[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":54,"FormattedDate_YGZoki4KbemRpkMkk2LxWIughCHzKqWyXU32hDxuo":61,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":68,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":74,"$f17q7jdn7tll3p":81,"$f2r4b9phgo6bha":114,"finding-templates-{\"q\":\"\",\"page\":1}":116},[4,15,21,27,33,39,44],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":14,"text":41,"link":8,"external":9,"targets":42,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[43],"\u002F",{"title":45,"slug":46,"text":47,"link":48,"external":49,"targets":50,"cta":53,"variant":13,"campaign_id":46},"Office Hours #11 - Compliance cycle survey","office-hours-11","[Live Office Hours, Wed Sept 16] Continuous compliance evidence: from automated tools or tired humans?","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_FLMs2-vyQbCTB67guMJH-Q",true,[51,52],"\u002Finsights\u002Fcompliance-cycles-survey","\u002Finsights","Save your spot",["Island",55],{"key":56,"params":57,"result":59},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":58},"{}",{"head":60},{},["Island",62],{"key":63,"params":64,"result":66},"FormattedDate_YGZoki4KbemRpkMkk2LxWIughCHzKqWyXU32hDxuo",{"props":65},"{\"date\":1778569448,\"format\":\"MMMM dd, yyyy\"}",{"head":67},{},["Island",69],{"key":70,"params":71,"result":72},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":58},{"head":73},{},["Island",75],{"key":76,"params":77,"result":79},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":78},"{\"text-color\":\"gray\"}",{"head":80},{},{"count":82,"next":83,"previous":84,"results":85},17386,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",null,[86],{"id":87,"detectable_with":88,"vuln_details":95,"vuln_id":111,"name":112,"published":113,"updated":84},29701,{"tool":89,"engine":92},{"id":90,"name":91},1,"Network Scanner",{"id":93,"name":94},2,"Nuclei",{"id":87,"epss_score":96,"epss_percentile":97,"in_cisa_catalog":9,"codename":84,"public_description":98,"description":84,"severity":99,"risk_description":100,"public_recommendation":101,"recommendation":84,"references":102,"cvssv3":105,"cve":106,"date":108,"software_type":84,"vendor":109,"product":110,"ptt_exploit_capabilities":84,"category":84},0.00372,0.30492,"HSC MailInspector v5.3.3-7 contains a path traversal caused by improper control of user-supplied file paths in \u002Fvendor\u002Fphpunit\u002Fphpunit.php, letting remote attackers read arbitrary files, exploit requires crafted request.","high","The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","Update to the latest version.",[103,104],"https:\u002F\u002Fgithub.com\u002Fsql3t0\u002Fcve-disclosures\u002Fblob\u002Fmain\u002F01_-_CVE-2026-29962_LFI%2BPath_Traversal.md","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-29962",7.5,[107],"CVE-2026-29962","2026-05-18T00:00:00Z","hsclabs","mailinspector","NETSCAN-NUCLEI-CVE-CVE-2026-29962","HSC MailInspector - Local File Inclusion (CVE-2026-29962)","2026-09-11T00:00:00Z",{"count":115},195,{"count":82,"next":117,"previous":84,"results":118},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[119,143,159,181,202,210,229,251,273,296,321,342,364,384,403,423,446,468,489,509,531,547,568,589,610],{"id":120,"detectable_with":121,"vuln_details":124,"vuln_id":141,"name":142,"published":113,"updated":84},29702,{"tool":122,"engine":123},{"id":90,"name":91},{"id":93,"name":94},{"id":120,"codename":84,"description":84,"severity":125,"risk_description":126,"public_description":127,"public_recommendation":128,"recommendation":84,"references":129,"cvssv3":133,"epss_score":134,"epss_percentile":135,"cve":136,"in_cisa_catalog":9,"date":138,"software_type":84,"vendor":139,"product":140,"ptt_exploit_capabilities":84},"critical","Anonymous attackers can reset email and password of the lowest-id activated user, gaining full access including administrator privileges.","FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication.","Upgrade to version 1.8.224 or later.",[130,131,132],"https:\u002F\u002Fgithub.com\u002Ffreescout-help-desk\u002Ffreescout\u002Fsecurity\u002Fadvisories\u002FGHSA-jqj5-r72v-v29g","https:\u002F\u002Fgithub.com\u002Ffreescout-help-desk\u002Ffreescout\u002Fcommit\u002Fc4688c31","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53595",9.4,0.00616,0.47485,[137],"CVE-2026-53595","2026-07-20T00:00:00Z","freescout-help-desk","freescout","NETSCAN-NUCLEI-CVE-CVE-2026-53595","FreeScout \u003C 1.8.224 - Invite Hash Authorization Bypass",{"id":144,"detectable_with":145,"vuln_details":148,"vuln_id":157,"name":158,"published":113,"updated":84},29703,{"tool":146,"engine":147},{"id":90,"name":91},{"id":93,"name":94},{"id":144,"codename":84,"description":84,"severity":149,"risk_description":150,"public_description":151,"public_recommendation":152,"recommendation":84,"references":153,"cvssv3":84,"epss_score":84,"epss_percentile":84,"cve":84,"in_cisa_catalog":9,"date":84,"software_type":84,"vendor":155,"product":156,"ptt_exploit_capabilities":84},"medium","The risk exists that the data is unknowingly exposed to the internet, making it accessible to remote threat actors that can leverage it to attack the target, or the entire company, depending on the sensitivity of the data.","Detects if the logs\u002Fmetrics page of the Apache Livy server is exposed.","We suggest restricting access to the exposed resource.",[154],"https:\u002F\u002Fgithub.com\u002Fapache\u002Flivy","apache","livy","NETSCAN-NUCLEI-EXPOSURES-APACHE-LIVY-LOGS","Apache Livy - Logs Exposed",{"id":160,"detectable_with":161,"vuln_details":164,"vuln_id":179,"name":180,"published":113,"updated":84},29706,{"tool":162,"engine":163},{"id":90,"name":91},{"id":93,"name":94},{"id":160,"codename":84,"description":84,"severity":125,"risk_description":165,"public_description":166,"public_recommendation":167,"recommendation":84,"references":168,"cvssv3":172,"epss_score":173,"epss_percentile":174,"cve":175,"in_cisa_catalog":9,"date":177,"software_type":84,"vendor":178,"product":178,"ptt_exploit_capabilities":84},"Attackers can bypass authentication to access victim accounts and execute API functions, potentially compromising user data and system integrity.","Mantis Bug Tracker \u003C 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username.","Upgrade to version 2.28.1 or later; disabling the SOAP API reduces risk.",[169,170,171],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-30849","https:\u002F\u002Fgithub.com\u002Fmantisbt\u002Fmantisbt\u002Fsecurity\u002Fadvisories\u002FGHSA-phrq-pc6r-f6gh","https:\u002F\u002Fmantisbt.org\u002Fbugs\u002Fview.php?id=36902",9.3,0.00413,0.34704,[176],"CVE-2026-30849","2026-03-23T00:00:00Z","mantisbt","NETSCAN-NUCLEI-CVE-CVE-2026-30849","MantisBT \u003C 2.28.1 - SOAP API Authentication Bypass",{"id":182,"detectable_with":183,"vuln_details":186,"vuln_id":200,"name":201,"published":113,"updated":84},29705,{"tool":184,"engine":185},{"id":90,"name":91},{"id":93,"name":94},{"id":182,"codename":84,"description":84,"severity":125,"risk_description":187,"public_description":188,"public_recommendation":189,"recommendation":84,"references":190,"cvssv3":194,"epss_score":195,"epss_percentile":196,"cve":197,"in_cisa_catalog":9,"date":199,"software_type":84,"vendor":84,"product":84,"ptt_exploit_capabilities":84},"The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Phenixdigital phoenix_storybook >=0.5.0 \u003C1.1.0 contains a code injection caused by unsanitized attribute value interpolation in HEEx template generation, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires sending crafted WebSocket event data.","Upgrade to version 1.1.0 or later.",[191,192,193],"https:\u002F\u002Fgithub.com\u002Fplausible\u002Fanalytics\u002Fsecurity\u002Fadvisories","https:\u002F\u002Fgithub.com\u002Fplausible\u002Fanalytics","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-8467",9.8,0.00907,0.57804,[198],"CVE-2026-8467","2026-05-20T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-8467","Phoenix Storybook - Remote Code Execution",{"id":87,"detectable_with":203,"vuln_details":206,"vuln_id":111,"name":209,"published":113,"updated":84},{"tool":204,"engine":205},{"id":90,"name":91},{"id":93,"name":94},{"id":87,"codename":84,"description":84,"severity":99,"risk_description":100,"public_description":98,"public_recommendation":101,"recommendation":84,"references":207,"cvssv3":105,"epss_score":96,"epss_percentile":97,"cve":208,"in_cisa_catalog":9,"date":108,"software_type":84,"vendor":109,"product":110,"ptt_exploit_capabilities":84},[103,104],[107],"HSC MailInspector - Local File Inclusion",{"id":211,"detectable_with":212,"vuln_details":215,"vuln_id":227,"name":228,"published":113,"updated":84},29708,{"tool":213,"engine":214},{"id":90,"name":91},{"id":93,"name":94},{"id":211,"codename":84,"description":84,"severity":125,"risk_description":187,"public_description":216,"public_recommendation":217,"recommendation":84,"references":218,"cvssv3":194,"epss_score":221,"epss_percentile":222,"cve":223,"in_cisa_catalog":9,"date":225,"software_type":84,"vendor":226,"product":226,"ptt_exploit_capabilities":84},"GiveWP \u003C= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input","Update to the latest version beyond 4.16.7.1.",[219,220],"https:\u002F\u002Fpatchstack.com\u002Farticles\u002Funauthenticated-php-object-injection-to-remote-code-execution-on-givewp\u002F","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-82222",0.00418,0.35196,[224],"CVE-2026-82222","2026-08-28T00:00:00Z","givewp","NETSCAN-NUCLEI-CVE-CVE-2026-82222","GiveWP \u003C= 4.16.7.1 - Remote Code Execution",{"id":230,"detectable_with":231,"vuln_details":234,"vuln_id":249,"name":250,"published":113,"updated":84},29707,{"tool":232,"engine":233},{"id":90,"name":91},{"id":93,"name":94},{"id":230,"codename":84,"description":84,"severity":125,"risk_description":187,"public_description":235,"public_recommendation":236,"recommendation":84,"references":237,"cvssv3":194,"epss_score":242,"epss_percentile":243,"cve":244,"in_cisa_catalog":9,"date":246,"software_type":84,"vendor":247,"product":248,"ptt_exploit_capabilities":84},"Hermes WebUI \u003C 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials.","Update to version 0.51.788 or later.",[238,239,240,241],"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fhermes-webui-unauthenticated-rce-via-terminal-api","https:\u002F\u002Fgithub.com\u002Fnesquena\u002Fhermes-webui\u002Fcommit\u002Fd257e5f36cfa9328600c8bde6f0de09a6ad9b6f4","https:\u002F\u002Fgithub.com\u002Fnesquena\u002Fhermes-webui\u002Freleases\u002Ftag\u002Fv0.51.788","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-58123",0.01339,0.69588,[245],"CVE-2026-58123","2026-07-09T00:00:00Z","nesquena","hermes-webui","NETSCAN-NUCLEI-CVE-CVE-2026-58123","Hermes WebUI \u003C 0.51.788 - Remote Code Execution",{"id":252,"detectable_with":253,"vuln_details":256,"vuln_id":271,"name":272,"published":113,"updated":84},29710,{"tool":254,"engine":255},{"id":90,"name":91},{"id":93,"name":94},{"id":252,"codename":84,"description":84,"severity":149,"risk_description":257,"public_description":258,"public_recommendation":259,"recommendation":84,"references":260,"cvssv3":264,"epss_score":265,"epss_percentile":266,"cve":267,"in_cisa_catalog":9,"date":269,"software_type":84,"vendor":270,"product":270,"ptt_exploit_capabilities":84},"Attackers can execute malicious scripts in users' browsers, potentially stealing session cookies or performing actions on their behalf.","Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query.","Update to the version including commit 6732dde or later.",[261,262,263],"https:\u002F\u002Fgithub.com\u002Fbludit\u002Fbludit\u002Fcommit\u002F6732ddedda8b73ce0a017a1b6adf685100244e01","https:\u002F\u002Fgist.github.com\u002Fthepiyushkumarshukla\u002F36b213cdb3c7d603e23fd23605cd681e","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41456",6.1,0.01243,0.67444,[268],"CVE-2026-41456","2026-04-21T00:00:00Z","bludit","NETSCAN-NUCLEI-CVE-CVE-2026-41456","Bludit CMS \u003C= 3.20.0 - Cross-Site Scripting",{"id":274,"detectable_with":275,"vuln_details":278,"vuln_id":294,"name":295,"published":113,"updated":84},29709,{"tool":276,"engine":277},{"id":90,"name":91},{"id":93,"name":94},{"id":274,"codename":84,"description":84,"severity":125,"risk_description":187,"public_description":279,"public_recommendation":280,"recommendation":84,"references":281,"cvssv3":287,"epss_score":288,"epss_percentile":289,"cve":290,"in_cisa_catalog":9,"date":292,"software_type":84,"vendor":293,"product":293,"ptt_exploit_capabilities":84},"Paperclip \u003C 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target.","Update to version 2026.416.0 or later.",[282,283,284,285,286],"https:\u002F\u002Fgithub.com\u002Fpaperclipai\u002Fpaperclip\u002Fsecurity\u002Fadvisories\u002FGHSA-68qg-g8mg-6pr7","https:\u002F\u002Fattackerkb.com\u002Ftopics\u002F86rSV7hsXi\u002Fcve-2026-41679","https:\u002F\u002Fwww.rapid7.com\u002Fdb\u002Fmodules\u002Fexploit\u002Flinux\u002Fhttp\u002Fpaperclipai_unauth_rce_cve_2026_41679","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41679","https:\u002F\u002Fgithub.com\u002Fbartfroklage\u002Fcve-2026-41679",10,0.04673,0.91213,[291],"CVE-2026-41679","2026-04-23T00:00:00Z","paperclipai","NETSCAN-NUCLEI-CVE-CVE-2026-41679","Paperclip - Remote Code Execution",{"id":297,"detectable_with":298,"vuln_details":301,"vuln_id":319,"name":320,"published":113,"updated":84},29704,{"tool":299,"engine":300},{"id":90,"name":91},{"id":93,"name":94},{"id":297,"codename":84,"description":84,"severity":125,"risk_description":302,"public_description":303,"public_recommendation":304,"recommendation":84,"references":305,"cvssv3":287,"epss_score":312,"epss_percentile":313,"cve":314,"in_cisa_catalog":49,"date":316,"software_type":84,"vendor":317,"product":318,"ptt_exploit_capabilities":84},"Remote attackers can bypass authentication and multi-factor authentication to gain full technician access.","SimpleHelp \u003C= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured.","Update to a version later than 5.5.15 or the final 6.0 release.",[306,307,308,309,310,311],"https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fdisclosures\u002Fcve-2026-48558-simplehelp-authentication-bypass-iocs\u002F","https:\u002F\u002Fsimple-help.com\u002Fsecurity\u002Fsimplehelp-security-update-2026-05","https:\u002F\u002Fgithub.com\u002Frapid7\u002Fmetasploit-framework\u002Fblob\u002Fmaster\u002Fmodules\u002Fexploits\u002Fmulti\u002Fhttp\u002Fsimplehelp_oidc_auth_bypass_rce.rb","https:\u002F\u002Fgithub.com\u002FJ4ck3LSyN-Gen2\u002FCVE-2026-48558","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48558","https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558",0.30045,0.98098,[315],"CVE-2026-48558","2026-06-12T00:00:00Z","simple-help","simplehelp","NETSCAN-NUCLEI-CVE-CVE-2026-48558","SimpleHelp \u003C=5.5.15 - OIDC JWT Authentication Bypass",{"id":322,"detectable_with":323,"vuln_details":326,"vuln_id":339,"name":340,"published":341,"updated":84},29698,{"tool":324,"engine":325},{"id":90,"name":91},{"id":93,"name":94},{"id":322,"codename":84,"description":84,"severity":125,"risk_description":327,"public_description":328,"public_recommendation":329,"recommendation":84,"references":330,"cvssv3":332,"epss_score":333,"epss_percentile":334,"cve":335,"in_cisa_catalog":9,"date":337,"software_type":84,"vendor":338,"product":338,"ptt_exploit_capabilities":84},"Unauthenticated attackers can access protected API endpoints and execute remote code, leading to full system compromise.","LibreNMS \u003C= 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates.","Update to version 26.8.0 or later.",[331],"https:\u002F\u002Fgithub.com\u002Flibrenms\u002Flibrenms\u002Fsecurity\u002Fadvisories\u002FGHSA-cvq8-gqfq-3mvg",9.2,0.00563,0.4496,[336],"CVE-2026-86426","2026-09-07T00:00:00Z","librenms","NETSCAN-NUCLEI-CVE-CVE-2026-86426","LibreNMS \u003C= 26.7.0 - Unauthenticated API Access","2026-09-10T00:00:00Z",{"id":343,"detectable_with":344,"vuln_details":347,"vuln_id":362,"name":363,"published":341,"updated":84},29697,{"tool":345,"engine":346},{"id":90,"name":91},{"id":93,"name":94},{"id":343,"codename":84,"description":84,"severity":149,"risk_description":348,"public_description":349,"public_recommendation":350,"recommendation":84,"references":351,"cvssv3":354,"epss_score":355,"epss_percentile":356,"cve":357,"in_cisa_catalog":9,"date":359,"software_type":84,"vendor":360,"product":361,"ptt_exploit_capabilities":84},"Unauthenticated attackers can access sensitive student learning statistics of any registered user, leading to information disclosure.","MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication.","Update to version 3.7.46 or later.",[352,353],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-81199",5.3,0.00133,0.03191,[358],"CVE-2026-81199","2026-09-02T00:00:00Z","stylemix","masterstudy-lms","NETSCAN-NUCLEI-CVE-CVE-2026-81199","MasterStudy LMS \u003C 3.7.46 - Unauthenticated Student Statistics Disclosure",{"id":365,"detectable_with":366,"vuln_details":369,"vuln_id":382,"name":383,"published":341,"updated":84},29696,{"tool":367,"engine":368},{"id":90,"name":91},{"id":93,"name":94},{"id":365,"codename":84,"description":84,"severity":99,"risk_description":370,"public_description":371,"public_recommendation":372,"recommendation":84,"references":373,"cvssv3":105,"epss_score":377,"epss_percentile":378,"cve":379,"in_cisa_catalog":9,"date":381,"software_type":84,"vendor":84,"product":84,"ptt_exploit_capabilities":84},"Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.","VidShop – Shoppable Videos for WooCommerce plugin for WordPress \u003C= 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information.","Update to the latest version of VidShop – Shoppable Videos for WooCommerce plugin for WordPress.",[374,375,376],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvidshop-for-woocommerce\u002Ftrunk\u002Fincludes\u002Frest-api\u002Fv1\u002Fclass-videos-controller.php#L297","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvidshop-for-woocommerce\u002Ftrunk\u002Fincludes\u002Futils\u002Fclass-query-builder.php#L778","https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa61d8d2a-742f-45f1-9146-f733b80ef195?source=cve",0.00416,0.35,[380],"CVE-2026-0702","2026-01-28T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-0702","VidShop for WooCommerce \u003C= 1.1.4 - SQL Injection",{"id":385,"detectable_with":386,"vuln_details":389,"vuln_id":401,"name":402,"published":341,"updated":84},29699,{"tool":387,"engine":388},{"id":90,"name":91},{"id":93,"name":94},{"id":385,"codename":84,"description":84,"severity":149,"risk_description":390,"public_description":391,"public_recommendation":392,"recommendation":84,"references":393,"cvssv3":354,"epss_score":84,"epss_percentile":84,"cve":397,"in_cisa_catalog":9,"date":399,"software_type":84,"vendor":400,"product":400,"ptt_exploit_capabilities":84},"Unauthenticated attackers can enumerate panel administrators, API key prefixes,hosted domains, and scan metadata CyberPanel instances.","CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.","Upgrade CyberPanel to 2.4.6",[394,395,396],"https:\u002F\u002Fgithub.com\u002Fusmannasir\u002Fcyberpanel\u002Fsecurity\u002Fadvisories\u002FGHSA-qmwq-9cc8-x6h2","https:\u002F\u002Fgithub.com\u002Fusmannasir\u002Fcyberpanel\u002Fcommit\u002F20484fd","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87820",[398],"CVE-2026-87820","2026-09-09T00:00:00Z","cyberpanel","NETSCAN-NUCLEI-CVE-CVE-2026-87820","CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure",{"id":404,"detectable_with":405,"vuln_details":408,"vuln_id":421,"name":422,"published":341,"updated":84},29700,{"tool":406,"engine":407},{"id":90,"name":91},{"id":93,"name":94},{"id":404,"codename":84,"description":84,"severity":125,"risk_description":187,"public_description":409,"public_recommendation":410,"recommendation":84,"references":411,"cvssv3":194,"epss_score":414,"epss_percentile":415,"cve":416,"in_cisa_catalog":9,"date":418,"software_type":84,"vendor":419,"product":420,"ptt_exploit_capabilities":84},"yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (\u002Fpublic\u002Fstatic\u002Fadmin\u002Flib\u002Fwebuploader\u002F0.1.5\u002Fserver\u002Fpreview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges.","Delete or restrict access to the preview.php script or upgrade to a patched version.",[412,413],"https:\u002F\u002Fgithub.com\u002Fyuan1994\u002Ftpadmin","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-2113",0.00574,0.45494,[417],"CVE-2026-2113","2026-02-07T00:00:00Z","yuan1994","tpadmin","NETSCAN-NUCLEI-CVE-CVE-2026-2113","tpadmin \u003C= 1.3.12 - Remote Code Execution",{"id":424,"detectable_with":425,"vuln_details":428,"vuln_id":444,"name":445,"published":399,"updated":84},29692,{"tool":426,"engine":427},{"id":90,"name":91},{"id":93,"name":94},{"id":424,"codename":84,"description":84,"severity":99,"risk_description":100,"public_description":429,"public_recommendation":430,"recommendation":84,"references":431,"cvssv3":436,"epss_score":437,"epss_percentile":438,"cve":439,"in_cisa_catalog":9,"date":441,"software_type":84,"vendor":442,"product":443,"ptt_exploit_capabilities":84},"TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter.","Update to the latest version of Fluig or apply security patches addressing this issue.",[432,433,434,435],"https:\u002F\u002Fwww.exploit-db.com\u002Fexploits\u002F49622","https:\u002F\u002Fgithub.com\u002FLs4ss\u002FCVE-2020-29134","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-29134","https:\u002F\u002Fdetecti.com.br\u002Fblog\u002Fpost.html?slug=TOTVS-FLuig-Platform-CVE-2020-29134",8.6,0.15025,0.96508,[440],"CVE-2020-29134","2021-03-05T00:00:00Z","totvs","fluig","NETSCAN-NUCLEI-CVE-CVE-2020-29134","TOTVS Fluig \u003C= 1.7.0 - Arbitrary File Read",{"id":447,"detectable_with":448,"vuln_details":451,"vuln_id":466,"name":467,"published":399,"updated":84},29690,{"tool":449,"engine":450},{"id":90,"name":91},{"id":93,"name":94},{"id":447,"codename":84,"description":84,"severity":125,"risk_description":452,"public_description":453,"public_recommendation":454,"recommendation":84,"references":455,"cvssv3":194,"epss_score":459,"epss_percentile":460,"cve":461,"in_cisa_catalog":9,"date":463,"software_type":84,"vendor":464,"product":465,"ptt_exploit_capabilities":84},"Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.","A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4","Update to version 2026.3 HF3 or 2026.4.",[456,457,458],"https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed\u002F","https:\u002F\u002Fme.n-able.com\u002Fs\u002Fsecurity-advisory\u002FaArVy0000002LTNKA2\u002Fcve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis","https:\u002F\u002Fdocumentation.n-able.com\u002FN-central\u002FRelease_Notes\u002FGA\u002FContent\u002FN-central_2026.3_HF3_Release_Notes.htm",0.00676,0.50139,[462],"CVE-2026-86206","2026-09-05T00:00:00Z","n-able","n-central","NETSCAN-NUCLEI-CVE-CVE-2026-86206","N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing",{"id":469,"detectable_with":470,"vuln_details":473,"vuln_id":487,"name":488,"published":399,"updated":84},29693,{"tool":471,"engine":472},{"id":90,"name":91},{"id":93,"name":94},{"id":469,"codename":84,"description":84,"severity":125,"risk_description":474,"public_description":475,"public_recommendation":476,"recommendation":84,"references":477,"cvssv3":194,"epss_score":480,"epss_percentile":481,"cve":482,"in_cisa_catalog":9,"date":484,"software_type":84,"vendor":485,"product":486,"ptt_exploit_capabilities":84},"Unauthenticated attackers can obtain admin password-reset URLs, enabling full administrator account takeover.","TranslatePress WordPress plugin \u003C= 3.3.1 contains a sensitive information exposure caused by the 'trp_get_translations_regular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string saving enabled and admin profile locale set to a published secondary language.","Update to a version later than 3.3.1 or the latest available version",[478,479],"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Ftranslatepress-multilingual\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-19632",0.00787,0.53991,[483],"CVE-2026-19632","2026-08-26T00:00:00Z","cozmoslabs","translatepress-multilingual","NETSCAN-NUCLEI-CVE-CVE-2026-19632","TranslatePress \u003C= 3.3.1 - Unauthenticated Account Takeover",{"id":490,"detectable_with":491,"vuln_details":494,"vuln_id":507,"name":508,"published":399,"updated":84},29694,{"tool":492,"engine":493},{"id":90,"name":91},{"id":93,"name":94},{"id":490,"codename":84,"description":84,"severity":99,"risk_description":495,"public_description":496,"public_recommendation":497,"recommendation":84,"references":498,"cvssv3":436,"epss_score":500,"epss_percentile":501,"cve":502,"in_cisa_catalog":9,"date":504,"software_type":84,"vendor":505,"product":506,"ptt_exploit_capabilities":84},"An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.","Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.","Upgrade to Monsta FTP 2.14.5 or later.",[499],"https:\u002F\u002Fwww.vulncheck.com\u002Fblog\u002Fmonsta-ftp-ssrf-ipv6-blocklist-bypass",0.0186,0.77964,[503],"CVE-2026-60105","2026-07-08T00:00:00Z","monsta","monsta-ftp","NETSCAN-NUCLEI-CVE-CVE-2026-60105","Monsta FTP \u003C= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass",{"id":510,"detectable_with":511,"vuln_details":514,"vuln_id":529,"name":530,"published":399,"updated":84},29695,{"tool":512,"engine":513},{"id":90,"name":91},{"id":93,"name":94},{"id":510,"codename":84,"description":84,"severity":125,"risk_description":187,"public_description":515,"public_recommendation":516,"recommendation":84,"references":517,"cvssv3":287,"epss_score":522,"epss_percentile":523,"cve":524,"in_cisa_catalog":49,"date":526,"software_type":84,"vendor":527,"product":528,"ptt_exploit_capabilities":84},"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.","Apply SonicWall platform hotfix 12.4.3-03526 (12.4.x) or 12.5.0-02952 (12.5.x) immediately.",[518,519,520,521],"https:\u002F\u002Fpsirt.global.sonicwall.com\u002Fvuln-detail\u002FSNWLID-2026-0016","https:\u002F\u002Fwww.sonicwall.com\u002Fsupport\u002Fnotices\u002Fproduct-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016\u002FkA1VN000002AXmQ0AW","https:\u002F\u002Fsoftware.sonicwall.com\u002FPFORMSMAHOTFIX\u002FDocumentation\u002FTechNotepform-hotfix-12.5.0-02952.txt","https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild\u002F",0.07447,0.94081,[525],"CVE-2026-83548","2026-09-01T00:00:00Z","sonicwall","sma1000","NETSCAN-NUCLEI-CVE-CVE-2026-83548","SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB",{"id":532,"detectable_with":533,"vuln_details":536,"vuln_id":545,"name":546,"published":399,"updated":84},29691,{"tool":534,"engine":535},{"id":90,"name":91},{"id":93,"name":94},{"id":532,"codename":84,"description":84,"severity":125,"risk_description":537,"public_description":538,"public_recommendation":539,"recommendation":84,"references":540,"cvssv3":194,"epss_score":541,"epss_percentile":542,"cve":543,"in_cisa_catalog":9,"date":463,"software_type":84,"vendor":464,"product":465,"ptt_exploit_capabilities":84},"Attackers can bypass authentication, potentially gaining unauthorized access to internal APIs and sensitive data.","An authentication bypass in N-central \u003C 2026.3 HF 3 leads to authentication bypass in internal-only APIs.","Upgrade N-able N-central to version 2026.3.1.13 (2026.3 Hotfix 3) or later. Hosted N-central environments have already been patched by the vendor.",[456,457,458],0.00734,0.52282,[544],"CVE-2026-86207","NETSCAN-NUCLEI-CVE-CVE-2026-86207","N-able N-central - Authentication Bypass",{"id":548,"detectable_with":549,"vuln_details":552,"vuln_id":565,"name":566,"published":567,"updated":84},29689,{"tool":550,"engine":551},{"id":90,"name":91},{"id":93,"name":94},{"id":548,"codename":84,"description":84,"severity":99,"risk_description":553,"public_description":554,"public_recommendation":555,"recommendation":84,"references":556,"cvssv3":105,"epss_score":559,"epss_percentile":560,"cve":561,"in_cisa_catalog":9,"date":246,"software_type":84,"vendor":563,"product":564,"ptt_exploit_capabilities":84},"Attackers can access and leak unauthorized database information, compromising data confidentiality.","AcyMailing component for Joomla \u003C10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input.","Upgrade to version 10.11.1 or later.",[557,558],"https:\u002F\u002Fmysites.guru\u002Fblog\u002Facymailing-sql-injection-disclosure\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-56292",0.01381,0.70479,[562],"CVE-2026-56292","acyba","acymailing","NETSCAN-NUCLEI-CVE-CVE-2026-56292","AcyMailing \u003C 10.11.1 - Unauthenticated SQL Injection","2026-09-08T00:00:00Z",{"id":569,"detectable_with":570,"vuln_details":573,"vuln_id":587,"name":588,"published":337,"updated":84},29681,{"tool":571,"engine":572},{"id":90,"name":91},{"id":93,"name":94},{"id":569,"codename":84,"description":84,"severity":125,"risk_description":574,"public_description":575,"public_recommendation":576,"recommendation":84,"references":577,"cvssv3":194,"epss_score":580,"epss_percentile":581,"cve":582,"in_cisa_catalog":9,"date":584,"software_type":84,"vendor":585,"product":586,"ptt_exploit_capabilities":84},"Attackers can perform blind SQL injection to extract or manipulate database information remotely.","ClipBucket v5.5.2-#187 and below contain a blind SQL injection caused by unsanitized obj_id parameter in \u002Factions\u002Fajax.php used in user_exists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request.","Update to the latest version once a fix is available.",[578,579],"https:\u002F\u002Fgithub.com\u002FMacWarrior\u002Fclipbucket-v5\u002Fsecurity\u002Fadvisories\u002FGHSA-crpv-fmc4-j392","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21875",0.01527,0.73164,[583],"CVE-2026-21875","2026-01-08T00:00:00Z","macwarrior","clipbucket","NETSCAN-NUCLEI-CVE-CVE-2026-21875","ClipBucket v5 \u003C= 5.5.2 - Unauthenticated Blind SQL Injection",{"id":590,"detectable_with":591,"vuln_details":594,"vuln_id":608,"name":609,"published":337,"updated":84},29686,{"tool":592,"engine":593},{"id":90,"name":91},{"id":93,"name":94},{"id":590,"codename":84,"description":84,"severity":125,"risk_description":595,"public_description":596,"public_recommendation":597,"recommendation":84,"references":598,"cvssv3":194,"epss_score":601,"epss_percentile":602,"cve":603,"in_cisa_catalog":9,"date":605,"software_type":84,"vendor":606,"product":607,"ptt_exploit_capabilities":84},"Unauthenticated attackers can gain full administrative access, compromising all CRM data and control.","Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.","Update to the latest version that patches this vulnerability.",[599,600],"https:\u002F\u002Fgithub.com\u002Fkrayin\u002Flaravel-crm\u002Freleases","https:\u002F\u002Fgithub.com\u002Fkrayin\u002Flaravel-crm\u002Fcompare\u002Fv2.2.0...v2.2.1",0.02454,0.83436,[604],"CVE-2026-41452","2026-08-03T00:00:00Z","webkul","krayin-laravel-crm","NETSCAN-NUCLEI-CVE-CVE-2026-41452","Krayin CRM \u003C 2.2.1 - Installer Authentication Bypass",{"id":611,"detectable_with":612,"vuln_details":615,"vuln_id":631,"name":632,"published":337,"updated":84},29687,{"tool":613,"engine":614},{"id":90,"name":91},{"id":93,"name":94},{"id":611,"codename":84,"description":84,"severity":99,"risk_description":616,"public_description":617,"public_recommendation":618,"recommendation":84,"references":619,"cvssv3":623,"epss_score":624,"epss_percentile":625,"cve":626,"in_cisa_catalog":9,"date":628,"software_type":84,"vendor":629,"product":630,"ptt_exploit_capabilities":84},"Remote attackers can permanently take over the initial administrator account, leading to full control of the instance.","Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to \u002Fapi\u002Finstall during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator.","Upgrade to version 2.3.8 or later.",[620,621,622],"https:\u002F\u002Fgithub.com\u002F0xJacky\u002Fnginx-ui\u002Fsecurity\u002Fadvisories\u002FGHSA-h27v-ph7w-m9fp","https:\u002F\u002Fgithub.com\u002F0xJacky\u002Fnginx-ui\u002Freleases\u002Ftag\u002Fv2.3.8","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42221",8.1,0.01165,0.65421,[627],"CVE-2026-42221","2026-05-04T00:00:00Z","0xjacky","nginx-ui","NETSCAN-NUCLEI-CVE-CVE-2026-42221","Nginx UI \u003C= 2.3.7 - Unauthenticated Installer Exposure"]