDou UTCMS V9 - OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9916.yaml"
|
|
},
|
|
"CVE-2024-9935": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0749,
|
|
"epss_pct": 0.94038,
|
|
"name": "PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9935.yaml"
|
|
},
|
|
"CVE-2024-9989": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.0717,
|
|
"epss_pct": 0.93831,
|
|
"name": "Crypto <= 2.15 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9989.yaml"
|
|
},
|
|
"CVE-2025-0107": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.78532,
|
|
"epss_pct": 0.99553,
|
|
"name": "Palo Alto Networks Expedition - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0107.yaml"
|
|
},
|
|
"CVE-2025-0108": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.98455,
|
|
"epss_pct": 0.99916,
|
|
"name": "PAN-OS Management Interface - Path Confusion to Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0108.yaml"
|
|
},
|
|
"CVE-2025-0133": {
|
|
"epss": 0.46401,
|
|
"epss_pct": 0.98729,
|
|
"name": "PAN-OS - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0133.yaml"
|
|
},
|
|
"CVE-2025-0282": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.99979,
|
|
"epss_pct": 0.99979,
|
|
"name": "Ivanti Connect Secure - Stack-based Buffer Overflow",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0282.yaml"
|
|
},
|
|
"CVE-2025-0520": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.02547,
|
|
"epss_pct": 0.83885,
|
|
"name": "ShowDoc - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0520.yaml"
|
|
},
|
|
"CVE-2025-0674": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.03583,
|
|
"epss_pct": 0.88581,
|
|
"name": "Elber ESE DVB-S/S2 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0674.yaml"
|
|
},
|
|
"CVE-2025-0868": {
|
|
"epss": 0.16953,
|
|
"epss_pct": 0.96838,
|
|
"name": "DocsGPT - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0868.yaml"
|
|
},
|
|
"CVE-2025-10035": {
|
|
"name": "GoAnywhere - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10035.yaml"
|
|
},
|
|
"CVE-2025-10090": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"epss": 0.01791,
|
|
"epss_pct": 0.768,
|
|
"name": "Jinher OA - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10090.yaml"
|
|
},
|
|
"CVE-2025-10162": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03632,
|
|
"epss_pct": 0.88723,
|
|
"name": "WordPress OrderConvo < 14 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10162.yaml"
|
|
},
|
|
"CVE-2025-10204": {
|
|
"cwe": "CWE-306",
|
|
"name": "AC Smart II - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10204.yaml"
|
|
},
|
|
"CVE-2025-10210": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01297,
|
|
"epss_pct": 0.68362,
|
|
"name": "ChanCMS <= 3.3.0 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10210.yaml"
|
|
},
|
|
"CVE-2025-10211": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00705,
|
|
"epss_pct": 0.50816,
|
|
"name": "ChanCMS <= 3.3.0 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10211.yaml"
|
|
},
|
|
"CVE-2025-1023": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02407,
|
|
"epss_pct": 0.82906,
|
|
"name": "ChurchCRM - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1023.yaml"
|
|
},
|
|
"CVE-2025-1025": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.19493,
|
|
"epss_pct": 0.97178,
|
|
"name": "Cockpit < 2.4.1 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1025.yaml"
|
|
},
|
|
"CVE-2025-1035": {
|
|
"cvss": 5.7,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.09861,
|
|
"epss_pct": 0.95216,
|
|
"name": "KLog Server - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1035.yaml"
|
|
},
|
|
"CVE-2025-10353": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.02482,
|
|
"epss_pct": 0.83442,
|
|
"name": "Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10353.yaml"
|
|
},
|
|
"CVE-2025-10897": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01817,
|
|
"epss_pct": 0.77166,
|
|
"name": "WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10897.yaml"
|
|
},
|
|
"CVE-2025-1097": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.35534,
|
|
"epss_pct": 0.98336,
|
|
"name": "Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1097.yaml"
|
|
},
|
|
"CVE-2025-1098": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.83498,
|
|
"epss_pct": 0.99661,
|
|
"name": "Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1098.yaml"
|
|
},
|
|
"CVE-2025-11307": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01846,
|
|
"epss_pct": 0.77538,
|
|
"name": "WP Google Maps < 9.0.48 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11307.yaml"
|
|
},
|
|
"CVE-2025-11368": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00976,
|
|
"epss_pct": 0.59665,
|
|
"name": "LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11368.yaml"
|
|
},
|
|
"CVE-2025-11371": {
|
|
"cvss": 6.2,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-552",
|
|
"epss": 0.92094,
|
|
"epss_pct": 0.99813,
|
|
"name": "Gladinet CentreStack & TrioFox - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11371.yaml"
|
|
},
|
|
"CVE-2025-11580": {
|
|
"name": "PowerJob List - Authorization Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11580.yaml"
|
|
},
|
|
"CVE-2025-11693": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.02135,
|
|
"epss_pct": 0.80706,
|
|
"name": "Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11693.yaml"
|
|
},
|
|
"CVE-2025-11700": {
|
|
"name": "N-central - XML External Entities Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11700.yaml"
|
|
},
|
|
"CVE-2025-11749": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.74759,
|
|
"epss_pct": 0.99466,
|
|
"name": "WordPress AI Engine Plugin - Token Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11749.yaml"
|
|
},
|
|
"CVE-2025-11750": {
|
|
"name": "Dify - User Enumeration via \"Account not found\" Message",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11750.yaml"
|
|
},
|
|
"CVE-2025-11833": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.51005,
|
|
"epss_pct": 0.98846,
|
|
"name": "Post SMTP <= 3.6.0 - Email Log Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11833.yaml"
|
|
},
|
|
"CVE-2025-11953": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.9398,
|
|
"epss_pct": 0.99838,
|
|
"name": "React Native Community CLI - Unauthenticated OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11953.yaml"
|
|
},
|
|
"CVE-2025-12055": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03572,
|
|
"epss_pct": 0.88544,
|
|
"name": "MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12055.yaml"
|
|
},
|
|
"CVE-2025-12101": {
|
|
"name": "Citrix NetScaler ADC & Gateway - Reflected XSS / Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-12101.yaml"
|
|
},
|
|
"CVE-2025-12139": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02328,
|
|
"epss_pct": 0.82314,
|
|
"name": "Integrate Google Drive <= 1.5.3 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12139.yaml"
|
|
},
|
|
"CVE-2025-1232": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01877,
|
|
"epss_pct": 0.77931,
|
|
"name": "Site Reviews < 7.2.5 - Unauthenticated Stored XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1232.yaml"
|
|
},
|
|
"CVE-2025-12480": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.90532,
|
|
"epss_pct": 0.99793,
|
|
"name": "Triofox - Improper Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12480.yaml"
|
|
},
|
|
"CVE-2025-12536": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00797,
|
|
"epss_pct": 0.53961,
|
|
"name": "SureForms <= 1.13.1 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12536.yaml"
|
|
},
|
|
"CVE-2025-12841": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00715,
|
|
"epss_pct": 0.51209,
|
|
"name": "WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12841.yaml"
|
|
},
|
|
"CVE-2025-1302": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.10395,
|
|
"epss_pct": 0.95395,
|
|
"name": "JSONPath Plus < 10.3.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1302.yaml"
|
|
},
|
|
"CVE-2025-1303": {
|
|
"name": "Plugin Oficial \u2013 Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1303.yaml"
|
|
},
|
|
"CVE-2025-13138": {
|
|
"name": "WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13138.yaml"
|
|
},
|
|
"CVE-2025-1323": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02856,
|
|
"epss_pct": 0.85751,
|
|
"name": "WP-Recall \u2013 Plugin <= 16.26.10 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1323.yaml"
|
|
},
|
|
"CVE-2025-13315": {
|
|
"name": "Twonky Server 8.5.2 on Linux and Windows - Log File Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13315.yaml"
|
|
},
|
|
"CVE-2025-13339": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02246,
|
|
"epss_pct": 0.81645,
|
|
"name": "Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13339.yaml"
|
|
},
|
|
"CVE-2025-13342": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02192,
|
|
"epss_pct": 0.8118,
|
|
"name": "DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13342.yaml"
|
|
},
|
|
"CVE-2025-1338": {
|
|
"cwe": "CWE-78",
|
|
"epss": 0.51397,
|
|
"epss_pct": 0.98856,
|
|
"name": "NUUO Camera <=20250203 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1338.yaml"
|
|
},
|
|
"CVE-2025-13390": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.04593,
|
|
"epss_pct": 0.90986,
|
|
"name": "WP Directory Kit <= 1.4.4 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13390.yaml"
|
|
},
|
|
"CVE-2025-13418": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00611,
|
|
"epss_pct": 0.46848,
|
|
"name": "Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13418.yaml"
|
|
},
|
|
"CVE-2025-13486": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"name": "Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13486.yaml"
|
|
},
|
|
"CVE-2025-13528": {
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00729,
|
|
"epss_pct": 0.51703,
|
|
"name": "Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13528.yaml"
|
|
},
|
|
"CVE-2025-1361": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01287,
|
|
"epss_pct": 0.68138,
|
|
"name": "IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1361.yaml"
|
|
},
|
|
"CVE-2025-13652": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01101,
|
|
"epss_pct": 0.63368,
|
|
"name": "WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13652.yaml"
|
|
},
|
|
"CVE-2025-13773": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.03766,
|
|
"epss_pct": 0.89139,
|
|
"name": "WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13773.yaml"
|
|
},
|
|
"CVE-2025-13801": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"name": "Yoco Payments <= 3.8.8 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13801.yaml"
|
|
},
|
|
"CVE-2025-13920": {
|
|
"cvss": 6.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00669,
|
|
"epss_pct": 0.49449,
|
|
"name": "WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13920.yaml"
|
|
},
|
|
"CVE-2025-13956": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00906,
|
|
"epss_pct": 0.57362,
|
|
"name": "LearnPress < 4.3.2 - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13956.yaml"
|
|
},
|
|
"CVE-2025-14047": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00902,
|
|
"epss_pct": 0.57237,
|
|
"name": "User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14047.yaml"
|
|
},
|
|
"CVE-2025-14124": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01594,
|
|
"epss_pct": 0.7397,
|
|
"name": "Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14124.yaml"
|
|
},
|
|
"CVE-2025-14155": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00782,
|
|
"epss_pct": 0.53454,
|
|
"name": "Premium Addons for Elementor - Unauthenticated Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14155.yaml"
|
|
},
|
|
"CVE-2025-14340": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01002,
|
|
"epss_pct": 0.60462,
|
|
"name": "Payara Server - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14340.yaml"
|
|
},
|
|
"CVE-2025-14437": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.01944,
|
|
"epss_pct": 0.78728,
|
|
"name": "WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14437.yaml"
|
|
},
|
|
"CVE-2025-14528": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03991,
|
|
"epss_pct": 0.89779,
|
|
"name": "D-Link DIR-803 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14528.yaml"
|
|
},
|
|
"CVE-2025-14611": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-321",
|
|
"name": "Gladinet CentreStack & Triofox - Hardcoded Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14611.yaml"
|
|
},
|
|
"CVE-2025-14726": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
|
|
"epss": 0.0083,
|
|
"epss_pct": 0.55027,
|
|
"name": "WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14726.yaml"
|
|
},
|
|
"CVE-2025-14847": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-908",
|
|
"epss": 0.83218,
|
|
"epss_pct": 0.99655,
|
|
"name": "MongoDB Server - Information Disclosure (MongoBleed)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-14847.yaml"
|
|
},
|
|
"CVE-2025-14998": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.0181,
|
|
"epss_pct": 0.77069,
|
|
"name": "Branda WordPress plugin - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14998.yaml"
|
|
},
|
|
"CVE-2025-15403": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.01422,
|
|
"epss_pct": 0.70987,
|
|
"name": "RegistrationMagic <= 6.0.7.1 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-15403.yaml"
|
|
},
|
|
"CVE-2025-1550": {
|
|
"epss": 0.02581,
|
|
"epss_pct": 0.8412,
|
|
"name": "Keras Model.load_model - Arbitrary Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-1550.yaml"
|
|
},
|
|
"CVE-2025-15503": {
|
|
"cwe": "CWE-434",
|
|
"epss": 0.01949,
|
|
"epss_pct": 0.78786,
|
|
"name": "Sangfor OSM - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-15503.yaml"
|
|
},
|
|
"CVE-2025-1562": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.03021,
|
|
"epss_pct": 0.86506,
|
|
"name": "Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1562.yaml"
|
|
},
|
|
"CVE-2025-1595": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01094,
|
|
"epss_pct": 0.63171,
|
|
"name": "EasyCVR <=2.1.2 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1595.yaml"
|
|
},
|
|
"CVE-2025-1661": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.56382,
|
|
"epss_pct": 0.98982,
|
|
"name": "HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1661.yaml"
|
|
},
|
|
"CVE-2025-1743": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01628,
|
|
"epss_pct": 0.74473,
|
|
"name": "Pichome 2.1.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1743.yaml"
|
|
},
|
|
"CVE-2025-1974": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-653",
|
|
"epss": 0.99525,
|
|
"epss_pct": 0.99943,
|
|
"name": "Ingress-Nginx Controller - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1974.yaml"
|
|
},
|
|
"CVE-2025-2010": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01737,
|
|
"epss_pct": 0.76072,
|
|
"name": "WordPress JobWP Plugin <= 2.3.9 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2010.yaml"
|
|
},
|
|
"CVE-2025-2011": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.46373,
|
|
"epss_pct": 0.98728,
|
|
"name": "Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2011.yaml"
|
|
},
|
|
"CVE-2025-20188": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.27136,
|
|
"epss_pct": 0.97906,
|
|
"name": "Cisco IOS XE WLC - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20188.yaml"
|
|
},
|
|
"CVE-2025-20281": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.97093,
|
|
"epss_pct": 0.99886,
|
|
"name": "Cisco ISE - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20281.yaml"
|
|
},
|
|
"CVE-2025-20282": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.27003,
|
|
"epss_pct": 0.97894,
|
|
"name": "Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20282.yaml"
|
|
},
|
|
"CVE-2025-20362": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.87085,
|
|
"epss_pct": 0.99734,
|
|
"name": "Cisco Secure Firewall ASA & FTD - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20362.yaml"
|
|
},
|
|
"CVE-2025-2075": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02656,
|
|
"epss_pct": 0.84601,
|
|
"name": "Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2075.yaml"
|
|
},
|
|
"CVE-2025-2127": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00966,
|
|
"epss_pct": 0.59252,
|
|
"name": "JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2127.yaml"
|
|
},
|
|
"CVE-2025-2129": {
|
|
"cvss": 5.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-1188",
|
|
"epss": 0.01056,
|
|
"epss_pct": 0.62056,
|
|
"name": "Mage AI - Insecure Default Authentication Setup",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2129.yaml"
|
|
},
|
|
"CVE-2025-2221": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01691,
|
|
"epss_pct": 0.75441,
|
|
"name": "WordPress WPCOM Member <= 1.7.6 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2221.yaml"
|
|
},
|
|
"CVE-2025-22214": {
|
|
"name": "Landray EIS SQL\u6ce8\u5165\u6f0f\u6d1e",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-22214.yaml"
|
|
},
|
|
"CVE-2025-22457": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.9998,
|
|
"epss_pct": 0.99981,
|
|
"name": "Ivanti Connect Secure - Stack-based Buffer Overflow",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-22457.yaml"
|
|
},
|
|
"CVE-2025-2264": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.34548,
|
|
"epss_pct": 0.983,
|
|
"name": "Sante PACS Server.exe - Path Traversal Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2264.yaml"
|
|
},
|
|
"CVE-2025-22785": {
|
|
"name": "Course Booking System <= 6.0.6 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-22785.yaml"
|
|
},
|
|
"CVE-2025-2294": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.78202,
|
|
"epss_pct": 0.99544,
|
|
"name": "Kubio AI Page Builder <= 2.5.1 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2294.yaml"
|
|
},
|
|
"CVE-2025-22952": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02899,
|
|
"epss_pct": 0.85965,
|
|
"name": "Elestio Memos <= v0.24.0 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-22952.yaml"
|
|
},
|
|
"CVE-2025-23061": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.07284,
|
|
"epss_pct": 0.93913,
|
|
"name": "Mongoose - NoSQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-23061.yaml"
|
|
},
|
|
"CVE-2025-23211": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.03593,
|
|
"epss_pct": 0.88613,
|
|
"name": "Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-23211.yaml"
|
|
},
|
|
"CVE-2025-24016": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.9384,
|
|
"epss_pct": 0.99837,
|
|
"name": "Wazuh - Unsafe Deserialization Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24016.yaml"
|
|
},
|
|
"CVE-2025-24354": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00875,
|
|
"epss_pct": 0.56468,
|
|
"name": "Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24354.yaml"
|
|
},
|
|
"CVE-2025-24514": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.32618,
|
|
"epss_pct": 0.98215,
|
|
"name": "Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24514.yaml"
|
|
},
|
|
"CVE-2025-24582": {
|
|
"name": "12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24582.yaml"
|
|
},
|
|
"CVE-2025-2473": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02442,
|
|
"epss_pct": 0.83157,
|
|
"name": "Company Visitor Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2473.yaml"
|
|
},
|
|
"CVE-2025-24752": {
|
|
"epss": 0.01198,
|
|
"epss_pct": 0.65941,
|
|
"name": "Essential Addons for Elementor < 6.0.15 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-24752.yaml"
|
|
},
|
|
"CVE-2025-24786": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02675,
|
|
"epss_pct": 0.84732,
|
|
"name": "WhoDB < 0.45.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24786.yaml"
|
|
},
|
|
"CVE-2025-24799": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.86348,
|
|
"epss_pct": 0.9972,
|
|
"name": "GLPI < 10.0.17 - Pre-Auth SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24799.yaml"
|
|
},
|
|
"CVE-2025-24813": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.99927,
|
|
"epss_pct": 0.99967,
|
|
"name": "Apache Tomcat Path Equivalence - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24813.yaml"
|
|
},
|
|
"CVE-2025-24893": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-95",
|
|
"epss": 0.99864,
|
|
"epss_pct": 0.9996,
|
|
"name": "XWiki Platform - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24893.yaml"
|
|
},
|
|
"CVE-2025-24963": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02384,
|
|
"epss_pct": 0.82724,
|
|
"name": "Vitest Browser Mode - Local File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24963.yaml"
|
|
},
|
|
"CVE-2025-25034": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.04516,
|
|
"epss_pct": 0.90839,
|
|
"name": "SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25034.yaml"
|
|
},
|
|
"CVE-2025-25037": {
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01454,
|
|
"epss_pct": 0.71589,
|
|
"name": "Aquatronica Controller System <= 5.1.6 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25037.yaml"
|
|
},
|
|
"CVE-2025-2505": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.04802,
|
|
"epss_pct": 0.91316,
|
|
"name": "WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2505.yaml"
|
|
},
|
|
"CVE-2025-25062": {
|
|
"cvss": 4.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01721,
|
|
"epss_pct": 0.75862,
|
|
"name": "Backdrop CMS - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-25062.yaml"
|
|
},
|
|
"CVE-2025-25231": {
|
|
"name": "Omnissa Workspace ONE UEM - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25231.yaml"
|
|
},
|
|
"CVE-2025-25256": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.60344,
|
|
"epss_pct": 0.99074,
|
|
"name": "Fortinet FortiSIEM - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-25256.yaml"
|
|
},
|
|
"CVE-2025-25257": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.99772,
|
|
"epss_pct": 0.99954,
|
|
"name": "Fortinet FortiWeb - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25257.yaml"
|
|
},
|
|
"CVE-2025-25291": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-347",
|
|
"epss": 0.2026,
|
|
"epss_pct": 0.97284,
|
|
"name": "GitLab - SAML Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-25291.yaml"
|
|
},
|
|
"CVE-2025-25296": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01898,
|
|
"epss_pct": 0.78187,
|
|
"name": "Label Studio < 1.16.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25296.yaml"
|
|
},
|
|
"CVE-2025-2539": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-327",
|
|
"epss": 0.01624,
|
|
"epss_pct": 0.74418,
|
|
"name": "File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2539.yaml"
|
|
},
|
|
"CVE-2025-25570": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.02056,
|
|
"epss_pct": 0.79936,
|
|
"name": "Vue Vben Admin - Default Credentials",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25570.yaml"
|
|
},
|
|
"CVE-2025-2558": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-98",
|
|
"name": "WordPress The Wound Theme <= 0.0.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2558.yaml"
|
|
},
|
|
"CVE-2025-2563": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.46384,
|
|
"epss_pct": 0.98728,
|
|
"name": "User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2563.yaml"
|
|
},
|
|
"CVE-2025-2609": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01101,
|
|
"epss_pct": 0.63361,
|
|
"name": "MagnusBilling Login Logs - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2609.yaml"
|
|
},
|
|
"CVE-2025-2610": {
|
|
"cvss": 7.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0092,
|
|
"epss_pct": 0.57801,
|
|
"name": "MagnusBilling Alarm Module - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2610.yaml"
|
|
},
|
|
"CVE-2025-2611": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.05991,
|
|
"epss_pct": 0.92795,
|
|
"name": "ICTBroadcast - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2611.yaml"
|
|
},
|
|
"CVE-2025-26319": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.55869,
|
|
"epss_pct": 0.98969,
|
|
"name": "FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-26319.yaml"
|
|
},
|
|
"CVE-2025-2636": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10241,
|
|
"epss_pct": 0.95342,
|
|
"name": "InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2636.yaml"
|
|
},
|
|
"CVE-2025-26399": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.895,
|
|
"epss_pct": 0.99774,
|
|
"name": "SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-26399.yaml"
|
|
},
|
|
"CVE-2025-26793": {
|
|
"epss": 0.02369,
|
|
"epss_pct": 0.82626,
|
|
"name": "FREEDOM Administration - Default Login",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-26793.yaml"
|
|
},
|
|
"CVE-2025-27007": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-266",
|
|
"epss": 0.5148,
|
|
"epss_pct": 0.9886,
|
|
"name": "OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27007.yaml"
|
|
},
|
|
"CVE-2025-2709": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00938,
|
|
"epss_pct": 0.58416,
|
|
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2709.yaml"
|
|
},
|
|
"CVE-2025-2710": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00938,
|
|
"epss_pct": 0.58418,
|
|
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2710.yaml"
|
|
},
|
|
"CVE-2025-2711": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00938,
|
|
"epss_pct": 0.58416,
|
|
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2711.yaml"
|
|
},
|
|
"CVE-2025-27112": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.00963,
|
|
"epss_pct": 0.59202,
|
|
"name": "Navidrome <=0.54.5 - Authentication Bypass in Subsonic API",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27112.yaml"
|
|
},
|
|
"CVE-2025-2712": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00825,
|
|
"epss_pct": 0.54867,
|
|
"name": "Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2712.yaml"
|
|
},
|
|
"CVE-2025-27134": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.02065,
|
|
"epss_pct": 0.80034,
|
|
"name": "Joplin 3.3.3 Server - Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27134.yaml"
|
|
},
|
|
"CVE-2025-27218": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.65003,
|
|
"epss_pct": 0.9919,
|
|
"name": "Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27218.yaml"
|
|
},
|
|
"CVE-2025-27222": {
|
|
"name": "TRUfusion Enterprise <= 7.10.4.0 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27222.yaml"
|
|
},
|
|
"CVE-2025-27223": {
|
|
"name": "TRUfusion Enterprise <= 7.10.4.0 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27223.yaml"
|
|
},
|
|
"CVE-2025-27225": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.17222,
|
|
"epss_pct": 0.96874,
|
|
"name": "TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27225.yaml"
|
|
},
|
|
"CVE-2025-2746": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.59052,
|
|
"epss_pct": 0.99043,
|
|
"name": "Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2746.yaml"
|
|
},
|
|
"CVE-2025-2747": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.92488,
|
|
"epss_pct": 0.99818,
|
|
"name": "Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2747.yaml"
|
|
},
|
|
"CVE-2025-2748": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.60586,
|
|
"epss_pct": 0.99079,
|
|
"name": "Kentico Xperience CMS - Unauthenticated Stored XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2748.yaml"
|
|
},
|
|
"CVE-2025-27505": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01103,
|
|
"epss_pct": 0.63419,
|
|
"name": "GeoServer - Missing Authorization on REST API Index",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27505.yaml"
|
|
},
|
|
"CVE-2025-27506": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00685,
|
|
"epss_pct": 0.50113,
|
|
"name": "NocoDB < 0.258.0 - Reflected XSS in Password Reset",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27506.yaml"
|
|
},
|
|
"CVE-2025-2775": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.42952,
|
|
"epss_pct": 0.98622,
|
|
"name": "SysAid On-Prem <= 23.3.40 - XML External Entity",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2775.yaml"
|
|
},
|
|
"CVE-2025-2776": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.64397,
|
|
"epss_pct": 0.99175,
|
|
"name": "SysAid On-Prem <= 23.3.40 - XML External Entity",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2776.yaml"
|
|
},
|
|
"CVE-2025-2777": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.72202,
|
|
"epss_pct": 0.99389,
|
|
"name": "SysAid On-Prem <= 23.3.40 - XML External Entity",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2777.yaml"
|
|
},
|
|
"CVE-2025-27817": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.65905,
|
|
"epss_pct": 0.99214,
|
|
"name": "Apache Kafka Client - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27817.yaml"
|
|
},
|
|
"CVE-2025-27888": {
|
|
"epss": 0.01726,
|
|
"epss_pct": 0.75918,
|
|
"name": "Apache Druid - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27888.yaml"
|
|
},
|
|
"CVE-2025-27892": {
|
|
"cvss": 6.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.119,
|
|
"epss_pct": 0.95804,
|
|
"name": "Shopware < 6.5.8.13 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27892.yaml"
|
|
},
|
|
"CVE-2025-27915": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03918,
|
|
"epss_pct": 0.89583,
|
|
"name": "Zimbra - Cross-Site Scripting via ICS Files",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml"
|
|
},
|
|
"CVE-2025-28228": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.01754,
|
|
"epss_pct": 0.76321,
|
|
"name": "Electrolink FM/DAB/TV Transmitter - Credentials Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28228.yaml"
|
|
},
|
|
"CVE-2025-28242": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-384",
|
|
"name": "DAEnetIP4 METO v1.25 - Session Hijacking",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28242.yaml"
|
|
},
|
|
"CVE-2025-28367": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.02092,
|
|
"epss_pct": 0.80318,
|
|
"name": "mojoPortal <=2.9.0.1 - Directory Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28367.yaml"
|
|
},
|
|
"CVE-2025-28906": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00498,
|
|
"epss_pct": 0.40679,
|
|
"name": "Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-28906.yaml"
|
|
},
|
|
"CVE-2025-2907": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01372,
|
|
"epss_pct": 0.70014,
|
|
"name": "Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2907.yaml"
|
|
},
|
|
"CVE-2025-29085": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.29346,
|
|
"epss_pct": 0.98041,
|
|
"name": "Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29085.yaml"
|
|
},
|
|
"CVE-2025-29306": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.4628,
|
|
"epss_pct": 0.98725,
|
|
"name": "FoxCMS v.1.2.5 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29306.yaml"
|
|
},
|
|
"CVE-2025-29635": {
|
|
"cvss": 7.2,
|
|
"cwe": "CWE-78",
|
|
"epss": 0.87823,
|
|
"epss_pct": 0.9975,
|
|
"name": "D-Link DIR-823X set_prohibiting - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29635.yaml"
|
|
},
|
|
"CVE-2025-29925": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-285",
|
|
"name": "XWiki REST API - Private Pages Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29925.yaml"
|
|
},
|
|
"CVE-2025-29927": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99225,
|
|
"epss_pct": 0.99934,
|
|
"name": "Next.js Middleware Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29927.yaml"
|
|
},
|
|
"CVE-2025-30208": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.74969,
|
|
"epss_pct": 0.99469,
|
|
"name": "Vite - Arbitrary File Read",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30208.yaml"
|
|
},
|
|
"CVE-2025-30220": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.46131,
|
|
"epss_pct": 0.98721,
|
|
"name": "GeoServer WFS - XXE Processing Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30220.yaml"
|
|
},
|
|
"CVE-2025-30406": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.94252,
|
|
"epss_pct": 0.99843,
|
|
"name": "Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30406.yaml"
|
|
},
|
|
"CVE-2025-30567": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02786,
|
|
"epss_pct": 0.8539,
|
|
"name": "WordPress WP01 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30567.yaml"
|
|
},
|
|
"CVE-2025-3102": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-697",
|
|
"epss": 0.7568,
|
|
"epss_pct": 0.99482,
|
|
"name": "SureTriggers \u2013 All-in-One Automation Platform \u2264 1.0.78 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3102.yaml"
|
|
},
|
|
"CVE-2025-31125": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.58462,
|
|
"epss_pct": 0.99031,
|
|
"name": "Vite Development Server - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31125.yaml"
|
|
},
|
|
"CVE-2025-31131": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05382,
|
|
"epss_pct": 0.92094,
|
|
"name": "Yeswiki < 4.5.2 - Unauthenticated Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31131.yaml"
|
|
},
|
|
"CVE-2025-31161": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.99951,
|
|
"epss_pct": 0.99973,
|
|
"name": "CrushFTP - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31161.yaml"
|
|
},
|
|
"CVE-2025-31324": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.99512,
|
|
"epss_pct": 0.99942,
|
|
"name": "SAP NetWeaver Visual Composer Metadata Uploader - Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31324.yaml"
|
|
},
|
|
"CVE-2025-31486": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.40175,
|
|
"epss_pct": 0.98533,
|
|
"name": "Vite server.fs.deny Bypass - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31486.yaml"
|
|
},
|
|
"CVE-2025-31489": {
|
|
"epss": 0.02428,
|
|
"epss_pct": 0.83073,
|
|
"name": "MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31489.yaml"
|
|
},
|
|
"CVE-2025-32257": {
|
|
"name": "1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32257.yaml"
|
|
},
|
|
"CVE-2025-32355": {
|
|
"name": "Rocket TRUfusion Enterprise - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32355.yaml"
|
|
},
|
|
"CVE-2025-32395": {
|
|
"cvss": 6.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01725,
|
|
"epss_pct": 0.75912,
|
|
"name": "Vite - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32395.yaml"
|
|
},
|
|
"CVE-2025-32429": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.84036,
|
|
"epss_pct": 0.99674,
|
|
"name": "XWiki Platform - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32429.yaml"
|
|
},
|
|
"CVE-2025-32430": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00634,
|
|
"epss_pct": 0.4791,
|
|
"name": "XWiki Platform - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32430.yaml"
|
|
},
|
|
"CVE-2025-32432": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99837,
|
|
"epss_pct": 0.99959,
|
|
"name": "CraftCMS - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32432.yaml"
|
|
},
|
|
"CVE-2025-32433": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.98594,
|
|
"epss_pct": 0.99919,
|
|
"name": "Erlang/OTP SSH - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-32433.yaml"
|
|
},
|
|
"CVE-2025-32463": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-426",
|
|
"epss": 0.59417,
|
|
"epss_pct": 0.99053,
|
|
"name": "Sudo - Local Privilege Escalation via chroot",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-32463.yaml"
|
|
},
|
|
"CVE-2025-3248": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.99996,
|
|
"epss_pct": 0.99988,
|
|
"name": "Langflow AI - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3248.yaml"
|
|
},
|
|
"CVE-2025-32614": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.0187,
|
|
"epss_pct": 0.77861,
|
|
"name": "EventON Lite <= 2.4 - Authenticated Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32614.yaml"
|
|
},
|
|
"CVE-2025-32778": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.19326,
|
|
"epss_pct": 0.97147,
|
|
"name": "Web-Check < 2.0.1 Screenshot API - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32778.yaml"
|
|
},
|
|
"CVE-2025-32813": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.43894,
|
|
"epss_pct": 0.98653,
|
|
"name": "Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32813.yaml"
|
|
},
|
|
"CVE-2025-32814": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.36408,
|
|
"epss_pct": 0.98373,
|
|
"name": "NetMRI Unauthenticated SQL Injection via skipjackUsername",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32814.yaml"
|
|
},
|
|
"CVE-2025-32815": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.40935,
|
|
"epss_pct": 0.98555,
|
|
"name": "NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32815.yaml"
|
|
},
|
|
"CVE-2025-32966": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.04396,
|
|
"epss_pct": 0.90625,
|
|
"name": "DataEase 2.10.4-2.10.7 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32966.yaml"
|
|
},
|
|
"CVE-2025-32969": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.77774,
|
|
"epss_pct": 0.99533,
|
|
"name": "XWiki REST API Query - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32969.yaml"
|
|
},
|
|
"CVE-2025-32970": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"name": "XWiki WYSIWYG API - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32970.yaml"
|
|
},
|
|
"CVE-2025-34023": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01452,
|
|
"epss_pct": 0.71554,
|
|
"name": "Karel IP Phone IP1211 Web Management Panel - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34023.yaml"
|
|
},
|
|
"CVE-2025-34026": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.8194,
|
|
"epss_pct": 0.99625,
|
|
"name": "Versa Concerto Actuator Endpoint - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34026.yaml"
|
|
},
|
|
"CVE-2025-34027": {
|
|
"cwe": "CWE-367",
|
|
"epss": 0.4522,
|
|
"epss_pct": 0.98694,
|
|
"name": "Versa Concerto API Path Based - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34027.yaml"
|
|
},
|
|
"CVE-2025-34028": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.97657,
|
|
"epss_pct": 0.99899,
|
|
"name": "Commvault - SSRF via /commandcenter/deployWebpackage.do",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34028.yaml"
|
|
},
|
|
"CVE-2025-34030": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.60298,
|
|
"epss_pct": 0.99072,
|
|
"name": "sar2html <=3.2.2 Plot Parameter - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34030.yaml"
|
|
},
|
|
"CVE-2025-34031": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02809,
|
|
"epss_pct": 0.85506,
|
|
"name": "Moodle Jmol Filter 6.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34031.yaml"
|
|
},
|
|
"CVE-2025-34032": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.00684,
|
|
"epss_pct": 0.50065,
|
|
"name": "Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34032.yaml"
|
|
},
|
|
"CVE-2025-34035": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.12334,
|
|
"epss_pct": 0.95903,
|
|
"name": "EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34035.yaml"
|
|
},
|
|
"CVE-2025-34038": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"name": "Fanwei e-cology - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34038.yaml"
|
|
},
|
|
"CVE-2025-34040": {
|
|
"epss": 0.14813,
|
|
"epss_pct": 0.96437,
|
|
"name": "Zhiyuan OA Platform - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34040.yaml"
|
|
},
|
|
"CVE-2025-34045": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"name": "WeiPHP 5.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34045.yaml"
|
|
},
|
|
"CVE-2025-34073": {
|
|
"name": "Maltrail <=0.54 Username Parameter - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34073.yaml"
|
|
},
|
|
"CVE-2025-34077": {
|
|
"epss": 0.14307,
|
|
"epss_pct": 0.9634,
|
|
"name": "WordPress Pie Register <= 3.7.1.4 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34077.yaml"
|
|
},
|
|
"CVE-2025-34141": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01852,
|
|
"epss_pct": 0.77623,
|
|
"name": "ETQ Reliance - Reflected XSS via SQLConverterServlet",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34141.yaml"
|
|
},
|
|
"CVE-2025-34143": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.30353,
|
|
"epss_pct": 0.98096,
|
|
"name": "ETQ Reliance - Authentication Bypass via Trailing Space",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34143.yaml"
|
|
},
|
|
"CVE-2025-3415": {
|
|
"epss": 0.00956,
|
|
"epss_pct": 0.58952,
|
|
"name": "Grafana - Exposes DingDing API Keys",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3415.yaml"
|
|
},
|
|
"CVE-2025-34152": {
|
|
"name": "Shenzhen Aitemi M300 Wi-Fi Repeater \u2013 Unauthenticated Remote Command Execution via `time` Parameter",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34152.yaml"
|
|
},
|
|
"CVE-2025-34291": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-942",
|
|
"epss": 0.83629,
|
|
"epss_pct": 0.99666,
|
|
"name": "Langflow AI <= 1.6.9 - CORS Misconfiguration",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34291.yaml"
|
|
},
|
|
"CVE-2025-34299": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.72667,
|
|
"epss_pct": 0.99402,
|
|
"name": "Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34299.yaml"
|
|
},
|
|
"CVE-2025-34300": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.50696,
|
|
"epss_pct": 0.98836,
|
|
"name": "SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34300.yaml"
|
|
},
|
|
"CVE-2025-34509": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.54577,
|
|
"epss_pct": 0.98941,
|
|
"name": "Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34509.yaml"
|
|
},
|
|
"CVE-2025-3472": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.01933,
|
|
"epss_pct": 0.78596,
|
|
"name": "Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3472.yaml"
|
|
},
|
|
"CVE-2025-3515": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.0509,
|
|
"epss_pct": 0.91751,
|
|
"name": "Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3515.yaml"
|
|
},
|
|
"CVE-2025-3605": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.06937,
|
|
"epss_pct": 0.93636,
|
|
"name": "WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3605.yaml"
|
|
},
|
|
"CVE-2025-36604": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.62645,
|
|
"epss_pct": 0.99128,
|
|
"name": "Dell UnityVSA < 5.5 - Remote Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-36604.yaml"
|
|
},
|
|
"CVE-2025-36845": {
|
|
"name": "Eveo URVE Web Manager - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-36845.yaml"
|
|
},
|
|
"CVE-2025-37164": {
|
|
"name": "HPE OneView - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-37164.yaml"
|
|
},
|
|
"CVE-2025-4008": {
|
|
"cvss": 7.5,
|
|
"cwe": "CWE-77",
|
|
"epss": 0.93256,
|
|
"epss_pct": 0.99829,
|
|
"name": "MeteoBridge <= 6.1 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4008.yaml"
|
|
},
|
|
"CVE-2025-4009": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/V:C",
|
|
"epss": 0.7144,
|
|
"epss_pct": 0.99368,
|
|
"name": "Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4009.yaml"
|
|
},
|
|
"CVE-2025-40536": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-693",
|
|
"epss": 0.81624,
|
|
"epss_pct": 0.99615,
|
|
"name": "SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40536.yaml"
|
|
},
|
|
"CVE-2025-40551": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.83622,
|
|
"epss_pct": 0.99665,
|
|
"name": "SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40551.yaml"
|
|
},
|
|
"CVE-2025-40552": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1390",
|
|
"epss": 0.49734,
|
|
"epss_pct": 0.98809,
|
|
"name": "SolarWinds Web Help Desk - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40552.yaml"
|
|
},
|
|
"CVE-2025-40554": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-1390",
|
|
"epss": 0.58447,
|
|
"epss_pct": 0.9903,
|
|
"name": "SolarWinds Web Help Desk - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40554.yaml"
|
|
},
|
|
"CVE-2025-40630": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00471,
|
|
"epss_pct": 0.38911,
|
|
"name": "IceWarp Mail Server \u226411.4.0 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40630.yaml"
|
|
},
|
|
"CVE-2025-4078": {
|
|
"name": "Wangshen SecGate 3600 Path Traversal Vulnerability",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4078.yaml"
|
|
},
|
|
"CVE-2025-4123": {
|
|
"cvss": 7.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
|
|
"epss": 0.97007,
|
|
"epss_pct": 0.99886,
|
|
"name": "Grafana - XSS / Open Redirect / SSRF via Client Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4123.yaml"
|
|
},
|
|
"CVE-2025-41242": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02054,
|
|
"epss_pct": 0.79919,
|
|
"name": "Spring Framework - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41242.yaml"
|
|
},
|
|
"CVE-2025-41243": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.03548,
|
|
"epss_pct": 0.88475,
|
|
"name": "Spring Cloud Gateway Server Webflux - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41243.yaml"
|
|
},
|
|
"CVE-2025-41393": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00692,
|
|
"epss_pct": 0.50365,
|
|
"name": "Ricoh Web Image Monitor - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41393.yaml"
|
|
},
|
|
"CVE-2025-41646": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-704",
|
|
"epss": 0.49051,
|
|
"epss_pct": 0.98795,
|
|
"name": "RevPi Webstatus <= v2.4.5 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41646.yaml"
|
|
},
|
|
"CVE-2025-4210": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.01841,
|
|
"epss_pct": 0.77483,
|
|
"name": "Casdoor - Authorization Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4210.yaml"
|
|
},
|
|
"CVE-2025-4302": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.00888,
|
|
"epss_pct": 0.56815,
|
|
"name": "Stop User Enumeration WordPress plugin - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4302.yaml"
|
|
},
|
|
"CVE-2025-4322": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-620",
|
|
"epss": 0.15647,
|
|
"epss_pct": 0.96597,
|
|
"name": "Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4322.yaml"
|
|
},
|
|
"CVE-2025-4334": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.02138,
|
|
"epss_pct": 0.80728,
|
|
"name": "Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4334.yaml"
|
|
},
|
|
"CVE-2025-4380": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.39708,
|
|
"epss_pct": 0.98516,
|
|
"name": "Ads Pro Plugin <= 4.89 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4380.yaml"
|
|
},
|
|
"CVE-2025-4388": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.03794,
|
|
"epss_pct": 0.89223,
|
|
"name": "Liferay Portal - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4388.yaml"
|
|
},
|
|
"CVE-2025-4396": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02667,
|
|
"epss_pct": 0.84677,
|
|
"name": "Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4396.yaml"
|
|
},
|
|
"CVE-2025-44136": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02507,
|
|
"epss_pct": 0.83616,
|
|
"name": "MapTiler Tileserver-php v2.0 - Unauthenticated XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44136.yaml"
|
|
},
|
|
"CVE-2025-44137": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0136,
|
|
"epss_pct": 0.69759,
|
|
"name": "MapTiler Tileserver-php v2.0 - Unauthenticated File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44137.yaml"
|
|
},
|
|
"CVE-2025-44148": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.60579,
|
|
"epss_pct": 0.99079,
|
|
"name": "MailEnable Mail Service < v10 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44148.yaml"
|
|
},
|
|
"CVE-2025-44177": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04173,
|
|
"epss_pct": 0.90182,
|
|
"name": "White Star Software ProTop - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-44177.yaml"
|
|
},
|
|
"CVE-2025-4427": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.99927,
|
|
"epss_pct": 0.99967,
|
|
"name": "Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4427.yaml"
|
|
},
|
|
"CVE-2025-4524": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.10373,
|
|
"epss_pct": 0.95388,
|
|
"name": "WordPress Madara Theme < 2.2.2.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4524.yaml"
|
|
},
|
|
"CVE-2025-4576": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00588,
|
|
"epss_pct": 0.4574,
|
|
"name": "Liferay Portal & DXP - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4576.yaml"
|
|
},
|
|
"CVE-2025-45854": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.03012,
|
|
"epss_pct": 0.86463,
|
|
"name": "JEHC-BPM - Remote Code Execute",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-45854.yaml"
|
|
},
|
|
"CVE-2025-45985": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.07163,
|
|
"epss_pct": 0.93825,
|
|
"name": "Blink Router - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-45985.yaml"
|
|
},
|
|
"CVE-2025-4632": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.24295,
|
|
"epss_pct": 0.97696,
|
|
"name": "Samsung MagicINFO 9 Server - File Upload & Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4632.yaml"
|
|
},
|
|
"CVE-2025-46349": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.00625,
|
|
"epss_pct": 0.47544,
|
|
"name": "YesWiki Reflected XSS via File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46349.yaml"
|
|
},
|
|
"CVE-2025-4652": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00493,
|
|
"epss_pct": 0.40346,
|
|
"name": "Broadstreet WordPress plugin - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4652.yaml"
|
|
},
|
|
"CVE-2025-46549": {
|
|
"name": "YesWiki <= 4.5.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46549.yaml"
|
|
},
|
|
"CVE-2025-46550": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00535,
|
|
"epss_pct": 0.43029,
|
|
"name": "YesWiki < 4.5.4 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46550.yaml"
|
|
},
|
|
"CVE-2025-46554": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-285",
|
|
"name": "XWiki REST API - Attachments Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46554.yaml"
|
|
},
|
|
"CVE-2025-46565": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01157,
|
|
"epss_pct": 0.64814,
|
|
"name": "Vite Dev Server - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46565.yaml"
|
|
},
|
|
"CVE-2025-46817": {
|
|
"name": "Redis < 8.2.1 lua script - Integer Overflow",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-46817.yaml"
|
|
},
|
|
"CVE-2025-46818": {
|
|
"name": "Redis Lua Sandbox < 8.2.2 - Cross-User Escape",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-46818.yaml"
|
|
},
|
|
"CVE-2025-46819": {
|
|
"name": "Redis < 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-46819.yaml"
|
|
},
|
|
"CVE-2025-46822": {
|
|
"epss": 0.04028,
|
|
"epss_pct": 0.89859,
|
|
"name": "Java-springboot-codebase 1.1 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46822.yaml"
|
|
},
|
|
"CVE-2025-47188": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"epss": 0.50237,
|
|
"epss_pct": 0.98823,
|
|
"name": "Mitel 6000 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47188.yaml"
|
|
},
|
|
"CVE-2025-47204": {
|
|
"epss": 0.00438,
|
|
"epss_pct": 0.36579,
|
|
"name": "Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47204.yaml"
|
|
},
|
|
"CVE-2025-47423": {
|
|
"cvss": 5.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
|
|
"cwe": "CWE-24",
|
|
"epss": 0.01996,
|
|
"epss_pct": 0.79291,
|
|
"name": "Personal Weather Station Dashboard 12 - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47423.yaml"
|
|
},
|
|
"CVE-2025-47445": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.05145,
|
|
"epss_pct": 0.9182,
|
|
"name": "WordPress Eventin (Themewinter) \u2264 4.0.26 - Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47445.yaml"
|
|
},
|
|
"CVE-2025-47539": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.27878,
|
|
"epss_pct": 0.97955,
|
|
"name": "Eventin <= 4.0.26 - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47539.yaml"
|
|
},
|
|
"CVE-2025-47577": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04643,
|
|
"epss_pct": 0.91068,
|
|
"name": "TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47577.yaml"
|
|
},
|
|
"CVE-2025-47646": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-640",
|
|
"epss": 0.24936,
|
|
"epss_pct": 0.97753,
|
|
"name": "PSW Front-end Login & Registration 1.13 - Weak Password Recovery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47646.yaml"
|
|
},
|
|
"CVE-2025-47783": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"name": "Label Studio < 1.18.0 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47783.yaml"
|
|
},
|
|
"CVE-2025-47812": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.92823,
|
|
"epss_pct": 0.99822,
|
|
"name": "Wing FTP Server <= 7.4.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47812.yaml"
|
|
},
|
|
"CVE-2025-47813": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NH",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.59403,
|
|
"epss_pct": 0.99051,
|
|
"name": "Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47813.yaml"
|
|
},
|
|
"CVE-2025-47916": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-1336",
|
|
"epss": 0.83732,
|
|
"epss_pct": 0.99668,
|
|
"name": "Invision Community <=5.0.6 Unauthenticated RCE via Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47916.yaml"
|
|
},
|
|
"CVE-2025-48157": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.02188,
|
|
"epss_pct": 0.81149,
|
|
"name": "WordPress Formality Plugin <= 1.5.9 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48157.yaml"
|
|
},
|
|
"CVE-2025-48281": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01388,
|
|
"epss_pct": 0.7033,
|
|
"name": "MyStyle Custom Product Designer <= 3.21.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48281.yaml"
|
|
},
|
|
"CVE-2025-48703": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.99655,
|
|
"epss_pct": 0.99949,
|
|
"name": "CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48703.yaml"
|
|
},
|
|
"CVE-2025-48827": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-424",
|
|
"epss": 0.75844,
|
|
"epss_pct": 0.99487,
|
|
"name": "vBulletin 5.0.0-6.0.3 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48827.yaml"
|
|
},
|
|
"CVE-2025-48828": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-424",
|
|
"epss": 0.5764,
|
|
"epss_pct": 0.99012,
|
|
"name": "vBulletin replaceAdTemplate - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48828.yaml"
|
|
},
|
|
"CVE-2025-48954": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00685,
|
|
"epss_pct": 0.50125,
|
|
"name": "Discourse OAuth Social Login - Cross-site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48954.yaml"
|
|
},
|
|
"CVE-2025-49001": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.2288,
|
|
"epss_pct": 0.97572,
|
|
"name": "DataEase < 2.10.10 - JWT Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49001.yaml"
|
|
},
|
|
"CVE-2025-49002": {
|
|
"cwe": "CWE-290",
|
|
"epss": 0.47001,
|
|
"epss_pct": 0.98745,
|
|
"name": "DataEase - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49002.yaml"
|
|
},
|
|
"CVE-2025-49029": {
|
|
"epss": 0.02197,
|
|
"epss_pct": 0.81248,
|
|
"name": "WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49029.yaml"
|
|
},
|
|
"CVE-2025-49113": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99032,
|
|
"epss_pct": 0.99928,
|
|
"name": "Roundcube Webmail - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49113.yaml"
|
|
},
|
|
"CVE-2025-49132": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.53389,
|
|
"epss_pct": 0.98909,
|
|
"name": "Pterodactyl Panel - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49132.yaml"
|
|
},
|
|
"CVE-2025-49493": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.03404,
|
|
"epss_pct": 0.88007,
|
|
"name": "Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49493.yaml"
|
|
},
|
|
"CVE-2025-49533": {
|
|
"name": "Adobe Experience Manager Forms - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49533.yaml"
|
|
},
|
|
"CVE-2025-49596": {
|
|
"cwe": "CWE-306",
|
|
"epss": 0.44713,
|
|
"epss_pct": 0.98678,
|
|
"name": "MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49596.yaml"
|
|
},
|
|
"CVE-2025-49706": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.98841,
|
|
"epss_pct": 0.99925,
|
|
"name": "Microsoft SharePoint Server - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49706.yaml"
|
|
},
|
|
"CVE-2025-49825": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.07804,
|
|
"epss_pct": 0.94234,
|
|
"name": "Teleport - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49825.yaml"
|
|
},
|
|
"CVE-2025-49844": {
|
|
"name": "Redis Lua Parser < 8.2.2 - Use After Free",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml"
|
|
},
|
|
"CVE-2025-50578": {
|
|
"name": "Heimdall - Host Header Injection & Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-50578.yaml"
|
|
},
|
|
"CVE-2025-50738": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-200",
|
|
"name": "Memos < 0.25.0 - Stored Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-50738.yaml"
|
|
},
|
|
"CVE-2025-5086": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.90018,
|
|
"epss_pct": 0.99784,
|
|
"name": "Dassault Syst\u00e8mes DELMIA Apriso (up to 2025) - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5086.yaml"
|
|
},
|
|
"CVE-2025-51482": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.01862,
|
|
"epss_pct": 0.77763,
|
|
"name": "Letta Letta 0.7.12 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51482.yaml"
|
|
},
|
|
"CVE-2025-51501": {
|
|
"name": "Microweber CMS2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51501.yaml"
|
|
},
|
|
"CVE-2025-51502": {
|
|
"name": "Microweber CMS 2.0 - Reflected XSS in Admin Page Creation",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51502.yaml"
|
|
},
|
|
"CVE-2025-51586": {
|
|
"cwe": "CWE-359",
|
|
"name": "PrestaShop - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51586.yaml"
|
|
},
|
|
"CVE-2025-51990": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"name": "XWiki \u2013 Stored Cross-Site Scripting (XSS)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51990.yaml"
|
|
},
|
|
"CVE-2025-51991": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.03605,
|
|
"epss_pct": 0.88648,
|
|
"name": "XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51991.yaml"
|
|
},
|
|
"CVE-2025-52207": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.01499,
|
|
"epss_pct": 0.72447,
|
|
"name": "MikoPBX - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52207.yaml"
|
|
},
|
|
"CVE-2025-52472": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02207,
|
|
"epss_pct": 0.81329,
|
|
"name": "XWiki - HQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52472.yaml"
|
|
},
|
|
"CVE-2025-52488": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.35197,
|
|
"epss_pct": 0.98326,
|
|
"name": "DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52488.yaml"
|
|
},
|
|
"CVE-2025-52665": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.40972,
|
|
"epss_pct": 0.98555,
|
|
"name": "UniFi Access - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52665.yaml"
|
|
},
|
|
"CVE-2025-52691": {
|
|
"name": "SmarterMail - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52691.yaml"
|
|
},
|
|
"CVE-2025-52694": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.38542,
|
|
"epss_pct": 0.98467,
|
|
"name": "Advantech WISE-IoTSuite/SaaS - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52694.yaml"
|
|
},
|
|
"CVE-2025-5287": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.02355,
|
|
"epss_pct": 0.82534,
|
|
"name": "Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5287.yaml"
|
|
},
|
|
"CVE-2025-52970": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-223",
|
|
"epss": 0.09825,
|
|
"epss_pct": 0.95204,
|
|
"name": "Fortinet FortiWeb - Authentication Bypass to Admin Privilege",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52970.yaml"
|
|
},
|
|
"CVE-2025-5301": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.45502,
|
|
"epss_pct": 0.98701,
|
|
"name": "ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5301.yaml"
|
|
},
|
|
"CVE-2025-53118": {
|
|
"name": "Securden Unified PAM - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53118.yaml"
|
|
},
|
|
"CVE-2025-53364": {
|
|
"name": "Parse Server - GraphQL Schema Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53364.yaml"
|
|
},
|
|
"CVE-2025-5350": {
|
|
"cvss": 5.9,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00574,
|
|
"epss_pct": 0.45078,
|
|
"name": "WSO2 - Server Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5350.yaml"
|
|
},
|
|
"CVE-2025-53533": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00556,
|
|
"epss_pct": 0.44117,
|
|
"name": "Pi-hole Reflected XSS in 404-Error Page",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53533.yaml"
|
|
},
|
|
"CVE-2025-53558": {
|
|
"name": "ZTE ZXHN-F660T/F660A - Default Credentials",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53558.yaml"
|
|
},
|
|
"CVE-2025-53624": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01908,
|
|
"epss_pct": 0.78299,
|
|
"name": "Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53624.yaml"
|
|
},
|
|
"CVE-2025-53770": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99998,
|
|
"epss_pct": 0.9999,
|
|
"name": "Microsoft SharePoint Server - Remote Code Execution (ToolShell)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53770.yaml"
|
|
},
|
|
"CVE-2025-53771": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.999,
|
|
"epss_pct": 0.99964,
|
|
"name": "Microsoft SharePoint Server - Authentication Bypass (ToolShell)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53771.yaml"
|
|
},
|
|
"CVE-2025-53833": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-1336",
|
|
"epss": 0.09342,
|
|
"epss_pct": 0.9502,
|
|
"name": "LaRecipe < 2.8.1 Remote Code Execution via SSTI",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53833.yaml"
|
|
},
|
|
"CVE-2025-53887": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00884,
|
|
"epss_pct": 0.56702,
|
|
"name": "Directus < 11.9.0 - Version Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53887.yaml"
|
|
},
|
|
"CVE-2025-5394": {
|
|
"name": "Unauthenticated Arbitrary Plugin Upload in Alone Theme",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5394.yaml"
|
|
},
|
|
"CVE-2025-54068": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.96473,
|
|
"epss_pct": 0.99876,
|
|
"name": "Laravel Livewire v3 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54068.yaml"
|
|
},
|
|
"CVE-2025-54123": {
|
|
"name": "Hoverfly <= 1.11.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54123.yaml"
|
|
},
|
|
"CVE-2025-54125": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-359",
|
|
"name": "XWiki XML View - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54125.yaml"
|
|
},
|
|
"CVE-2025-54236": {
|
|
"name": "Adobe Commerce - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54236.yaml"
|
|
},
|
|
"CVE-2025-54249": {
|
|
"name": "Adobe Experience Manager \u2264 6.5.23.0 \u2013 SSRF",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54249.yaml"
|
|
},
|
|
"CVE-2025-54251": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-91",
|
|
"epss": 0.01724,
|
|
"epss_pct": 0.75903,
|
|
"name": "Adobe Experience Manager \u2264 6.5.23.0 - XML Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54251.yaml"
|
|
},
|
|
"CVE-2025-54309": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.94709,
|
|
"epss_pct": 0.9985,
|
|
"name": "CrushFTP - Authentication Bypass Race Condition",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-54309.yaml"
|
|
},
|
|
"CVE-2025-54589": {
|
|
"cvss": 6.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.02373,
|
|
"epss_pct": 0.82657,
|
|
"name": "Copyparty <=1.18.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54589.yaml"
|
|
},
|
|
"CVE-2025-54597": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00565,
|
|
"epss_pct": 0.44613,
|
|
"name": "Heimdall Application Dashboard < 2.7.3 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54597.yaml"
|
|
},
|
|
"CVE-2025-54726": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01514,
|
|
"epss_pct": 0.72707,
|
|
"name": "WordPress JS Archive List <= 6.1.5 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54726.yaml"
|
|
},
|
|
"CVE-2025-54782": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"epss": 0.49994,
|
|
"epss_pct": 0.98816,
|
|
"name": "NestJS DevTools Integration - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54782.yaml"
|
|
},
|
|
"CVE-2025-54793": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00614,
|
|
"epss_pct": 0.46998,
|
|
"name": "Astro SSR - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54793.yaml"
|
|
},
|
|
"CVE-2025-54988": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.15038,
|
|
"epss_pct": 0.96472,
|
|
"name": "Apache Tika - XXE Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54988.yaml"
|
|
},
|
|
"CVE-2025-55150": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01701,
|
|
"epss_pct": 0.75587,
|
|
"name": "Stirling-PDF < 1.1.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55150.yaml"
|
|
},
|
|
"CVE-2025-55161": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01982,
|
|
"epss_pct": 0.79134,
|
|
"name": "Stirling-PDF SSRF via Markdown",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55161.yaml"
|
|
},
|
|
"CVE-2025-55169": {
|
|
"name": "WeGIA - Directory Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55169.yaml"
|
|
},
|
|
"CVE-2025-55182": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99802,
|
|
"epss_pct": 0.99956,
|
|
"name": "React Server Components - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml"
|
|
},
|
|
"CVE-2025-55184": {
|
|
"name": "React Server Components - Denial of Service",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55184.yaml"
|
|
},
|
|
"CVE-2025-55190": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.0534,
|
|
"epss_pct": 0.92048,
|
|
"name": "ArgoCD Project API Token Repository Credentials Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55190.yaml"
|
|
},
|
|
"CVE-2025-55303": {
|
|
"cvss": 6.4,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00637,
|
|
"epss_pct": 0.48043,
|
|
"name": "Astro - Unauthorized Third-Party Image Access",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55303.yaml"
|
|
},
|
|
"CVE-2025-55523": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"name": "Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55523.yaml"
|
|
},
|
|
"CVE-2025-5569": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01451,
|
|
"epss_pct": 0.71522,
|
|
"name": "IdeaCMS <= 1.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5569.yaml"
|
|
},
|
|
"CVE-2025-55746": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L",
|
|
"cwe": "CWE-73",
|
|
"epss": 0.01334,
|
|
"epss_pct": 0.69166,
|
|
"name": "Directus - Unauthenticated File Modification",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55746.yaml"
|
|
},
|
|
"CVE-2025-55747": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.01668,
|
|
"epss_pct": 0.75097,
|
|
"name": "XWiki Platform - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55747.yaml"
|
|
},
|
|
"CVE-2025-55748": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.01771,
|
|
"epss_pct": 0.76556,
|
|
"name": "XWiki Platform - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55748.yaml"
|
|
},
|
|
"CVE-2025-55749": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.01471,
|
|
"epss_pct": 0.71946,
|
|
"name": "XWiki - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55749.yaml"
|
|
},
|
|
"CVE-2025-5605": {
|
|
"name": "WSO2 Management Console - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5605.yaml"
|
|
},
|
|
"CVE-2025-56132": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-305",
|
|
"epss": 0.00695,
|
|
"epss_pct": 0.50478,
|
|
"name": "LiquidFiles < 4.2 - User Enumeration via Password Reset",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56132.yaml"
|
|
},
|
|
"CVE-2025-56266": {
|
|
"name": "Avigilon ACM - Host Header Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56266.yaml"
|
|
},
|
|
"CVE-2025-56520": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00696,
|
|
"epss_pct": 0.50497,
|
|
"name": "Dify v1.6.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56520.yaml"
|
|
},
|
|
"CVE-2025-56819": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.03196,
|
|
"epss_pct": 0.87218,
|
|
"name": "Datart v1.0.0-rc.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56819.yaml"
|
|
},
|
|
"CVE-2025-5701": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01888,
|
|
"epss_pct": 0.78061,
|
|
"name": "HyperComments <= 1.2.2 - Arbitrary Options Update",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5701.yaml"
|
|
},
|
|
"CVE-2025-5777": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-457",
|
|
"epss": 0.99962,
|
|
"epss_pct": 0.99976,
|
|
"name": "Citrix NetScaler Memory Disclosure - CitrixBleed 2",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml"
|
|
},
|
|
"CVE-2025-57788": {
|
|
"name": "Commvault Unauthenticated Password Disclosure (WT-2025-0047)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57788.yaml"
|
|
},
|
|
"CVE-2025-57789": {
|
|
"name": "Commvault Initial Administrator Login Process Vulnerability",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57789.yaml"
|
|
},
|
|
"CVE-2025-57808": {
|
|
"name": "ESPHome - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57808.yaml"
|
|
},
|
|
"CVE-2025-57819": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.88269,
|
|
"epss_pct": 0.99758,
|
|
"name": "FreePBX - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57819.yaml"
|
|
},
|
|
"CVE-2025-57822": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.02495,
|
|
"epss_pct": 0.83528,
|
|
"name": "Next.js Middleware - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57822.yaml"
|
|
},
|
|
"CVE-2025-58044": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00488,
|
|
"epss_pct": 0.40052,
|
|
"name": "JumpServer - Open Redirect via Referer Header",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58044.yaml"
|
|
},
|
|
"CVE-2025-58179": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00829,
|
|
"epss_pct": 0.54986,
|
|
"name": "Astro Cloudflare Adapter - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58179.yaml"
|
|
},
|
|
"CVE-2025-58226": {
|
|
"name": "WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58226.yaml"
|
|
},
|
|
"CVE-2025-58360": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.64874,
|
|
"epss_pct": 0.99187,
|
|
"name": "GeoServer - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58360.yaml"
|
|
},
|
|
"CVE-2025-58434": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.49894,
|
|
"epss_pct": 0.98814,
|
|
"name": "Flowise <= 3.0.5 - Account Takeover",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58434.yaml"
|
|
},
|
|
"CVE-2025-58443": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.18687,
|
|
"epss_pct": 0.9706,
|
|
"name": "FOGProject <= 1.5.10.1673 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58443.yaml"
|
|
},
|
|
"CVE-2025-58751": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01224,
|
|
"epss_pct": 0.66677,
|
|
"name": "Vite Dev Server - Path Traversal",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58751.yaml"
|
|
},
|
|
"CVE-2025-59049": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01779,
|
|
"epss_pct": 0.76662,
|
|
"name": "Mockoon < 9.2.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59049.yaml"
|
|
},
|
|
"CVE-2025-59136": {
|
|
"name": "WordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59136.yaml"
|
|
},
|
|
"CVE-2025-59287": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.99979,
|
|
"epss_pct": 0.9998,
|
|
"name": "Windows Server Update Service - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59287.yaml"
|
|
},
|
|
"CVE-2025-59341": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.01636,
|
|
"epss_pct": 0.74622,
|
|
"name": "esm.sh <= v136 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59341.yaml"
|
|
},
|
|
"CVE-2025-59342": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-24",
|
|
"epss": 0.03031,
|
|
"epss_pct": 0.86548,
|
|
"name": "esm.sh <= v136 - Arbitrary File Write via Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59342.yaml"
|
|
},
|
|
"CVE-2025-5947": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.04469,
|
|
"epss_pct": 0.9076,
|
|
"name": "Service Finder Bookings - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5947.yaml"
|
|
},
|
|
"CVE-2025-59474": {
|
|
"name": "Jenkins Sidepanel - Unauthorized Agent/Queue Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59474.yaml"
|
|
},
|
|
"CVE-2025-59528": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.8737,
|
|
"epss_pct": 0.99742,
|
|
"name": "Flowise - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59528.yaml"
|
|
},
|
|
"CVE-2025-59582": {
|
|
"name": "Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59582.yaml"
|
|
},
|
|
"CVE-2025-5961": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.5253,
|
|
"epss_pct": 0.98882,
|
|
"name": "WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5961.yaml"
|
|
},
|
|
"CVE-2025-59716": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-203",
|
|
"epss": 0.00895,
|
|
"epss_pct": 0.57026,
|
|
"name": "ownCloud Guests - User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59716.yaml"
|
|
},
|
|
"CVE-2025-60188": {
|
|
"name": "Atarim < 4.2.2 - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-60188.yaml"
|
|
},
|
|
"CVE-2025-6058": {
|
|
"epss": 0.05497,
|
|
"epss_pct": 0.9222,
|
|
"name": "WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6058.yaml"
|
|
},
|
|
"CVE-2025-61224": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01357,
|
|
"epss_pct": 0.69695,
|
|
"name": "DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61224.yaml"
|
|
},
|
|
"CVE-2025-61666": {
|
|
"name": "Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61666.yaml"
|
|
},
|
|
"CVE-2025-6174": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0046,
|
|
"epss_pct": 0.38138,
|
|
"name": "WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6174.yaml"
|
|
},
|
|
"CVE-2025-61757": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.88201,
|
|
"epss_pct": 0.99756,
|
|
"name": "Oracle Identity Manager REST WebServices - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61757.yaml"
|
|
},
|
|
"CVE-2025-61882": {
|
|
"name": "Oracle E-Business Suite 12.2.3\u201312.2.14 \u2013 Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61882.yaml"
|
|
},
|
|
"CVE-2025-61884": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.97788,
|
|
"epss_pct": 0.99901,
|
|
"name": "Oracle E-Business Suite - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61884.yaml"
|
|
},
|
|
"CVE-2025-6197": {
|
|
"name": "Open Redirect via Organization Switching",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6197.yaml"
|
|
},
|
|
"CVE-2025-62039": {
|
|
"name": "AI ChatBot with ChatGPT by AYS <= 2.6.6 - Unauthenticated API Key Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62039.yaml"
|
|
},
|
|
"CVE-2025-6204": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.77077,
|
|
"epss_pct": 0.99516,
|
|
"name": "DELMIA Apriso - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6204.yaml"
|
|
},
|
|
"CVE-2025-6205": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.72217,
|
|
"epss_pct": 0.9939,
|
|
"name": "DELMIA Apriso - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6205.yaml"
|
|
},
|
|
"CVE-2025-62126": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00721,
|
|
"epss_pct": 0.51408,
|
|
"name": "WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62126.yaml"
|
|
},
|
|
"CVE-2025-6216": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-640",
|
|
"epss": 0.35127,
|
|
"epss_pct": 0.98323,
|
|
"name": "Allegra - Authentication Bypass via Predictable Password Reset Token",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-6216.yaml"
|
|
},
|
|
"CVE-2025-62168": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.62871,
|
|
"epss_pct": 0.99133,
|
|
"name": "Squid Proxy - HTTP Authentication Credentials Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62168.yaml"
|
|
},
|
|
"CVE-2025-62512": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-204",
|
|
"epss": 0.00766,
|
|
"epss_pct": 0.52976,
|
|
"name": "Piwigo - User Enumeration via Password Reset",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62512.yaml"
|
|
},
|
|
"CVE-2025-62522": {
|
|
"name": "Vite - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62522.yaml"
|
|
},
|
|
"CVE-2025-62613": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01083,
|
|
"epss_pct": 0.62824,
|
|
"name": "VDO.Ninja - DOM-Based Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62613.yaml"
|
|
},
|
|
"CVE-2025-62780": {
|
|
"cvss": 6.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00431,
|
|
"epss_pct": 0.3596,
|
|
"name": "ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62780.yaml"
|
|
},
|
|
"CVE-2025-63387": {
|
|
"cwe": "CWE-287",
|
|
"epss": 0.30318,
|
|
"epss_pct": 0.98094,
|
|
"name": "Dify v1.9.1 - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-63387.yaml"
|
|
},
|
|
"CVE-2025-6389": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.76138,
|
|
"epss_pct": 0.99497,
|
|
"name": "Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6389.yaml"
|
|
},
|
|
"CVE-2025-6403": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.01754,
|
|
"epss_pct": 0.76322,
|
|
"name": "Code-Projects School Fees Payment System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6403.yaml"
|
|
},
|
|
"CVE-2025-64095": {
|
|
"name": "DNN - Unrestricted Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64095.yaml"
|
|
},
|
|
"CVE-2025-64328": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"epss": 0.84618,
|
|
"epss_pct": 0.99687,
|
|
"name": "FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64328.yaml"
|
|
},
|
|
"CVE-2025-64446": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-23",
|
|
"epss": 0.91838,
|
|
"epss_pct": 0.99809,
|
|
"name": "FortiWeb - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64446.yaml"
|
|
},
|
|
"CVE-2025-64500": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-647",
|
|
"epss": 0.01325,
|
|
"epss_pct": 0.68948,
|
|
"name": "Symfony HttpFoundation - Access Control Bypass via PATH_INFO",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64500.yaml"
|
|
},
|
|
"CVE-2025-64525": {
|
|
"name": "Astro - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64525.yaml"
|
|
},
|
|
"CVE-2025-64764": {
|
|
"name": "Astro - Reflected XSS via server islands feature",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64764.yaml"
|
|
},
|
|
"CVE-2025-66472": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-80",
|
|
"epss": 0.00519,
|
|
"epss_pct": 0.42066,
|
|
"name": "XWiki DeleteApplication - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66472.yaml"
|
|
},
|
|
"CVE-2025-66516": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.80336,
|
|
"epss_pct": 0.9959,
|
|
"name": "Apache Tika - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66516.yaml"
|
|
},
|
|
"CVE-2025-66744": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.01478,
|
|
"epss_pct": 0.72052,
|
|
"name": "Yonyou YonBIP - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66744.yaml"
|
|
},
|
|
"CVE-2025-67303": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-420",
|
|
"epss": 0.01393,
|
|
"epss_pct": 0.70435,
|
|
"name": "ComfyUI-Manager < 3.38 - Configuration Overwrite",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-67303.yaml"
|
|
},
|
|
"CVE-2025-68043": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00588,
|
|
"epss_pct": 0.45741,
|
|
"name": "LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68043.yaml"
|
|
},
|
|
"CVE-2025-68493": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-611",
|
|
"epss": 0.39504,
|
|
"epss_pct": 0.98506,
|
|
"name": "Apache Struts XWork - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68493.yaml"
|
|
},
|
|
"CVE-2025-68509": {
|
|
"name": "User Submitted Posts <= 20251121 - Unauthenticated Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68509.yaml"
|
|
},
|
|
"CVE-2025-6851": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00654,
|
|
"epss_pct": 0.48802,
|
|
"name": "WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6851.yaml"
|
|
},
|
|
"CVE-2025-68602": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00498,
|
|
"epss_pct": 0.40675,
|
|
"name": "Accept Donations with PayPal <= 1.5.2 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68602.yaml"
|
|
},
|
|
"CVE-2025-68613": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.99105,
|
|
"epss_pct": 0.99932,
|
|
"name": "n8n - Remote Code Execution via Expression Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68613.yaml"
|
|
},
|
|
"CVE-2025-68645": {
|
|
"name": "Zimbra Collaboration - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68645.yaml"
|
|
},
|
|
"CVE-2025-68926": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.31362,
|
|
"epss_pct": 0.98148,
|
|
"name": "RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-68926.yaml"
|
|
},
|
|
"CVE-2025-69200": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-202",
|
|
"epss": 0.02191,
|
|
"epss_pct": 0.81174,
|
|
"name": "phpMyFAQ - Configuration Backup Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69200.yaml"
|
|
},
|
|
"CVE-2025-6934": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.26442,
|
|
"epss_pct": 0.9786,
|
|
"name": "The Opal Estate Pro \u2013 Property Management <= 1.7.5 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6934.yaml"
|
|
},
|
|
"CVE-2025-69411": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01609,
|
|
"epss_pct": 0.74189,
|
|
"name": "ionCube Tester Plus <= 1.3 - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69411.yaml"
|
|
},
|
|
"CVE-2025-6970": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.60994,
|
|
"epss_pct": 0.9909,
|
|
"name": "WordPress Events Manager <= 7.0.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6970.yaml"
|
|
},
|
|
"CVE-2025-6984": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01661,
|
|
"epss_pct": 0.74992,
|
|
"name": "langchain-ai langchain - XML External Entity Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-6984.yaml"
|
|
},
|
|
"CVE-2025-69971": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-321",
|
|
"epss": 0.02036,
|
|
"epss_pct": 0.79725,
|
|
"name": "FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-69971.yaml"
|
|
},
|
|
"CVE-2025-71243": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.05126,
|
|
"epss_pct": 0.91793,
|
|
"name": "SPIP Saisies - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71243.yaml"
|
|
},
|
|
"CVE-2025-71257": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.44576,
|
|
"epss_pct": 0.98674,
|
|
"name": "BMC FootPrints - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71257.yaml"
|
|
},
|
|
"CVE-2025-71258": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.1743,
|
|
"epss_pct": 0.96902,
|
|
"name": "BMC FootPrints 'searchWeb' - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71258.yaml"
|
|
},
|
|
"CVE-2025-71259": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.12916,
|
|
"epss_pct": 0.96025,
|
|
"name": "BMC FootPrints 'feedUrl' - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71259.yaml"
|
|
},
|
|
"CVE-2025-71260": {
|
|
"name": "BMC FootPrints - Deserialization of Untrusted Data (RCE)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-71260.yaml"
|
|
},
|
|
"CVE-2025-71324": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-73",
|
|
"epss": 0.0157,
|
|
"epss_pct": 0.73613,
|
|
"name": "Flowise - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71324.yaml"
|
|
},
|
|
"CVE-2025-71334": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-73",
|
|
"epss": 0.0436,
|
|
"epss_pct": 0.90554,
|
|
"name": "Flowise - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71334.yaml"
|
|
},
|
|
"CVE-2025-7160": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01707,
|
|
"epss_pct": 0.75681,
|
|
"name": "Zoo Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-7160.yaml"
|
|
},
|
|
"CVE-2025-7901": {
|
|
"name": "yangzongzhuan RuoYi - DOM Based XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-7901.yaml"
|
|
},
|
|
"CVE-2025-8085": {
|
|
"name": "Ditty < 3.1.58 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8085.yaml"
|
|
},
|
|
"CVE-2025-8110": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.82693,
|
|
"epss_pct": 0.99643,
|
|
"name": "Gogs <= 0.13.3 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8110.yaml"
|
|
},
|
|
"CVE-2025-8191": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01684,
|
|
"epss_pct": 0.75339,
|
|
"name": "Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-8191.yaml"
|
|
},
|
|
"CVE-2025-8266": {
|
|
"name": "ChanCMS <= 3.1. - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8266.yaml"
|
|
},
|
|
"CVE-2025-8286": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.01217,
|
|
"epss_pct": 0.66461,
|
|
"name": "G\u00fcralp Systems FMUS Series - Unauthenticated Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-8286.yaml"
|
|
},
|
|
"CVE-2025-8848": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00417,
|
|
"epss_pct": 0.34723,
|
|
"name": "LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8848.yaml"
|
|
},
|
|
"CVE-2025-8868": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.24317,
|
|
"epss_pct": 0.97699,
|
|
"name": "Chef Automate < 4.13.295 \u2014 SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8868.yaml"
|
|
},
|
|
"CVE-2025-8943": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.71601,
|
|
"epss_pct": 0.99372,
|
|
"name": "Flowise < 3.0.1 - Remote Command Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8943.yaml"
|
|
},
|
|
"CVE-2025-9196": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00937,
|
|
"epss_pct": 0.58389,
|
|
"name": "Trinity Audio <= 5.21.0 - Information Exposure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9196.yaml"
|
|
},
|
|
"CVE-2025-9209": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.02196,
|
|
"epss_pct": 0.81236,
|
|
"name": "RestroPress 3.0.0-3.2.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9209.yaml"
|
|
},
|
|
"CVE-2025-9242": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.913,
|
|
"epss_pct": 0.99801,
|
|
"name": "WatchGuard IKEv2 Out-of-Bounds Write Vulnerability",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-9242.yaml"
|
|
},
|
|
"CVE-2025-9316": {
|
|
"name": "N-central - Authentication Bypass",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9316.yaml"
|
|
},
|
|
"CVE-2025-9744": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01806,
|
|
"epss_pct": 0.7701,
|
|
"name": "Loan Management System 1.0 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9744.yaml"
|
|
},
|
|
"CVE-2025-9808": {
|
|
"name": "The Events Calendar <= 6.15.2 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9808.yaml"
|
|
},
|
|
"CVE-2025-9985": {
|
|
"name": "Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9985.yaml"
|
|
},
|
|
"CVE-2026-0257": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-565",
|
|
"epss": 0.93905,
|
|
"epss_pct": 0.99837,
|
|
"name": "Palo Alto Networks PAN-OS - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-0257.yaml"
|
|
},
|
|
"CVE-2026-0545": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.04392,
|
|
"epss_pct": 0.90619,
|
|
"name": "MLflow Job API - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0545.yaml"
|
|
},
|
|
"CVE-2026-0558": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.01936,
|
|
"epss_pct": 0.78636,
|
|
"name": "LolLMS <= 2.2.0 - Unauthenticated File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0558.yaml"
|
|
},
|
|
"CVE-2026-0560": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01765,
|
|
"epss_pct": 0.76462,
|
|
"name": "LolLMS < 2.2.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0560.yaml"
|
|
},
|
|
"CVE-2026-0594": {
|
|
"name": "WordPress List Site Contributors < 1.1.8 - Reflected XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0594.yaml"
|
|
},
|
|
"CVE-2026-0717": {
|
|
"epss": 0.0062,
|
|
"epss_pct": 0.47304,
|
|
"name": "LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0717.yaml"
|
|
},
|
|
"CVE-2026-0740": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.62903,
|
|
"epss_pct": 0.99135,
|
|
"name": "Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0740.yaml"
|
|
},
|
|
"CVE-2026-0743": {
|
|
"cvss": 4.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00576,
|
|
"epss_pct": 0.45137,
|
|
"name": "WP Content Permission <= 1.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0743.yaml"
|
|
},
|
|
"CVE-2026-0770": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.63417,
|
|
"epss_pct": 0.99149,
|
|
"name": "Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0770.yaml"
|
|
},
|
|
"CVE-2026-0829": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00682,
|
|
"epss_pct": 0.49962,
|
|
"name": "Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0829.yaml"
|
|
},
|
|
"CVE-2026-0926": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.09396,
|
|
"epss_pct": 0.95045,
|
|
"name": "Prodigy Commerce <= 3.3.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0926.yaml"
|
|
},
|
|
"CVE-2026-10520": {
|
|
"name": "Ivanti Sentry - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10520.yaml"
|
|
},
|
|
"CVE-2026-10580": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-285",
|
|
"epss": 0.02948,
|
|
"epss_pct": 0.86186,
|
|
"name": "Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10580.yaml"
|
|
},
|
|
"CVE-2026-10768": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01873,
|
|
"epss_pct": 0.77888,
|
|
"name": "Drupal LocalGov Workflows < 1.6.0 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10768.yaml"
|
|
},
|
|
"CVE-2026-10795": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-347",
|
|
"epss": 0.03578,
|
|
"epss_pct": 0.88566,
|
|
"name": "UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-10795.yaml"
|
|
},
|
|
"CVE-2026-10823": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01524,
|
|
"epss_pct": 0.72848,
|
|
"name": "YMC Filter WordPress - Unauthenticated Post Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10823.yaml"
|
|
},
|
|
"CVE-2026-1115": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.0121,
|
|
"epss_pct": 0.663,
|
|
"name": "parisneo/lollms < 2.2.0 - Authenticated Stored XSS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1115.yaml"
|
|
},
|
|
"CVE-2026-11387": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.02208,
|
|
"epss_pct": 0.81336,
|
|
"name": "SMS Alert \u2013 SMS & OTP for WooCommerce - Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-11387.yaml"
|
|
},
|
|
"CVE-2026-11801": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00967,
|
|
"epss_pct": 0.59355,
|
|
"name": "WPAdverts <= 2.3.2 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-11801.yaml"
|
|
},
|
|
"CVE-2026-1207": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.12976,
|
|
"epss_pct": 0.96039,
|
|
"name": "Django RasterField - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1207.yaml"
|
|
},
|
|
"CVE-2026-12394": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.01492,
|
|
"epss_pct": 0.72306,
|
|
"name": "WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12394.yaml"
|
|
},
|
|
"CVE-2026-1277": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00592,
|
|
"epss_pct": 0.45935,
|
|
"name": "URL Shortify <= 1.12.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1277.yaml"
|
|
},
|
|
"CVE-2026-12898": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01352,
|
|
"epss_pct": 0.69585,
|
|
"name": "All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12898.yaml"
|
|
},
|
|
"CVE-2026-1296": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.0046,
|
|
"epss_pct": 0.38131,
|
|
"name": "Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1296.yaml"
|
|
},
|
|
"CVE-2026-13001": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.03757,
|
|
"epss_pct": 0.89112,
|
|
"name": "Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13001.yaml"
|
|
},
|
|
"CVE-2026-1306": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04458,
|
|
"epss_pct": 0.90742,
|
|
"name": "WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1306.yaml"
|
|
},
|
|
"CVE-2026-1314": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00892,
|
|
"epss_pct": 0.56941,
|
|
"name": "WordPress 3D FlipBook <= 1.16.17 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1314.yaml"
|
|
},
|
|
"CVE-2026-13147": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00912,
|
|
"epss_pct": 0.57542,
|
|
"name": "WordPress Kirki < 6.0.12 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13147.yaml"
|
|
},
|
|
"CVE-2026-1357": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.32714,
|
|
"epss_pct": 0.98221,
|
|
"name": "WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1357.yaml"
|
|
},
|
|
"CVE-2026-1368": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01211,
|
|
"epss_pct": 0.66315,
|
|
"name": "Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1368.yaml"
|
|
},
|
|
"CVE-2026-13731": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00889,
|
|
"epss_pct": 0.56833,
|
|
"name": "WPBot <= 8.4.9 - Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-13731.yaml"
|
|
},
|
|
"CVE-2026-1405": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.03177,
|
|
"epss_pct": 0.87139,
|
|
"name": "WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1405.yaml"
|
|
},
|
|
"CVE-2026-14483": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.03639,
|
|
"epss_pct": 0.88747,
|
|
"name": "Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14483.yaml"
|
|
},
|
|
"CVE-2026-14894": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.03484,
|
|
"epss_pct": 0.88283,
|
|
"name": "WordPress Super Forms <= 6.3.313 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14894.yaml"
|
|
},
|
|
"CVE-2026-1492": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.24229,
|
|
"epss_pct": 0.97689,
|
|
"name": "WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1492.yaml"
|
|
},
|
|
"CVE-2026-15094": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00686,
|
|
"epss_pct": 0.50152,
|
|
"name": "WP Hotel Booking <= 2.3.2 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-15094.yaml"
|
|
},
|
|
"CVE-2026-15409": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.83658,
|
|
"epss_pct": 0.99668,
|
|
"name": "SonicWall SMA1000 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-15409.yaml"
|
|
},
|
|
"CVE-2026-1557": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.01722,
|
|
"epss_pct": 0.75872,
|
|
"name": "WP Responsive Images <= 1.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1557.yaml"
|
|
},
|
|
"CVE-2026-15733": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.13545,
|
|
"epss_pct": 0.96177,
|
|
"name": "WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-15733.yaml"
|
|
},
|
|
"CVE-2026-1581": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01727,
|
|
"epss_pct": 0.75932,
|
|
"name": "wpForo Forum <= 2.4.14 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1581.yaml"
|
|
},
|
|
"CVE-2026-15826": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-704",
|
|
"epss": 0.03911,
|
|
"epss_pct": 0.89548,
|
|
"name": "User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-15826.yaml"
|
|
},
|
|
"CVE-2026-1603": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.8056,
|
|
"epss_pct": 0.99593,
|
|
"name": "Ivanti Endpoint Manager - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1603.yaml"
|
|
},
|
|
"CVE-2026-16232": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.72051,
|
|
"epss_pct": 0.99385,
|
|
"name": "Check Point Security Management Server - SmartConsole Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-16232.yaml"
|
|
},
|
|
"CVE-2026-16268": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00437,
|
|
"epss_pct": 0.36523,
|
|
"name": "Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-16268.yaml"
|
|
},
|
|
"CVE-2026-1731": {
|
|
"cwe": "CWE-78",
|
|
"epss": 0.89396,
|
|
"epss_pct": 0.99772,
|
|
"name": "BeyondTrust Remote Support - Unauthenticated WebSocket RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml"
|
|
},
|
|
"CVE-2026-17505": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00804,
|
|
"epss_pct": 0.54198,
|
|
"name": "WordPress TranslatePress < 3.2.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-17505.yaml"
|
|
},
|
|
"CVE-2026-17532": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00817,
|
|
"epss_pct": 0.54606,
|
|
"name": "Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-17532.yaml"
|
|
},
|
|
"CVE-2026-17594": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.00613,
|
|
"epss_pct": 0.46937,
|
|
"name": "Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-17594.yaml"
|
|
},
|
|
"CVE-2026-1830": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.08095,
|
|
"epss_pct": 0.94406,
|
|
"name": "Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1830.yaml"
|
|
},
|
|
"CVE-2026-18577": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.54068,
|
|
"epss_pct": 0.98928,
|
|
"name": "N-able N-central < 2026.3.1.10 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18577.yaml"
|
|
},
|
|
"CVE-2026-1890": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00682,
|
|
"epss_pct": 0.49962,
|
|
"name": "LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1890.yaml"
|
|
},
|
|
"CVE-2026-18963": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-640",
|
|
"epss": 0.03239,
|
|
"epss_pct": 0.87401,
|
|
"name": "Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml"
|
|
},
|
|
"CVE-2026-19478": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.06001,
|
|
"epss_pct": 0.92806,
|
|
"name": "GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19478.yaml"
|
|
},
|
|
"CVE-2026-19598": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.02791,
|
|
"epss_pct": 0.8541,
|
|
"name": "Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19598.yaml"
|
|
},
|
|
"CVE-2026-1980": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00829,
|
|
"epss_pct": 0.54985,
|
|
"name": "WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1980.yaml"
|
|
},
|
|
"CVE-2026-19900": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.02243,
|
|
"epss_pct": 0.81624,
|
|
"name": "LB-LINK Routers - Unauthenticated Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19900.yaml"
|
|
},
|
|
"CVE-2026-20079": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.35946,
|
|
"epss_pct": 0.98356,
|
|
"name": "Cisco Secure Firewall Management Center - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml"
|
|
},
|
|
"CVE-2026-20182": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.91522,
|
|
"epss_pct": 0.99805,
|
|
"name": "Cisco Catalyst SD-WAN Controller - vHub Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-20182.yaml"
|
|
},
|
|
"CVE-2026-2025": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01379,
|
|
"epss_pct": 0.70164,
|
|
"name": "Mail Mint < 1.19.5 - Unauthenticated Email Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2025.yaml"
|
|
},
|
|
"CVE-2026-20253": {
|
|
"name": "Splunk Enterprise & Cloud Platform - Unrestricted File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20253.yaml"
|
|
},
|
|
"CVE-2026-20896": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-290",
|
|
"epss": 0.02755,
|
|
"epss_pct": 0.85196,
|
|
"name": "Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20896.yaml"
|
|
},
|
|
"CVE-2026-21445": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.3371,
|
|
"epss_pct": 0.98267,
|
|
"name": "Langflow - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21445.yaml"
|
|
},
|
|
"CVE-2026-21484": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"epss": 0.00779,
|
|
"epss_pct": 0.53383,
|
|
"name": "AnythingLLM - Username Enumeration via Password Recovery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21484.yaml"
|
|
},
|
|
"CVE-2026-21643": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.94085,
|
|
"epss_pct": 0.99839,
|
|
"name": "Fortinet FortiClientEMS 7.4.4 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21643.yaml"
|
|
},
|
|
"CVE-2026-21858": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.78197,
|
|
"epss_pct": 0.99543,
|
|
"name": "n8n Webhooks - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21858.yaml"
|
|
},
|
|
"CVE-2026-21859": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00772,
|
|
"epss_pct": 0.5313,
|
|
"name": "Mailpit < 1.28.3 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21859.yaml"
|
|
},
|
|
"CVE-2026-21877": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.05373,
|
|
"epss_pct": 0.92083,
|
|
"name": "n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21877.yaml"
|
|
},
|
|
"CVE-2026-21891": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.02217,
|
|
"epss_pct": 0.81411,
|
|
"name": "ZimaOS - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21891.yaml"
|
|
},
|
|
"CVE-2026-22200": {
|
|
"cwe": "CWE-74",
|
|
"epss": 0.73606,
|
|
"epss_pct": 0.99429,
|
|
"name": "osTicket - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22200.yaml"
|
|
},
|
|
"CVE-2026-22557": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.28116,
|
|
"epss_pct": 0.97967,
|
|
"name": "UniFi Network Application - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22557.yaml"
|
|
},
|
|
"CVE-2026-2262": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.0239,
|
|
"epss_pct": 0.82781,
|
|
"name": "Easy Appointments <= 3.12.21 - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2262.yaml"
|
|
},
|
|
"CVE-2026-22683": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02609,
|
|
"epss_pct": 0.84304,
|
|
"name": "Windmill < 1.603.3 - Operator Authorization Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22683.yaml"
|
|
},
|
|
"CVE-2026-22739": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0122,
|
|
"epss_pct": 0.66554,
|
|
"name": "Spring Cloud Config Server - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22739.yaml"
|
|
},
|
|
"CVE-2026-22778": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-209",
|
|
"epss": 0.03723,
|
|
"epss_pct": 0.89012,
|
|
"name": "vLLM 0.8.3 - 0.14.0 - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22778.yaml"
|
|
},
|
|
"CVE-2026-22812": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.17326,
|
|
"epss_pct": 0.96886,
|
|
"name": "OpenCode < 1.0.216 - Unauthenticated Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22812.yaml"
|
|
},
|
|
"CVE-2026-23482": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01523,
|
|
"epss_pct": 0.72835,
|
|
"name": "Blinko < 1.8.4 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23482.yaml"
|
|
},
|
|
"CVE-2026-23483": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.00771,
|
|
"epss_pct": 0.53128,
|
|
"name": "Blinko <= 1.8.3 - Path Traversal via /plugins",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23483.yaml"
|
|
},
|
|
"CVE-2026-23486": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00711,
|
|
"epss_pct": 0.51074,
|
|
"name": "Blinko <= 1.8.3 - User Information Leak",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23486.yaml"
|
|
},
|
|
"CVE-2026-23491": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.04108,
|
|
"epss_pct": 0.90044,
|
|
"name": "InvoicePlane <= 1.6.3 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23491.yaml"
|
|
},
|
|
"CVE-2026-23536": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01912,
|
|
"epss_pct": 0.78353,
|
|
"name": "Feast Feature Server <=0.58.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23536.yaml"
|
|
},
|
|
"CVE-2026-23550": {
|
|
"name": "Modular DS - Broken Access Control",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23550.yaml"
|
|
},
|
|
"CVE-2026-23696": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.16017,
|
|
"epss_pct": 0.96674,
|
|
"name": "Windmill < 1.603.3 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23696.yaml"
|
|
},
|
|
"CVE-2026-23744": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.45026,
|
|
"epss_pct": 0.98688,
|
|
"name": "MCPJam Inspector - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23744.yaml"
|
|
},
|
|
"CVE-2026-23760": {
|
|
"name": "SmarterTools SmarterMail - Admin Password Reset",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23760.yaml"
|
|
},
|
|
"CVE-2026-23829": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-93",
|
|
"epss": 0.01441,
|
|
"epss_pct": 0.71339,
|
|
"name": "Mailpit < 1.28.2 - SMTP CRLF Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-23829.yaml"
|
|
},
|
|
"CVE-2026-24061": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-88",
|
|
"epss": 0.97878,
|
|
"epss_pct": 0.99903,
|
|
"name": "GNU Inetutils telnetd - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-24061.yaml"
|
|
},
|
|
"CVE-2026-24128": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00503,
|
|
"epss_pct": 0.40977,
|
|
"name": "XWiki Platform Distribution Flavor Main - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24128.yaml"
|
|
},
|
|
"CVE-2026-2413": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.02331,
|
|
"epss_pct": 0.82341,
|
|
"name": "Ally \u2013 Web Accessibility & Usability <= 4.0.3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2413.yaml"
|
|
},
|
|
"CVE-2026-2416": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01392,
|
|
"epss_pct": 0.70415,
|
|
"name": "Geo Mashup <= 1.13.17 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2416.yaml"
|
|
},
|
|
"CVE-2026-24207": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-288",
|
|
"epss": 0.02552,
|
|
"epss_pct": 0.8392,
|
|
"name": "NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24207.yaml"
|
|
},
|
|
"CVE-2026-24423": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.87693,
|
|
"epss_pct": 0.99747,
|
|
"name": "SmarterMail - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24423.yaml"
|
|
},
|
|
"CVE-2026-24477": {
|
|
"name": "AnythingLLM - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24477.yaml"
|
|
},
|
|
"CVE-2026-25231": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-284",
|
|
"name": "FileRise <= 3.3.0 - Unauthenticated File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25231.yaml"
|
|
},
|
|
"CVE-2026-25512": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.18536,
|
|
"epss_pct": 0.97043,
|
|
"name": "Group-Office < 26.0.5 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25512.yaml"
|
|
},
|
|
"CVE-2026-25527": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0092,
|
|
"epss_pct": 0.57792,
|
|
"name": "changedetection.io <= 0.52.9 - Unauthenticated Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25527.yaml"
|
|
},
|
|
"CVE-2026-25545": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01769,
|
|
"epss_pct": 0.76534,
|
|
"name": "Astro SSR - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25545.yaml"
|
|
},
|
|
"CVE-2026-25555": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.01824,
|
|
"epss_pct": 0.7726,
|
|
"name": "OpenBullet2 <= 0.3.2 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25555.yaml"
|
|
},
|
|
"CVE-2026-25616": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00383,
|
|
"epss_pct": 0.31299,
|
|
"name": "Blesta <= 5.13.1 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25616.yaml"
|
|
},
|
|
"CVE-2026-25892": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.01586,
|
|
"epss_pct": 0.73847,
|
|
"name": "Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25892.yaml"
|
|
},
|
|
"CVE-2026-25895": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11195,
|
|
"epss_pct": 0.95637,
|
|
"name": "FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25895.yaml"
|
|
},
|
|
"CVE-2026-2614": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02982,
|
|
"epss_pct": 0.86336,
|
|
"name": "MLflow <= 3.9.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2614.yaml"
|
|
},
|
|
"CVE-2026-26190": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.36912,
|
|
"epss_pct": 0.98399,
|
|
"name": "Milvus - Unauthenticated Metrics API Access",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26190.yaml"
|
|
},
|
|
"CVE-2026-26217": {
|
|
"epss": 0.01914,
|
|
"epss_pct": 0.7838,
|
|
"name": "Crawl4AI < 0.8.0 - Local File Inclusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26217.yaml"
|
|
},
|
|
"CVE-2026-26341": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-1392",
|
|
"epss": 0.02663,
|
|
"epss_pct": 0.84643,
|
|
"name": "Tattile Camera < 1.181.5 - Default Login",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26341.yaml"
|
|
},
|
|
"CVE-2026-2652": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.20783,
|
|
"epss_pct": 0.97364,
|
|
"name": "MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2652.yaml"
|
|
},
|
|
"CVE-2026-26980": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.70208,
|
|
"epss_pct": 0.9933,
|
|
"name": "Ghost CMS Content API - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26980.yaml"
|
|
},
|
|
"CVE-2026-2699": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.59506,
|
|
"epss_pct": 0.99055,
|
|
"name": "Progress ShareFile Storage Zones Controller - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2699.yaml"
|
|
},
|
|
"CVE-2026-27174": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.06996,
|
|
"epss_pct": 0.93691,
|
|
"name": "MajorDoMo - Unauthenticated RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27174.yaml"
|
|
},
|
|
"CVE-2026-27176": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00449,
|
|
"epss_pct": 0.37433,
|
|
"name": "MajorDoMo - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27176.yaml"
|
|
},
|
|
"CVE-2026-27483": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.11113,
|
|
"epss_pct": 0.95619,
|
|
"name": "MindsDB - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27483.yaml"
|
|
},
|
|
"CVE-2026-27542": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-266",
|
|
"epss": 0.01737,
|
|
"epss_pct": 0.7608,
|
|
"name": "WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27542.yaml"
|
|
},
|
|
"CVE-2026-27645": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00445,
|
|
"epss_pct": 0.37143,
|
|
"name": "Changedetection.io RSS Single Watch - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27645.yaml"
|
|
},
|
|
"CVE-2026-27760": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.34629,
|
|
"epss_pct": 0.98303,
|
|
"name": "OpenCATS - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27760.yaml"
|
|
},
|
|
"CVE-2026-27771": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01393,
|
|
"epss_pct": 0.70438,
|
|
"name": "Gitea Container Registry - Unauthorized Private Image Access",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27771.yaml"
|
|
},
|
|
"CVE-2026-27796": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01154,
|
|
"epss_pct": 0.64751,
|
|
"name": "Homarr < 1.54.0 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27796.yaml"
|
|
},
|
|
"CVE-2026-27826": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.13632,
|
|
"epss_pct": 0.96201,
|
|
"name": "mcp-atlassian < 0.17.0 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27826.yaml"
|
|
},
|
|
"CVE-2026-27833": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01641,
|
|
"epss_pct": 0.747,
|
|
"name": "Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27833.yaml"
|
|
},
|
|
"CVE-2026-27944": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.22162,
|
|
"epss_pct": 0.97499,
|
|
"name": "Nginx UI < 2.3.3 - Information Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27944.yaml"
|
|
},
|
|
"CVE-2026-27971": {
|
|
"cvss": 9.2,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.05416,
|
|
"epss_pct": 0.92132,
|
|
"name": "Qwik - Unauthenticated RCE via server$ Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27971.yaml"
|
|
},
|
|
"CVE-2026-28288": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-204",
|
|
"epss": 0.00635,
|
|
"epss_pct": 0.47987,
|
|
"name": "Dify User Enumeration via Observable Response Discrepancy",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28288.yaml"
|
|
},
|
|
"CVE-2026-28358": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-204",
|
|
"epss": 0.00601,
|
|
"epss_pct": 0.46361,
|
|
"name": "NocoDB - User Enumeration",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28358.yaml"
|
|
},
|
|
"CVE-2026-28409": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.03315,
|
|
"epss_pct": 0.87703,
|
|
"name": "WeGIA <= 3.6.4 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28409.yaml"
|
|
},
|
|
"CVE-2026-28414": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-36",
|
|
"epss": 0.03098,
|
|
"epss_pct": 0.86814,
|
|
"name": "Gradio - Absolute Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28414.yaml"
|
|
},
|
|
"CVE-2026-28496": {
|
|
"name": "FOSSBilling - Server-Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28496.yaml"
|
|
},
|
|
"CVE-2026-29014": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.3949,
|
|
"epss_pct": 0.98505,
|
|
"name": "MetInfo CMS <= 8.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29014.yaml"
|
|
},
|
|
"CVE-2026-29059": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02945,
|
|
"epss_pct": 0.86173,
|
|
"name": "Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29059.yaml"
|
|
},
|
|
"CVE-2026-29066": {
|
|
"cvss": 6.2,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01025,
|
|
"epss_pct": 0.61146,
|
|
"name": "TinaCMS - Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29066.yaml"
|
|
},
|
|
"CVE-2026-29183": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00625,
|
|
"epss_pct": 0.47543,
|
|
"name": "SiYuan Note - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29183.yaml"
|
|
},
|
|
"CVE-2026-3001": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00473,
|
|
"epss_pct": 0.39011,
|
|
"name": "Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3001.yaml"
|
|
},
|
|
"CVE-2026-3018": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01382,
|
|
"epss_pct": 0.70221,
|
|
"name": "WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3018.yaml"
|
|
},
|
|
"CVE-2026-3055": {
|
|
"name": "Citrix NetScaler SAML IDP - Memory Overread",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3055.yaml"
|
|
},
|
|
"CVE-2026-30623": {
|
|
"cwe": "CWE-77",
|
|
"epss": 0.04997,
|
|
"epss_pct": 0.91617,
|
|
"name": "LiteLLM 1.18.10 - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30623.yaml"
|
|
},
|
|
"CVE-2026-30824": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.3625,
|
|
"epss_pct": 0.98365,
|
|
"name": "Flowise - NVIDIA NIM Endpoints Missing Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30824.yaml"
|
|
},
|
|
"CVE-2026-30928": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01657,
|
|
"epss_pct": 0.7492,
|
|
"name": "Glances - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30928.yaml"
|
|
},
|
|
"CVE-2026-30958": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01139,
|
|
"epss_pct": 0.64334,
|
|
"name": "OneUptime < 10.0.21 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30958.yaml"
|
|
},
|
|
"CVE-2026-30965": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.01329,
|
|
"epss_pct": 0.69039,
|
|
"name": "Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30965.yaml"
|
|
},
|
|
"CVE-2026-31431": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-787",
|
|
"epss": 0.99907,
|
|
"epss_pct": 0.99965,
|
|
"name": "Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-31431.yaml"
|
|
},
|
|
"CVE-2026-31807": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00445,
|
|
"epss_pct": 0.37137,
|
|
"name": "SiYuan <= v3.5.9 - SVG Animate Element XSS",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31807.yaml"
|
|
},
|
|
"CVE-2026-31809": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00505,
|
|
"epss_pct": 0.41129,
|
|
"name": "SiYuan <= v3.5.9 - Cross Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31809.yaml"
|
|
},
|
|
"CVE-2026-31816": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-74",
|
|
"epss": 0.15339,
|
|
"epss_pct": 0.96526,
|
|
"name": "Budibase - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31816.yaml"
|
|
},
|
|
"CVE-2026-31831": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01965,
|
|
"epss_pct": 0.78941,
|
|
"name": "Tautulli <= 2.16.1 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31831.yaml"
|
|
},
|
|
"CVE-2026-32230": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00905,
|
|
"epss_pct": 0.57325,
|
|
"name": "Uptime-Kuma < v1.23.0 - Improper Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32230.yaml"
|
|
},
|
|
"CVE-2026-32255": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.20776,
|
|
"epss_pct": 0.97363,
|
|
"name": "Kan <= 0.5.4 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32255.yaml"
|
|
},
|
|
"CVE-2026-32475": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.02374,
|
|
"epss_pct": 0.82665,
|
|
"name": "Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32475.yaml"
|
|
},
|
|
"CVE-2026-32583": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.007,
|
|
"epss_pct": 0.50644,
|
|
"name": "Webnus Inc. Modern Events Calendar - Broken Access Control",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32583.yaml"
|
|
},
|
|
"CVE-2026-32596": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.0155,
|
|
"epss_pct": 0.73311,
|
|
"name": "Glances - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32596.yaml"
|
|
},
|
|
"CVE-2026-3296": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.03469,
|
|
"epss_pct": 0.88234,
|
|
"name": "Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3296.yaml"
|
|
},
|
|
"CVE-2026-3300": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.39159,
|
|
"epss_pct": 0.98488,
|
|
"name": "Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3300.yaml"
|
|
},
|
|
"CVE-2026-33017": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.96177,
|
|
"epss_pct": 0.99872,
|
|
"name": "Langflow < 1.9.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33017.yaml"
|
|
},
|
|
"CVE-2026-33032": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.36299,
|
|
"epss_pct": 0.98367,
|
|
"name": "Nginx UI - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33032.yaml"
|
|
},
|
|
"CVE-2026-33057": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.05289,
|
|
"epss_pct": 0.91996,
|
|
"name": "Mesop AI Sandbox <= 1.2.2 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33057.yaml"
|
|
},
|
|
"CVE-2026-3326": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01866,
|
|
"epss_pct": 0.778,
|
|
"name": "XStore Theme < 9.7.3 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3326.yaml"
|
|
},
|
|
"CVE-2026-33340": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.21629,
|
|
"epss_pct": 0.97451,
|
|
"name": "LoLLMs WEBUI - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33340.yaml"
|
|
},
|
|
"CVE-2026-3335": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01142,
|
|
"epss_pct": 0.64408,
|
|
"name": "Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3335.yaml"
|
|
},
|
|
"CVE-2026-33439": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.10005,
|
|
"epss_pct": 0.95267,
|
|
"name": "OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33439.yaml"
|
|
},
|
|
"CVE-2026-33453": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-915",
|
|
"epss": 0.06157,
|
|
"epss_pct": 0.92963,
|
|
"name": "Apache Camel camel-coap - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-33453.yaml"
|
|
},
|
|
"CVE-2026-33476": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03256,
|
|
"epss_pct": 0.87473,
|
|
"name": "SiYuan <= v3.6.1 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33476.yaml"
|
|
},
|
|
"CVE-2026-33478": {
|
|
"name": "AVideo <= 26.0 - WWBN AVideo - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33478.yaml"
|
|
},
|
|
"CVE-2026-33497": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.19584,
|
|
"epss_pct": 0.97189,
|
|
"name": "Langflow < 1.7.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33497.yaml"
|
|
},
|
|
"CVE-2026-33534": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01978,
|
|
"epss_pct": 0.79083,
|
|
"name": "EspoCRM <= 9.3.3 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33534.yaml"
|
|
},
|
|
"CVE-2026-33626": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.4525,
|
|
"epss_pct": 0.98695,
|
|
"name": "LMDeploy - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33626.yaml"
|
|
},
|
|
"CVE-2026-33868": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00473,
|
|
"epss_pct": 0.39086,
|
|
"name": "Mastodon - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33868.yaml"
|
|
},
|
|
"CVE-2026-3395": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.0388,
|
|
"epss_pct": 0.89471,
|
|
"name": "MaxSite CMS <=109.1 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3395.yaml"
|
|
},
|
|
"CVE-2026-3396": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01473,
|
|
"epss_pct": 0.71975,
|
|
"name": "WCAPF WooCommerce Ajax Product Filter - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3396.yaml"
|
|
},
|
|
"CVE-2026-34036": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-98",
|
|
"epss": 0.01464,
|
|
"epss_pct": 0.71798,
|
|
"name": "Dolibarr <=22.0.4 - Local File Inclusion",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34036.yaml"
|
|
},
|
|
"CVE-2026-34156": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-913",
|
|
"epss": 0.34966,
|
|
"epss_pct": 0.98317,
|
|
"name": "NocoBase - VM Sandbox Escape to Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34156.yaml"
|
|
},
|
|
"CVE-2026-34197": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.9722,
|
|
"epss_pct": 0.99889,
|
|
"name": "Apache ActiveMQ - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34197.yaml"
|
|
},
|
|
"CVE-2026-34413": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.0311,
|
|
"epss_pct": 0.86859,
|
|
"name": "Xerte Online Toolkits <= 3.15 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34413.yaml"
|
|
},
|
|
"CVE-2026-34453": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.01227,
|
|
"epss_pct": 0.66747,
|
|
"name": "SiYuan <= v3.6.1 - Bookmark Data Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34453.yaml"
|
|
},
|
|
"CVE-2026-34486": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.98616,
|
|
"epss_pct": 0.9992,
|
|
"name": "Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34486.yaml"
|
|
},
|
|
"CVE-2026-34605": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00469,
|
|
"epss_pct": 0.38756,
|
|
"name": "SiYuan Note - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34605.yaml"
|
|
},
|
|
"CVE-2026-34847": {
|
|
"cvss": 4.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00401,
|
|
"epss_pct": 0.33237,
|
|
"name": "Hoppscotch <= 2026.2.1 - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34847.yaml"
|
|
},
|
|
"CVE-2026-34885": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01668,
|
|
"epss_pct": 0.75093,
|
|
"name": "WordPress Media Library Assistant <= 3.34 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34885.yaml"
|
|
},
|
|
"CVE-2026-34908": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.85194,
|
|
"epss_pct": 0.99698,
|
|
"name": "UniFi OS - Authentication Bypass via Path Traversal (..%2f)",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34908.yaml"
|
|
},
|
|
"CVE-2026-34910": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"epss": 0.87468,
|
|
"epss_pct": 0.99744,
|
|
"name": "UniFi OS Server - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34910.yaml"
|
|
},
|
|
"CVE-2026-34976": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.02036,
|
|
"epss_pct": 0.7972,
|
|
"name": "Dgraph <=v25.3.0 - Admin Mutation Missing Authorization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34976.yaml"
|
|
},
|
|
"CVE-2026-35029": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.26409,
|
|
"epss_pct": 0.97858,
|
|
"name": "LiteLLM - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35029.yaml"
|
|
},
|
|
"CVE-2026-35037": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00618,
|
|
"epss_pct": 0.47169,
|
|
"name": "Ech0 < 4.2.8 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35037.yaml"
|
|
},
|
|
"CVE-2026-35273": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.95473,
|
|
"epss_pct": 0.99863,
|
|
"name": "Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35273.yaml"
|
|
},
|
|
"CVE-2026-35616": {
|
|
"cwe": "CWE-284",
|
|
"epss": 0.90749,
|
|
"epss_pct": 0.99795,
|
|
"name": "FortiClient EMS - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35616.yaml"
|
|
},
|
|
"CVE-2026-3576": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.12943,
|
|
"epss_pct": 0.9603,
|
|
"name": "Planyo Online Reservation System <= 3.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3576.yaml"
|
|
},
|
|
"CVE-2026-3584": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.07239,
|
|
"epss_pct": 0.93879,
|
|
"name": "WordPress Kali Forms <= 2.4.9 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3584.yaml"
|
|
},
|
|
"CVE-2026-38360": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.05982,
|
|
"epss_pct": 0.92785,
|
|
"name": "dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-38360.yaml"
|
|
},
|
|
"CVE-2026-38361": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"cwe": "CWE-400",
|
|
"epss": 0.02643,
|
|
"epss_pct": 0.84517,
|
|
"name": "dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-38361.yaml"
|
|
},
|
|
"CVE-2026-3844": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.27701,
|
|
"epss_pct": 0.97944,
|
|
"name": "Breeze <= 2.4.4 - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3844.yaml"
|
|
},
|
|
"CVE-2026-3891": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.2506,
|
|
"epss_pct": 0.97763,
|
|
"name": "Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3891.yaml"
|
|
},
|
|
"CVE-2026-39339": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.01351,
|
|
"epss_pct": 0.69562,
|
|
"name": "ChurchCRM - API Authentication Bypass via URL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39339.yaml"
|
|
},
|
|
"CVE-2026-39352": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01279,
|
|
"epss_pct": 0.6797,
|
|
"name": "Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39352.yaml"
|
|
},
|
|
"CVE-2026-39363": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
|
|
"epss": 0.03396,
|
|
"epss_pct": 0.87982,
|
|
"name": "Vite Dev Server - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39363.yaml"
|
|
},
|
|
"CVE-2026-39364": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02095,
|
|
"epss_pct": 0.80347,
|
|
"name": "Vite Dev Server - Directory Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39364.yaml"
|
|
},
|
|
"CVE-2026-39365": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.00914,
|
|
"epss_pct": 0.57632,
|
|
"name": "Vite Dev Server - Path Traversal in Optimized Deps .map Handling",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39365.yaml"
|
|
},
|
|
"CVE-2026-39468": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01221,
|
|
"epss_pct": 0.66571,
|
|
"name": "Meta Box <= 5.11.1 - Arbitrary File Deletion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39468.yaml"
|
|
},
|
|
"CVE-2026-39808": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.92819,
|
|
"epss_pct": 0.99821,
|
|
"name": "Fortinet FortiSandbox - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39808.yaml"
|
|
},
|
|
"CVE-2026-39987": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.97279,
|
|
"epss_pct": 0.99891,
|
|
"name": "Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39987.yaml"
|
|
},
|
|
"CVE-2026-40105": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00549,
|
|
"epss_pct": 0.43757,
|
|
"name": "XWiki - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40105.yaml"
|
|
},
|
|
"CVE-2026-40151": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00758,
|
|
"epss_pct": 0.52679,
|
|
"name": "PraisonAI AgentOS - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40151.yaml"
|
|
},
|
|
"CVE-2026-4020": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.39975,
|
|
"epss_pct": 0.98523,
|
|
"name": "Gravity SMTP WordPress Plugin - Sensitive Information Exposure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4020.yaml"
|
|
},
|
|
"CVE-2026-40217": {
|
|
"cvss": 8.7,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.15056,
|
|
"epss_pct": 0.96477,
|
|
"name": "LiteLLM < 1.25.0 - Remote Code Execution",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40217.yaml"
|
|
},
|
|
"CVE-2026-40242": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00621,
|
|
"epss_pct": 0.47323,
|
|
"name": "Arcane <= 1.17.2 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40242.yaml"
|
|
},
|
|
"CVE-2026-40280": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01559,
|
|
"epss_pct": 0.73453,
|
|
"name": "Gotenberg <= 8.30.1 - Server Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40280.yaml"
|
|
},
|
|
"CVE-2026-40308": {
|
|
"cwe": "CWE-639",
|
|
"epss": 0.00932,
|
|
"epss_pct": 0.58209,
|
|
"name": "My Calendar WordPress Plugin - Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40308.yaml"
|
|
},
|
|
"CVE-2026-40466": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.04783,
|
|
"epss_pct": 0.91292,
|
|
"name": "Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40466.yaml"
|
|
},
|
|
"CVE-2026-4060": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01422,
|
|
"epss_pct": 0.70988,
|
|
"name": "Geo Mashup <= 1.13.18 - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4060.yaml"
|
|
},
|
|
"CVE-2026-40878": {
|
|
"cvss": 3.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
|
|
"epss": 0.00805,
|
|
"epss_pct": 0.54242,
|
|
"name": "Mailcow < 2026-03b - Href Link Injection",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40878.yaml"
|
|
},
|
|
"CVE-2026-40887": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01762,
|
|
"epss_pct": 0.7643,
|
|
"name": "Vendure Core - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40887.yaml"
|
|
},
|
|
"CVE-2026-41042": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.01512,
|
|
"epss_pct": 0.72673,
|
|
"name": "Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41042.yaml"
|
|
},
|
|
"CVE-2026-4106": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"epss": 0.00742,
|
|
"epss_pct": 0.52163,
|
|
"name": "HT Mega < 3.0.7 - Sensitive Information Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4106.yaml"
|
|
},
|
|
"CVE-2026-41176": {
|
|
"cvss": 9.2,
|
|
"cwe": "CWE-306",
|
|
"epss": 0.32715,
|
|
"epss_pct": 0.98221,
|
|
"name": "Rclone RC - Broken Access Control",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41176.yaml"
|
|
},
|
|
"CVE-2026-41179": {
|
|
"cvss": 9.2,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.08585,
|
|
"epss_pct": 0.94684,
|
|
"name": "RClone RC - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41179.yaml"
|
|
},
|
|
"CVE-2026-41432": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
|
|
"cwe": "CWE-345",
|
|
"epss": 0.0085,
|
|
"epss_pct": 0.55635,
|
|
"name": "New API < v0.12.10 - Stripe Webhook Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41432.yaml"
|
|
},
|
|
"CVE-2026-41492": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03082,
|
|
"epss_pct": 0.86753,
|
|
"name": "Dgraph <= 25.3.2 - Admin Token Disclosure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41492.yaml"
|
|
},
|
|
"CVE-2026-41640": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01875,
|
|
"epss_pct": 0.77911,
|
|
"name": "NocoBase - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41640.yaml"
|
|
},
|
|
"CVE-2026-41641": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01833,
|
|
"epss_pct": 0.77375,
|
|
"name": "NocoBase - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41641.yaml"
|
|
},
|
|
"CVE-2026-41940": {
|
|
"name": "cPanel & WHM - Authentication Bypass via Session-File CRLF Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41940.yaml"
|
|
},
|
|
"CVE-2026-42031": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01817,
|
|
"epss_pct": 0.77163,
|
|
"name": "CKAN DataStore SQL Search - SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42031.yaml"
|
|
},
|
|
"CVE-2026-42167": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.07389,
|
|
"epss_pct": 0.93979,
|
|
"name": "ProFTPD mod_sql - Preauth User Backdoor",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-42167.yaml"
|
|
},
|
|
"CVE-2026-42208": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.8942,
|
|
"epss_pct": 0.99773,
|
|
"name": "LiteLLM - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42208.yaml"
|
|
},
|
|
"CVE-2026-42271": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.83594,
|
|
"epss_pct": 0.99664,
|
|
"name": "LiteLLM - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42271.yaml"
|
|
},
|
|
"CVE-2026-42281": {
|
|
"cvss": 9.2,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01623,
|
|
"epss_pct": 0.74412,
|
|
"name": "MagicMirror <= 2.35.0 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42281.yaml"
|
|
},
|
|
"CVE-2026-42461": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.01283,
|
|
"epss_pct": 0.68055,
|
|
"name": "Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42461.yaml"
|
|
},
|
|
"CVE-2026-42569": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
|
|
"epss": 0.01173,
|
|
"epss_pct": 0.65293,
|
|
"name": "phpVMS < 7.0.6 - Legacy Importer Authorization Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42569.yaml"
|
|
},
|
|
"CVE-2026-4257": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.41475,
|
|
"epss_pct": 0.98573,
|
|
"name": "WordPress Contact Form by Supsystic - Server-Side Template Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4257.yaml"
|
|
},
|
|
"CVE-2026-42589": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.03013,
|
|
"epss_pct": 0.86468,
|
|
"name": "Gotenberg - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42589.yaml"
|
|
},
|
|
"CVE-2026-42596": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01239,
|
|
"epss_pct": 0.67004,
|
|
"name": "Gotenberg < 8.31.0 - Server-Side Request Forgery",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42596.yaml"
|
|
},
|
|
"CVE-2026-42647": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01323,
|
|
"epss_pct": 0.68909,
|
|
"name": "JoomSport <= 5.7.7 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42647.yaml"
|
|
},
|
|
"CVE-2026-42796": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.02747,
|
|
"epss_pct": 0.85148,
|
|
"name": "Arelle < 2.39.10 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42796.yaml"
|
|
},
|
|
"CVE-2026-42878": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00552,
|
|
"epss_pct": 0.43922,
|
|
"name": "FacturaScripts - Unauthenticated phpinfo Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42878.yaml"
|
|
},
|
|
"CVE-2026-44177": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.0177,
|
|
"epss_pct": 0.76552,
|
|
"name": "Kirby CMS 5.3.0-5.4.0 - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44177.yaml"
|
|
},
|
|
"CVE-2026-44262": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.0586,
|
|
"epss_pct": 0.92667,
|
|
"name": "Scramble Laravel - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44262.yaml"
|
|
},
|
|
"CVE-2026-44338": {
|
|
"cvss": 7.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.28571,
|
|
"epss_pct": 0.97994,
|
|
"name": "PraisonAI - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44338.yaml"
|
|
},
|
|
"CVE-2026-44381": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.00666,
|
|
"epss_pct": 0.49304,
|
|
"name": "MISP < 2.5.37 - SQL Injection",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44381.yaml"
|
|
},
|
|
"CVE-2026-44551": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.01461,
|
|
"epss_pct": 0.71726,
|
|
"name": "Open WebUI 'LDAP Empty Password' - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44551.yaml"
|
|
},
|
|
"CVE-2026-44578": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.38872,
|
|
"epss_pct": 0.98479,
|
|
"name": "Next.js WebSocket Upgrade Handler - SSRF",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-44578.yaml"
|
|
},
|
|
"CVE-2026-4480": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.1393,
|
|
"epss_pct": 0.96269,
|
|
"name": "Samba Printing Subsystem - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-4480.yaml"
|
|
},
|
|
"CVE-2026-44825": {
|
|
"cvss": 8.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.02892,
|
|
"epss_pct": 0.85929,
|
|
"name": "Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44825.yaml"
|
|
},
|
|
"CVE-2026-45298": {
|
|
"cvss": 8.6,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01491,
|
|
"epss_pct": 0.72284,
|
|
"name": "Dozzle - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45298.yaml"
|
|
},
|
|
"CVE-2026-45332": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.0134,
|
|
"epss_pct": 0.69312,
|
|
"name": "Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45332.yaml"
|
|
},
|
|
"CVE-2026-45397": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.0075,
|
|
"epss_pct": 0.52412,
|
|
"name": "Open WebUI < 0.9.5 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45397.yaml"
|
|
},
|
|
"CVE-2026-45695": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-88",
|
|
"epss": 0.0161,
|
|
"epss_pct": 0.7421,
|
|
"name": "Kopia Server 0.23.0 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45695.yaml"
|
|
},
|
|
"CVE-2026-4631": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.1548,
|
|
"epss_pct": 0.96552,
|
|
"name": "Cockpit Web Console < 360 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4631.yaml"
|
|
},
|
|
"CVE-2026-46339": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.03352,
|
|
"epss_pct": 0.87834,
|
|
"name": "9Router <= 0.4.36 - Unauthenticated RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46339.yaml"
|
|
},
|
|
"CVE-2026-46364": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01709,
|
|
"epss_pct": 0.75701,
|
|
"name": "phpMyFAQ <= 4.1.1 - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46364.yaml"
|
|
},
|
|
"CVE-2026-46372": {
|
|
"cvss": 8.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00866,
|
|
"epss_pct": 0.56159,
|
|
"name": "SillyTavern - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46372.yaml"
|
|
},
|
|
"CVE-2026-46442": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.3634,
|
|
"epss_pct": 0.9837,
|
|
"name": "Flowise < 3.1.2 - node-custom-function Unauthorized RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46442.yaml"
|
|
},
|
|
"CVE-2026-46670": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01654,
|
|
"epss_pct": 0.74872,
|
|
"name": "YesWiki < 4.6.4 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46670.yaml"
|
|
},
|
|
"CVE-2026-46725": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.02625,
|
|
"epss_pct": 0.844,
|
|
"name": "TYPO3 ceselector Extension - Insecure Deserialization",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46725.yaml"
|
|
},
|
|
"CVE-2026-47668": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.03882,
|
|
"epss_pct": 0.89478,
|
|
"name": "DbGate - Remote Code Execution via Anonymous JWT",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47668.yaml"
|
|
},
|
|
"CVE-2026-47670": {
|
|
"cvss": 9.4,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.01714,
|
|
"epss_pct": 0.75775,
|
|
"name": "DbGate - Remote Code Execution via Dynamic Import Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47670.yaml"
|
|
},
|
|
"CVE-2026-47717": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-201",
|
|
"epss": 0.01204,
|
|
"epss_pct": 0.6609,
|
|
"name": "FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47717.yaml"
|
|
},
|
|
"CVE-2026-48030": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.05849,
|
|
"epss_pct": 0.92649,
|
|
"name": "Pheditor 2.0.1-2.0.3 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48030.yaml"
|
|
},
|
|
"CVE-2026-4810": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/U:Amber",
|
|
"epss": 0.01818,
|
|
"epss_pct": 0.7718,
|
|
"name": "Google ADK-Python - Unauthenticated Builder Endpoint",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4810.yaml"
|
|
},
|
|
"CVE-2026-48282": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.42388,
|
|
"epss_pct": 0.98602,
|
|
"name": "Adobe ColdFusion - RDS Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48282.yaml"
|
|
},
|
|
"CVE-2026-48313": {
|
|
"name": "ColdFusion - Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48313.yaml"
|
|
},
|
|
"CVE-2026-48611": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.0386,
|
|
"epss_pct": 0.89423,
|
|
"name": "phpBB < 3.3.17 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48611.yaml"
|
|
},
|
|
"CVE-2026-48710": {
|
|
"cvss": 6.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
|
|
"cwe": "CWE-1289",
|
|
"epss": 0.02099,
|
|
"epss_pct": 0.80383,
|
|
"name": "Starlette - Improper Validation of Unsafe Equivalence in Input",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml"
|
|
},
|
|
"CVE-2026-48907": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.781,
|
|
"epss_pct": 0.99541,
|
|
"name": "Joomla! JCE extension < 2.9.99.5 unauthenticated RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48907.yaml"
|
|
},
|
|
"CVE-2026-48908": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.14824,
|
|
"epss_pct": 0.96438,
|
|
"name": "Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-48908.yaml"
|
|
},
|
|
"CVE-2026-48909": {
|
|
"cvss": 9.5,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.04941,
|
|
"epss_pct": 0.91533,
|
|
"name": "Joomla SP LMS <= 4.1.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-48909.yaml"
|
|
},
|
|
"CVE-2026-48939": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.19727,
|
|
"epss_pct": 0.97209,
|
|
"name": "Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48939.yaml"
|
|
},
|
|
"CVE-2026-49049": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-284",
|
|
"epss": 0.00992,
|
|
"epss_pct": 0.60105,
|
|
"name": "JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml"
|
|
},
|
|
"CVE-2026-49069": {
|
|
"cvss": 7.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.01171,
|
|
"epss_pct": 0.65241,
|
|
"name": "WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49069.yaml"
|
|
},
|
|
"CVE-2026-49777": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-506",
|
|
"epss": 0.01656,
|
|
"epss_pct": 0.74903,
|
|
"name": "WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49777.yaml"
|
|
},
|
|
"CVE-2026-4987": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-20",
|
|
"epss": 0.00955,
|
|
"epss_pct": 0.58939,
|
|
"name": "SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4987.yaml"
|
|
},
|
|
"CVE-2026-49952": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-323",
|
|
"epss": 0.04717,
|
|
"epss_pct": 0.91185,
|
|
"name": "Discuz! X5.0 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49952.yaml"
|
|
},
|
|
"CVE-2026-50160": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-915",
|
|
"epss": 0.01701,
|
|
"epss_pct": 0.75587,
|
|
"name": "Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50160.yaml"
|
|
},
|
|
"CVE-2026-50229": {
|
|
"cwe": "CWE-80",
|
|
"epss": 0.04091,
|
|
"epss_pct": 0.90004,
|
|
"name": "Apache Tomcat - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50229.yaml"
|
|
},
|
|
"CVE-2026-50230": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00406,
|
|
"epss_pct": 0.33705,
|
|
"name": "Lyrion Music Server <= 9.2.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50230.yaml"
|
|
},
|
|
"CVE-2026-5027": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.31661,
|
|
"epss_pct": 0.98165,
|
|
"name": "Langflow <= 1.8.4 - Path Traversal to RCE via File Upload",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5027.yaml"
|
|
},
|
|
"CVE-2026-5032": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.03057,
|
|
"epss_pct": 0.86657,
|
|
"name": "W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5032.yaml"
|
|
},
|
|
"CVE-2026-5073": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01383,
|
|
"epss_pct": 0.70238,
|
|
"name": "WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5073.yaml"
|
|
},
|
|
"CVE-2026-50751": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"epss": 0.83771,
|
|
"epss_pct": 0.99669,
|
|
"name": "Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50751.yaml"
|
|
},
|
|
"CVE-2026-52773": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"name": "YesWiki Archived Revision - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52773.yaml"
|
|
},
|
|
"CVE-2026-52774": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"name": "YesWiki Bazar Widget - Reflected XSS via 'id' Parameter",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52774.yaml"
|
|
},
|
|
"CVE-2026-52806": {
|
|
"cvss": 9.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-77",
|
|
"epss": 0.07934,
|
|
"epss_pct": 0.94314,
|
|
"name": "Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52806.yaml"
|
|
},
|
|
"CVE-2026-52815": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.01488,
|
|
"epss_pct": 0.72234,
|
|
"name": "Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure",
|
|
"severity": "low",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52815.yaml"
|
|
},
|
|
"CVE-2026-52824": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-1188",
|
|
"name": "Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52824.yaml"
|
|
},
|
|
"CVE-2026-53519": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01928,
|
|
"epss_pct": 0.78537,
|
|
"name": "Nezha Dashboard < 2.0.13 - Path Traversal",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53519.yaml"
|
|
},
|
|
"CVE-2026-53576": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.03296,
|
|
"epss_pct": 0.87633,
|
|
"name": "Kestra <= 1.3.20 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53576.yaml"
|
|
},
|
|
"CVE-2026-53629": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"name": "GLPI - Blind SQL Injection in History Log Filter (LogBleed)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53629.yaml"
|
|
},
|
|
"CVE-2026-53753": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.029,
|
|
"epss_pct": 0.85969,
|
|
"name": "Crawl4AI <= 0.8.6 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53753.yaml"
|
|
},
|
|
"CVE-2026-53755": {
|
|
"cvss": 8.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"name": "crawl4ai < 0.8.9 - Server Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53755.yaml"
|
|
},
|
|
"CVE-2026-53787": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.05638,
|
|
"epss_pct": 0.92408,
|
|
"name": "Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53787.yaml"
|
|
},
|
|
"CVE-2026-53976": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01899,
|
|
"epss_pct": 0.78201,
|
|
"name": "OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53976.yaml"
|
|
},
|
|
"CVE-2026-54066": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02386,
|
|
"epss_pct": 0.82747,
|
|
"name": "SiYuan <= 3.6.5 - Unauthenticated Path Traversal",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54066.yaml"
|
|
},
|
|
"CVE-2026-54069": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-346",
|
|
"epss": 0.00579,
|
|
"epss_pct": 0.45319,
|
|
"name": "SiYuan Note <= 3.6.5 - Authentication Bypass",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54069.yaml"
|
|
},
|
|
"CVE-2026-54157": {
|
|
"cwe": "CWE-918",
|
|
"epss": 0.0183,
|
|
"epss_pct": 0.77331,
|
|
"name": "LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54157.yaml"
|
|
},
|
|
"CVE-2026-54236": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-532",
|
|
"epss": 0.00927,
|
|
"epss_pct": 0.58016,
|
|
"name": "vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54236.yaml"
|
|
},
|
|
"CVE-2026-54836": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01343,
|
|
"epss_pct": 0.69372,
|
|
"name": "YMC Filter - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54836.yaml"
|
|
},
|
|
"CVE-2026-54917": {
|
|
"cvss": 7.8,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01219,
|
|
"epss_pct": 0.66527,
|
|
"name": "SeaweedFS <= 4.29 - Path Traversal File Write",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54917.yaml"
|
|
},
|
|
"CVE-2026-55040": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-1390",
|
|
"epss": 0.39652,
|
|
"epss_pct": 0.98513,
|
|
"name": "Microsoft SharePoint Server - JWT Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-55040.yaml"
|
|
},
|
|
"CVE-2026-55087": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"epss": 0.00523,
|
|
"epss_pct": 0.42303,
|
|
"name": "Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55087.yaml"
|
|
},
|
|
"CVE-2026-55224": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"cwe": "CWE-22",
|
|
"name": "MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55224.yaml"
|
|
},
|
|
"CVE-2026-55229": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.01514,
|
|
"epss_pct": 0.72698,
|
|
"name": "Gotenberg < 8.34.0 - Local File Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55229.yaml"
|
|
},
|
|
"CVE-2026-55450": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H",
|
|
"epss": 0.0119,
|
|
"epss_pct": 0.65747,
|
|
"name": "Langflow < 1.9.1 - Unauthenticated File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55450.yaml"
|
|
},
|
|
"CVE-2026-55592": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00284,
|
|
"epss_pct": 0.20522,
|
|
"name": "Dashy <= 4.3.6 - Reflected XSS via Workspace",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55592.yaml"
|
|
},
|
|
"CVE-2026-5615": {
|
|
"cvss": 4.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.00773,
|
|
"epss_pct": 0.53175,
|
|
"name": "VvvebJs <= 2.0.5 - Cross-Site Scripting",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5615.yaml"
|
|
},
|
|
"CVE-2026-56265": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-798",
|
|
"epss": 0.02639,
|
|
"epss_pct": 0.84491,
|
|
"name": "Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56265.yaml"
|
|
},
|
|
"CVE-2026-56270": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.02048,
|
|
"epss_pct": 0.79849,
|
|
"name": "Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56270.yaml"
|
|
},
|
|
"CVE-2026-56290": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.30375,
|
|
"epss_pct": 0.98096,
|
|
"name": "Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56290.yaml"
|
|
},
|
|
"CVE-2026-56291": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.14595,
|
|
"epss_pct": 0.96396,
|
|
"name": "Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56291.yaml"
|
|
},
|
|
"CVE-2026-56782": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.03559,
|
|
"epss_pct": 0.88501,
|
|
"name": "Gorse < 0.5.10 - Unauthenticated Database Dump",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56782.yaml"
|
|
},
|
|
"CVE-2026-5718": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.04175,
|
|
"epss_pct": 0.90187,
|
|
"name": "Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5718.yaml"
|
|
},
|
|
"CVE-2026-57219": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-522",
|
|
"epss": 0.01988,
|
|
"epss_pct": 0.79206,
|
|
"name": "RabbitMQ Management - OAuth 2 Client Secret Disclosure",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-57219.yaml"
|
|
},
|
|
"CVE-2026-57827": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-434",
|
|
"epss": 0.02328,
|
|
"epss_pct": 0.82312,
|
|
"name": "RSFiles! for Joomla - Arbitrary File Upload",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-57827.yaml"
|
|
},
|
|
"CVE-2026-58138": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.09143,
|
|
"epss_pct": 0.94945,
|
|
"name": "Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58138.yaml"
|
|
},
|
|
"CVE-2026-58455": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.0804,
|
|
"epss_pct": 0.94372,
|
|
"name": "Dockwatch <= 0.6.567 - OS Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58455.yaml"
|
|
},
|
|
"CVE-2026-58644": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.15873,
|
|
"epss_pct": 0.96643,
|
|
"name": "Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58644.yaml"
|
|
},
|
|
"CVE-2026-59774": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"name": "Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59774.yaml"
|
|
},
|
|
"CVE-2026-59801": {
|
|
"name": "9Router - Unauthenticated LLM Provider API Exposure",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59801.yaml"
|
|
},
|
|
"CVE-2026-60004": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.84554,
|
|
"epss_pct": 0.99685,
|
|
"name": "Gitea <= 1.27.0 - Pre-Auth Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml"
|
|
},
|
|
"CVE-2026-6118": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.02304,
|
|
"epss_pct": 0.82122,
|
|
"name": "AstrBot <= 4.22.1 - Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6118.yaml"
|
|
},
|
|
"CVE-2026-61511": {
|
|
"cwe": "CWE-94",
|
|
"epss": 0.70766,
|
|
"epss_pct": 0.9935,
|
|
"name": "vBulletin 6.x - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61511.yaml"
|
|
},
|
|
"CVE-2026-61808": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"name": "LightRAG <= 1.5.4 - Missing Authentication",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61808.yaml"
|
|
},
|
|
"CVE-2026-6203": {
|
|
"cvss": 6.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-601",
|
|
"epss": 0.00663,
|
|
"epss_pct": 0.49194,
|
|
"name": "User Registration & Membership WordPress plugin - Open Redirect",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6203.yaml"
|
|
},
|
|
"CVE-2026-63030": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.97271,
|
|
"epss_pct": 0.9989,
|
|
"name": "WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml"
|
|
},
|
|
"CVE-2026-63077": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-502",
|
|
"epss": 0.87709,
|
|
"epss_pct": 0.99747,
|
|
"name": "JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63077.yaml"
|
|
},
|
|
"CVE-2026-6433": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"epss": 0.01195,
|
|
"epss_pct": 0.65854,
|
|
"name": "FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6433.yaml"
|
|
},
|
|
"CVE-2026-64638": {
|
|
"cvss": 8.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-79",
|
|
"epss": 0.31204,
|
|
"epss_pct": 0.9814,
|
|
"name": "WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml"
|
|
},
|
|
"CVE-2026-64849": {
|
|
"cvss": 9.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.1641,
|
|
"epss_pct": 0.96749,
|
|
"name": "MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64849.yaml"
|
|
},
|
|
"CVE-2026-65442": {
|
|
"cvss": 7.2,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00419,
|
|
"epss_pct": 0.34928,
|
|
"name": "FormCraft3 <= 3.9.15 - Server-Side Request Forgery",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65442.yaml"
|
|
},
|
|
"CVE-2026-65694": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.03394,
|
|
"epss_pct": 0.8797,
|
|
"name": "Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65694.yaml"
|
|
},
|
|
"CVE-2026-65761": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.00928,
|
|
"epss_pct": 0.58037,
|
|
"name": "Joomla Easy Store - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65761.yaml"
|
|
},
|
|
"CVE-2026-65919": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01918,
|
|
"epss_pct": 0.78428,
|
|
"name": "Meshery <1.0.57 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-65919.yaml"
|
|
},
|
|
"CVE-2026-67208": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-306",
|
|
"epss": 0.05285,
|
|
"epss_pct": 0.91993,
|
|
"name": "Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-67208.yaml"
|
|
},
|
|
"CVE-2026-6826": {
|
|
"cvss": 6.9,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.01461,
|
|
"epss_pct": 0.71739,
|
|
"name": "Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6826.yaml"
|
|
},
|
|
"CVE-2026-6854": {
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01577,
|
|
"epss_pct": 0.73725,
|
|
"name": "My Calendar < 3.7.9 - Unauthenticated SQL Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6854.yaml"
|
|
},
|
|
"CVE-2026-6875": {
|
|
"cvss": 9.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.77584,
|
|
"epss_pct": 0.99526,
|
|
"name": "ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6875.yaml"
|
|
},
|
|
"CVE-2026-69084": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01104,
|
|
"epss_pct": 0.63441,
|
|
"name": "SiYuan - SQL Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69084.yaml"
|
|
},
|
|
"CVE-2026-69251": {
|
|
"cvss": 9.0,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.01058,
|
|
"epss_pct": 0.62111,
|
|
"name": "Flowise < 3.1.3 - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69251.yaml"
|
|
},
|
|
"CVE-2026-71209": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.02005,
|
|
"epss_pct": 0.79419,
|
|
"name": "Audiobookshelf - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71209.yaml"
|
|
},
|
|
"CVE-2026-71362": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"cwe": "CWE-863",
|
|
"epss": 0.25136,
|
|
"epss_pct": 0.97774,
|
|
"name": "Adobe Commerce/Magento - Customer Session Identity Switch",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml"
|
|
},
|
|
"CVE-2026-72898": {
|
|
"cvss": 10.0,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.82323,
|
|
"epss_pct": 0.99636,
|
|
"name": "Metabase - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72898.yaml"
|
|
},
|
|
"CVE-2026-73034": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01509,
|
|
"epss_pct": 0.7262,
|
|
"name": "DB-GPT <= 0.8.1 - Arbitrary File Write",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-73034.yaml"
|
|
},
|
|
"CVE-2026-73570": {
|
|
"cvss": 8.9,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
|
|
"cwe": "CWE-78",
|
|
"epss": 0.20528,
|
|
"epss_pct": 0.9733,
|
|
"name": "Zimbra Collaboration Suite < 10.1.20 - OS Command Injection",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-73570.yaml"
|
|
},
|
|
"CVE-2026-7467": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-269",
|
|
"epss": 0.01242,
|
|
"epss_pct": 0.67094,
|
|
"name": "Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-7467.yaml"
|
|
},
|
|
"CVE-2026-76904": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.01791,
|
|
"epss_pct": 0.76809,
|
|
"name": "GeoServer jsonArrayContains CQL Filter - SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-76904.yaml"
|
|
},
|
|
"CVE-2026-77806": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.04201,
|
|
"epss_pct": 0.90239,
|
|
"name": "SPIP < 4.4.22 - Unauthenticated RCE",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-77806.yaml"
|
|
},
|
|
"CVE-2026-7798": {
|
|
"cvss": 5.4,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
|
"cwe": "CWE-918",
|
|
"epss": 0.00695,
|
|
"epss_pct": 0.5048,
|
|
"name": "WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-7798.yaml"
|
|
},
|
|
"CVE-2026-8037": {
|
|
"name": "Progress ADC LoadMaster - Command Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml"
|
|
},
|
|
"CVE-2026-8054": {
|
|
"name": "dotCMS Core Publish Audit API - Unauthenticated SQL Injection",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8054.yaml"
|
|
},
|
|
"CVE-2026-8181": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-287",
|
|
"epss": 0.14608,
|
|
"epss_pct": 0.96397,
|
|
"name": "WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8181.yaml"
|
|
},
|
|
"CVE-2026-8236": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.00523,
|
|
"epss_pct": 0.42303,
|
|
"name": "Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8236.yaml"
|
|
},
|
|
"CVE-2026-8237": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.0064,
|
|
"epss_pct": 0.48179,
|
|
"name": "Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8237.yaml"
|
|
},
|
|
"CVE-2026-8383": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.07623,
|
|
"epss_pct": 0.94126,
|
|
"name": "LearnPress < 4.3.7 - Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8383.yaml"
|
|
},
|
|
"CVE-2026-8385": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-200",
|
|
"epss": 0.00801,
|
|
"epss_pct": 0.54075,
|
|
"name": "WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8385.yaml"
|
|
},
|
|
"CVE-2026-8386": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.007,
|
|
"epss_pct": 0.50658,
|
|
"name": "WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8386.yaml"
|
|
},
|
|
"CVE-2026-8679": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.01566,
|
|
"epss_pct": 0.73555,
|
|
"name": "WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8679.yaml"
|
|
},
|
|
"CVE-2026-8713": {
|
|
"cvss": 9.1,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02669,
|
|
"epss_pct": 0.84689,
|
|
"name": "Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8713.yaml"
|
|
},
|
|
"CVE-2026-8732": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-862",
|
|
"epss": 0.21511,
|
|
"epss_pct": 0.97439,
|
|
"name": "WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8732.yaml"
|
|
},
|
|
"CVE-2026-8839": {
|
|
"cvss": 5.3,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cwe": "CWE-639",
|
|
"epss": 0.01018,
|
|
"epss_pct": 0.60918,
|
|
"name": "WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR",
|
|
"severity": "medium",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8839.yaml"
|
|
},
|
|
"CVE-2026-8857": {
|
|
"cvss": 8.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.02098,
|
|
"epss_pct": 0.80376,
|
|
"name": "MediaWiki EasyTimeline - Code Injection RCE",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8857.yaml"
|
|
},
|
|
"CVE-2026-9082": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-89",
|
|
"epss": 0.87892,
|
|
"epss_pct": 0.99751,
|
|
"name": "Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9082.yaml"
|
|
},
|
|
"CVE-2026-9133": {
|
|
"cvss": 7.7,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
|
"cwe": "CWE-489",
|
|
"epss": 0.01039,
|
|
"epss_pct": 0.61565,
|
|
"name": "Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9133.yaml"
|
|
},
|
|
"CVE-2026-9198": {
|
|
"cvss": 9.8,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"cwe": "CWE-94",
|
|
"epss": 0.34734,
|
|
"epss_pct": 0.98307,
|
|
"name": "IBM Langflow - Remote Code Execution",
|
|
"severity": "critical",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9198.yaml"
|
|
},
|
|
"CVE-2026-9282": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02861,
|
|
"epss_pct": 0.85774,
|
|
"name": "W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9282.yaml"
|
|
},
|
|
"CVE-2026-9290": {
|
|
"cvss": 7.5,
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.02502,
|
|
"epss_pct": 0.83577,
|
|
"name": "WP User Manager \u2013 User Profile Builder & Membership - Local File Inclusion",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9290.yaml"
|
|
},
|
|
"CVE-2026-9506": {
|
|
"cvss": 8.7,
|
|
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
|
|
"cwe": "CWE-22",
|
|
"epss": 0.01238,
|
|
"epss_pct": 0.66983,
|
|
"name": "Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read",
|
|
"severity": "high",
|
|
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9506.yaml"
|
|
}
|
|
}
|