2,896 results · Clear filters · Feed
-
Critical 9.3
Expedition: Missing Authentication Leads to Admin Account Takeover
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichm…
KEV Nov 7, 2024 -
Critical 9.8
Jelly Template Injection Vulnerability in ServiceNow UI Macros
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servi…
KEV Jul 29, 2024 -
Critical 9.1CVE-2024-37770 Public exploit
14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. Thi…
-
Critical 9.8
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
-
Critical 9.0
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…
-
Critical 10.0
unauthorized file access
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized
-
Critical 10.0
remote code execution
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely
-
Critical 9.9CVE-2024-39930 Public exploit
Gogs has an argument Injection in the built-in SSH server
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the …
-
Critical 9.9
rejetto HFS vulnerable to OS Command Execution by remote authenticated users
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnS…
-
Critical 9.8CVE-2024-39844 Public exploit
In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
-
Critical 9.8
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to …
-
Critical 10.0
CoacoaPods trunk RCE in email verification system rfc-822
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX re…
-
Critical 9.8
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2…
-
Critical 9.1
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
KEV May 1, 2025 -
Critical 9.8
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted …
KEV Jul 15, 2024 -
Critical 9.9CVE-2024-37762 Public exploit
MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code executi…
-
Critical 9.8
BC Security Empire Path Traversal RCE
BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, a…
-
Critical 9.1CVE-2024-5535 Public exploit
SSL_select_next_proto buffer overread
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…
-
Critical 9.8
WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
KEV Mar 3, 2025 -
Critical 9.8
WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.
-
Critical 9.8
SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL i…
-
Critical 9.1
MOVEit Transfer Authentication Bypass Vulnerability
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
-
Critical 9.8
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
-
Critical 10.0CVE-2024-6297 Public exploit
Several WordPress.org Plugins <= Various Versions - Injected Backdoor
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to…
-
Critical 9.1
Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over t…
-
Critical 10.0CVE-2023-50029 Public exploit
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaS…
-
Critical 9.8CVE-2024-34313 Public exploit
An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a p…
-
Critical 9.8CVE-2024-37759 Public exploit
DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerab…
-
Critical 9.1
Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow rem…
-
Critical 9.8
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for p…
-
Critical 10.0
WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter…
-
Critical 9.8CVE-2024-34833 Public exploit
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_setti…
-
Critical 9.8CVE-2024-38396 Public exploit
An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in…
-
Critical 9.9CVE-2024-3105 Public exploit
Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the…
-
Critical 9.8CVE-2024-3912 Public exploit
ASUS Router - Upload arbitrary firmware
Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
-
Critical 9.8CVE-2024-27173 Public exploit
insecure upload
Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS s…
-
Critical 9.8
XXE can expose crypt key and other secrets granting full admin access
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability …
KEV Jul 17, 2024 -
Critical 9.8
Web Directory Free < 1.7.0 - Unauthenticated SQL Injection
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based…
-
Critical 10.0
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. T…
-
Critical 9.8CVE-2024-31777 Public exploit
File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted fi…