[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":44,"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk":51,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":58,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":64,"$f2r4b9phgo6bha":71,"$f17q7jdn7tll3p":73,"finding-templates-{\"q\":\"\",\"page\":1}":107},[4,15,21,27,33,39],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":14,"text":41,"link":8,"external":9,"targets":42,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[43],"\u002F",["Island",45],{"key":46,"params":47,"result":49},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":48},"{}",{"head":50},{},["Island",52],{"key":53,"params":54,"result":56},"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk",{"props":55},"{\"date\":1791358396,\"format\":\"MMMM dd, yyyy\"}",{"head":57},{},["Island",59],{"key":60,"params":61,"result":62},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":48},{"head":63},{},["Island",65],{"key":66,"params":67,"result":69},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":68},"{\"text-color\":\"gray\"}",{"head":70},{},{"count":72},210,{"count":74,"next":75,"previous":76,"results":77},17494,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",null,[78],{"id":79,"detectable_with":80,"vuln_details":87,"vuln_id":104,"name":105,"published":106,"updated":76},29811,{"tool":81,"engine":84},{"id":82,"name":83},1,"Network Scanner",{"id":85,"name":86},2,"Nuclei",{"id":79,"epss_score":88,"epss_percentile":89,"in_cisa_catalog":9,"codename":76,"public_description":90,"description":76,"severity":91,"risk_description":92,"public_recommendation":93,"recommendation":76,"references":94,"cvssv3":98,"cve":99,"date":101,"software_type":76,"vendor":102,"product":103,"ptt_exploit_capabilities":76,"category":76},0.00503,0.41329,"Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.","high","Unauthenticated attackers can read arbitrary files from the server, including application configuration and secrets, which can lead to further compromise.","Update to the vendor-provided fixed release.",[95,96,97],"https:\u002F\u002F1dayexploit.com\u002Fblog\u002Fcve-2026-6377-next4biz-csm-path-traversal\u002F","https:\u002F\u002Fgithub.com\u002F1dayexploit\u002Fadvisories\u002Ftree\u002Fmain\u002Fadvisories\u002Fcve-2026-6377-next4biz-csm-path-traversal","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6377",8.6,[100],"CVE-2026-6377","2026-09-07T00:00:00Z","next4biz","csm","NETSCAN-NUCLEI-CVE-CVE-2026-6377","Next4Biz CSM - Arbitrary File Read via DownloadFileHandler (CVE-2026-6377)","2026-10-14T00:00:00Z",{"count":74,"next":108,"previous":76,"results":109},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[110,131,154,172,180,205,230,251,270,292,311,327,349,370,389,410,432,453,474,493,515,542,562,585,606],{"id":111,"detectable_with":112,"vuln_details":115,"vuln_id":129,"name":130,"published":106,"updated":76},29812,{"tool":113,"engine":114},{"id":82,"name":83},{"id":85,"name":86},{"id":111,"codename":76,"description":76,"severity":91,"risk_description":116,"public_description":117,"public_recommendation":118,"recommendation":76,"references":119,"cvssv3":122,"epss_score":123,"epss_percentile":124,"cve":125,"in_cisa_catalog":9,"date":127,"software_type":76,"vendor":128,"product":128,"ptt_exploit_capabilities":76},"Unauthorized users can access post titles and excerpts, leading to information disclosure.","Discourse \u003C 2026.1.2\u002F2026.2.1\u002F2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges.","Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.",[120,121],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-824f-66wh-xx3g","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27934",8.7,0.00423,0.34807,[126],"CVE-2026-27934","2026-03-19T00:00:00Z","discourse","NETSCAN-NUCLEI-CVE-CVE-2026-27934","Discourse \u003C 2026.1.2\u002F2026.2.1\u002F2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure",{"id":132,"detectable_with":133,"vuln_details":136,"vuln_id":152,"name":153,"published":106,"updated":76},29817,{"tool":134,"engine":135},{"id":82,"name":83},{"id":85,"name":86},{"id":132,"codename":76,"description":76,"severity":137,"risk_description":138,"public_description":139,"public_recommendation":140,"recommendation":76,"references":141,"cvssv3":144,"epss_score":145,"epss_percentile":146,"cve":147,"in_cisa_catalog":9,"date":149,"software_type":76,"vendor":150,"product":151,"ptt_exploit_capabilities":76},"critical","Unauthenticated callers obtain an internal service identity on the API gateway, reaching privileged IAM, secrets, node inventory and ingest operations with no credential. On a confirmed deployment the forged identity was authorized on 136 API paths, including POST to \u002Fapis\u002Fiam\u002Fv2\u002Fpolicies, \u002Fapis\u002Fiam\u002Fv2\u002Ftokens and \u002Fapis\u002Fiam\u002Fv2\u002Fusers, so it converts directly into persistent administrative access.","Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.","Upgrade to Chef Automate 4.13.520 or later, which adds x509 chain verification to the header certificate path and strips the Grpc-Metadata prefixed headers at the load balancer. As an independent mitigation, blank Grpc-Metadata-Grpcgateway-X-Client-Cert, Grpc-Metadata-X-Client-Cert and X-Client-Cert at any proxy in front of Automate, repeating the directives in every location block that proxies to the gateway.",[142,143],"https:\u002F\u002Fcommunity.progress.com\u002Fs\u002Farticle\u002FCritical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80462",10,0.00483,0.39876,[148],"CVE-2026-80462","2026-09-11T00:00:00Z","progress","chef_automate","NETSCAN-NUCLEI-CVE-CVE-2026-80462","Chef Automate API Gateway - Authentication Bypass",{"id":155,"detectable_with":156,"vuln_details":159,"vuln_id":170,"name":171,"published":106,"updated":76},29815,{"tool":157,"engine":158},{"id":82,"name":83},{"id":85,"name":86},{"id":155,"codename":76,"description":76,"severity":91,"risk_description":160,"public_description":161,"public_recommendation":162,"recommendation":76,"references":163,"cvssv3":166,"epss_score":76,"epss_percentile":76,"cve":167,"in_cisa_catalog":9,"date":76,"software_type":76,"vendor":169,"product":169,"ptt_exploit_capabilities":76},"An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data through error messages.","SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.","Upgrade to SuiteCRM 7.15.2, 8.10.2, or a later release.",[164,165],"https:\u002F\u002Fgithub.com\u002FSuiteCRM\u002FSuiteCRM\u002Fsecurity\u002Fadvisories\u002FGHSA-72r3-24x4-j46c","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69137",7.7,[168],"CVE-2026-69137","suitecrm","NETSCAN-NUCLEI-CVE-CVE-2026-69137","SuiteCRM \u003C= 7.15.1, \u003C= 8.10.1 - Authenticated SSRF",{"id":79,"detectable_with":173,"vuln_details":176,"vuln_id":104,"name":179,"published":106,"updated":76},{"tool":174,"engine":175},{"id":82,"name":83},{"id":85,"name":86},{"id":79,"codename":76,"description":76,"severity":91,"risk_description":92,"public_description":90,"public_recommendation":93,"recommendation":76,"references":177,"cvssv3":98,"epss_score":88,"epss_percentile":89,"cve":178,"in_cisa_catalog":9,"date":101,"software_type":76,"vendor":102,"product":103,"ptt_exploit_capabilities":76},[95,96,97],[100],"Next4Biz CSM - Arbitrary File Read via DownloadFileHandler",{"id":181,"detectable_with":182,"vuln_details":185,"vuln_id":203,"name":204,"published":106,"updated":76},29813,{"tool":183,"engine":184},{"id":82,"name":83},{"id":85,"name":86},{"id":181,"codename":76,"description":76,"severity":137,"risk_description":186,"public_description":187,"public_recommendation":188,"recommendation":76,"references":189,"cvssv3":195,"epss_score":196,"epss_percentile":197,"cve":198,"in_cisa_catalog":9,"date":200,"software_type":76,"vendor":201,"product":202,"ptt_exploit_capabilities":76},"Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.","GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Patches are available in GeoTools 33.6 and 34.5. No known workaround is available, so the scope can only be limited by restricting which CQL functions are exposed.","Upgrade GeoTools to version 33.6 or 34.5, or a GeoServer release that bundles one of them.",[190,191,192,193,194],"https:\u002F\u002Fgist.github.com\u002Fportbuster1337\u002F70d75ec246b85e3199037ce212ff1a06","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76904","https:\u002F\u002Fgithub.com\u002Fgeotools\u002Fgeotools\u002Fcommit\u002Fd821c4d321dd91c22e31fcd5b1ce676645da5176","https:\u002F\u002Fgithub.com\u002Fgeotools\u002Fgeotools\u002Fpull\u002F5829","https:\u002F\u002Fgithub.com\u002Fgeotools\u002Fgeotools\u002Freleases\u002Ftag\u002F33.6",9.8,0.03976,0.90266,[199],"CVE-2026-76904","2026-08-21T00:00:00Z","osgeo","geoserver","NETSCAN-NUCLEI-CVE-CVE-2026-76904","GeoServer jsonArrayContains CQL Filter - SQL Injection",{"id":206,"detectable_with":207,"vuln_details":210,"vuln_id":228,"name":229,"published":106,"updated":76},29816,{"tool":208,"engine":209},{"id":82,"name":83},{"id":85,"name":86},{"id":206,"codename":76,"description":76,"severity":137,"risk_description":211,"public_description":212,"public_recommendation":213,"recommendation":76,"references":214,"cvssv3":195,"epss_score":220,"epss_percentile":221,"cve":222,"in_cisa_catalog":224,"date":225,"software_type":76,"vendor":226,"product":227,"ptt_exploit_capabilities":76},"The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.","Update to the latest version of Check Point Management Server.",[215,216,217,218,219],"https:\u002F\u002Fsupport.checkpoint.com\u002Fresults\u002Fsk\u002Fsk1000171","https:\u002F\u002Fblog.checkpoint.com\u002Fsecurity\u002Fsecurity-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616\u002F","https:\u002F\u002Fgithub.com\u002FBishopFox\u002FCVE-2026-93616-check","https:\u002F\u002Fgithub.com\u002FWadesWeaponShed\u002FCVE-2026-93616_Checks","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-93616",0.19654,0.97343,[223],"CVE-2026-93616",true,"2026-09-22T00:00:00Z","checkpoint","quantum_security_management","NETSCAN-NUCLEI-CVE-CVE-2026-93616","Check Point Security Management - Unauthenticated Directory Traversal to RCE",{"id":231,"detectable_with":232,"vuln_details":235,"vuln_id":249,"name":250,"published":106,"updated":76},29818,{"tool":233,"engine":234},{"id":82,"name":83},{"id":85,"name":86},{"id":231,"codename":76,"description":76,"severity":236,"risk_description":237,"public_description":238,"public_recommendation":239,"recommendation":76,"references":240,"cvssv3":243,"epss_score":244,"epss_percentile":245,"cve":246,"in_cisa_catalog":9,"date":248,"software_type":76,"vendor":128,"product":128,"ptt_exploit_capabilities":76},"medium","Unauthenticated attackers can determine private group membership, potentially exposing sensitive user information.","Discourse \u003C 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.","Update to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later; alternatively, disable public access to user directory.",[241,242],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-r6rh-xvf5-r5f2","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33425",5.3,0.00346,0.26262,[247],"CVE-2026-33425","2026-03-21T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-33425","Discourse - Private Group Membership Inference via exclude_groups",{"id":252,"detectable_with":253,"vuln_details":256,"vuln_id":268,"name":269,"published":106,"updated":76},29819,{"tool":254,"engine":255},{"id":82,"name":83},{"id":85,"name":86},{"id":252,"codename":76,"description":76,"severity":137,"risk_description":257,"public_description":258,"public_recommendation":259,"recommendation":76,"references":260,"cvssv3":144,"epss_score":76,"epss_percentile":76,"cve":263,"in_cisa_catalog":224,"date":265,"software_type":76,"vendor":266,"product":267,"ptt_exploit_capabilities":76},"An unauthenticated attacker can bypass authentication and access protected CGI endpoints on the Ivanti Connect Secure appliance, leading to remote code execution with root privileges when chained with additional vulnerabilities.","Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.","Upgrade Ivanti Connect Secure to the patched version released on October 13, 2026. Affected versions include 25.1.1 and prior, 25.1.2, and 22.8R2.4.",[261,262],"https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2026\u002F10\u002F13\u002Fa-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days\u002F","https:\u002F\u002Fforums.ivanti.com",[264],"CVE-2026-104935","2026-10-13T00:00:00Z","ivanti","connect_secure","NETSCAN-NUCLEI-CVE-CVE-2026-104935","Ivanti Connect Secure \u003C= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",{"id":271,"detectable_with":272,"vuln_details":275,"vuln_id":290,"name":291,"published":106,"updated":76},29814,{"tool":273,"engine":274},{"id":82,"name":83},{"id":85,"name":86},{"id":271,"codename":76,"description":76,"severity":91,"risk_description":276,"public_description":277,"public_recommendation":278,"recommendation":76,"references":279,"cvssv3":282,"epss_score":283,"epss_percentile":284,"cve":285,"in_cisa_catalog":9,"date":287,"software_type":76,"vendor":288,"product":289,"ptt_exploit_capabilities":76},"Successful exploitation requires logged-in users to click a malicious link, but allows unauthenticated attackers to execute arbitrary scripts or change web page contents on authenticated user sessions.","The weMail plugin for WordPress \u003C 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response.","Upgrade to weMail version 2.1.3 or later.",[280,281],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Ff00c1853-a4b2-4e91-99b3-fed8acbe6da7\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwemail\u002F",7.1,0.00282,0.19151,[286],"CVE-2026-8089","2026-06-17T00:00:00Z","weDevs","weMail","NETSCAN-NUCLEI-CVE-CVE-2026-8089","WordPress weMail \u003C 2.1.3 - Cross-Site Scripting",{"id":293,"detectable_with":294,"vuln_details":297,"vuln_id":309,"name":310,"published":265,"updated":76},29808,{"tool":295,"engine":296},{"id":82,"name":83},{"id":85,"name":86},{"id":293,"codename":76,"description":76,"severity":236,"risk_description":298,"public_description":299,"public_recommendation":300,"recommendation":76,"references":301,"cvssv3":243,"epss_score":304,"epss_percentile":305,"cve":306,"in_cisa_catalog":9,"date":308,"software_type":76,"vendor":76,"product":76,"ptt_exploit_capabilities":76},"Attackers can enumerate valid user accounts, potentially aiding targeted attacks or privilege escalation.","MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.","Update to stable release v6.49.18 or later.",[302,303],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-54772","https:\u002F\u002Fgithub.com\u002Fdeauther890\u002FCVE-2024-54772",0.01288,0.69465,[307],"CVE-2024-54772","2025-02-11T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2024-54772","MikroTik WinBox \u003C= 6.49.17 - Username Enumeration",{"id":312,"detectable_with":313,"vuln_details":316,"vuln_id":325,"name":326,"published":265,"updated":76},29804,{"tool":314,"engine":315},{"id":82,"name":83},{"id":85,"name":86},{"id":312,"codename":76,"description":76,"severity":91,"risk_description":317,"public_description":318,"public_recommendation":319,"recommendation":76,"references":320,"cvssv3":76,"epss_score":76,"epss_percentile":76,"cve":76,"in_cisa_catalog":9,"date":76,"software_type":76,"vendor":323,"product":324,"ptt_exploit_capabilities":76},"The risk exist that a remote attacker could take advantage of the default credentials for taking over the default account. If an authenticated vulnerability is present on the machine, it could also be leveraged to exploit the target, compromising the underlying system.","MITRE Caldera was found using default credentials. When started with the insecure default configuration, both the v4 (classic) and v5 (Magma) consoles ship static operator accounts (red, blue and admin) that all authenticate with the password \"admin\". An attacker who logs in gains full control of the adversary-emulation server and can run operations that execute commands on every connected agent.","Change all default credentials immediately and configure unique, strong passwords for each operator account.",[321,322],"https:\u002F\u002Fgithub.com\u002Fmitre\u002Fcaldera","https:\u002F\u002Fcaldera.readthedocs.io\u002Fen\u002Flatest\u002FServer-Configuration.html","mitre","caldera","NETSCAN-NUCLEI-DEFAULT-LOGINS-CALDERA-DEFAULT-LOGIN","MITRE Caldera - Default Login",{"id":328,"detectable_with":329,"vuln_details":332,"vuln_id":347,"name":348,"published":265,"updated":76},29805,{"tool":330,"engine":331},{"id":82,"name":83},{"id":85,"name":86},{"id":328,"codename":76,"description":76,"severity":91,"risk_description":333,"public_description":334,"public_recommendation":335,"recommendation":76,"references":336,"cvssv3":282,"epss_score":340,"epss_percentile":341,"cve":342,"in_cisa_catalog":9,"date":344,"software_type":76,"vendor":345,"product":346,"ptt_exploit_capabilities":76},"Attackers can execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, potentially leading to session hijacking or privilege escalation.","The Tag Groups WordPress plugin \u003C 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.","Update the Tag Groups plugin to version 2.2.0 or later.",[337,338,339],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9833","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F75792c33-2d9d-46db-a98c-00ec40951099\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Ftag-groups\u002F",0.00524,0.42879,[343],"CVE-2026-9833","2026-07-20T00:00:00Z","publishpress","tag-groups","NETSCAN-NUCLEI-CVE-CVE-2026-9833","WordPress Tag Groups \u003C 2.2.0 - Reflected Cross-Site Scripting",{"id":350,"detectable_with":351,"vuln_details":354,"vuln_id":368,"name":369,"published":265,"updated":76},29809,{"tool":352,"engine":353},{"id":82,"name":83},{"id":85,"name":86},{"id":350,"codename":76,"description":76,"severity":137,"risk_description":355,"public_description":356,"public_recommendation":357,"recommendation":76,"references":358,"cvssv3":195,"epss_score":361,"epss_percentile":362,"cve":363,"in_cisa_catalog":9,"date":365,"software_type":76,"vendor":366,"product":367,"ptt_exploit_capabilities":76},"An unauthenticated attacker can read arbitrary files including the ECDSA signing key, enabling them to forge access JWTs and bypass authentication for any account.","LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '\u002F'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys\u002Fecdsa_id), which signs access JWTs and enables full authentication bypass for any account.","Upgrade GravitLauncher LaunchServer to a version newer than 5.7.11.",[359,360],"https:\u002F\u002Fgithub.com\u002FGravitLauncher\u002FLauncher\u002Fsecurity\u002Fadvisories\u002FGHSA-5g75-477j-2c2f","https:\u002F\u002Fgithub.com\u002FGravitLauncher\u002FLauncher\u002Fcommit\u002F1e0b3a3",0.02883,0.86521,[364],"CVE-2026-54617","2026-09-17T00:00:00Z","gravitlauncher","launchserver","NETSCAN-NUCLEI-CVE-CVE-2026-54617","GravitLauncher LaunchServer \u003C=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read",{"id":371,"detectable_with":372,"vuln_details":375,"vuln_id":387,"name":388,"published":265,"updated":76},29806,{"tool":373,"engine":374},{"id":82,"name":83},{"id":85,"name":86},{"id":371,"codename":76,"description":76,"severity":137,"risk_description":211,"public_description":376,"public_recommendation":377,"recommendation":76,"references":378,"cvssv3":195,"epss_score":380,"epss_percentile":381,"cve":382,"in_cisa_catalog":9,"date":384,"software_type":76,"vendor":385,"product":386,"ptt_exploit_capabilities":76},"When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.","Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.",[379],"https:\u002F\u002Fgithub.com\u002Fmaximhq\u002Fbifrost\u002Fpull\u002F6757",0.00621,0.48368,[383],"CVE-2026-90898","2026-09-14T00:00:00Z","maximhq","bifrost","NETSCAN-NUCLEI-CVE-CVE-2026-90898","Bifrost \u003C 2.1.0 - Unauthenticated MCP Stdio Command Execution",{"id":390,"detectable_with":391,"vuln_details":394,"vuln_id":408,"name":409,"published":265,"updated":76},29807,{"tool":392,"engine":393},{"id":82,"name":83},{"id":85,"name":86},{"id":390,"codename":76,"description":76,"severity":137,"risk_description":211,"public_description":395,"public_recommendation":396,"recommendation":76,"references":397,"cvssv3":195,"epss_score":401,"epss_percentile":402,"cve":403,"in_cisa_catalog":9,"date":405,"software_type":76,"vendor":406,"product":407,"ptt_exploit_capabilities":76},"Selenium Server (Grid) before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via \u002Fwd\u002Fhub\u002Fsession due to missing Origin validation and weak content-type enforcement.","Upgrade to Selenium Server 4.0.0-alpha-7 or later and restrict network exposure.",[398,399,400],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-28108","https:\u002F\u002Fwww.gabriel.urdhr.fr\u002F2022\u002F02\u002F07\u002Fselenium-standalone-server-csrf-dns-rebinding-rce\u002F","https:\u002F\u002Fgithub.com\u002FSeleniumHQ\u002Fselenium\u002Fblob\u002Ftrunk\u002Fjava\u002FCHANGELOG",0.11727,0.95994,[404],"CVE-2022-28108","2022-04-19T00:00:00Z","selenium","selenium_grid","NETSCAN-NUCLEI-CVE-CVE-2022-28108","Selenium Grid \u003C 4.0.0-alpha-7 - Remote Code Execution",{"id":411,"detectable_with":412,"vuln_details":415,"vuln_id":430,"name":431,"published":265,"updated":76},29810,{"tool":413,"engine":414},{"id":82,"name":83},{"id":85,"name":86},{"id":411,"codename":76,"description":76,"severity":91,"risk_description":416,"public_description":417,"public_recommendation":418,"recommendation":76,"references":419,"cvssv3":422,"epss_score":423,"epss_percentile":424,"cve":425,"in_cisa_catalog":9,"date":427,"software_type":76,"vendor":428,"product":429,"ptt_exploit_capabilities":76},"The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","The Divi Plus WordPress plugin through 2.4.0 exposes the \u002Fwp-json\u002Felicus\u002Fv1\u002Fdipl-modules\u002Fsvg-animator REST route with a permission callback that returns true unconditionally, and passes the svg_image parameter to file_get_contents() without any path restriction, so an unauthenticated attacker can read any file readable by the web server user.","Update Divi Plus to version 2.4.1 or later.",[420,421],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91136","https:\u002F\u002Fgithub.com\u002Ffl0ydsec\u002FCVE-2026-91136",7.5,0.01782,0.77709,[426],"CVE-2026-91136","2026-10-10T00:00:00Z","elicus","divi_plus","NETSCAN-NUCLEI-CVE-CVE-2026-91136","Divi Plus \u003C= 2.4.0 - Unauthenticated Arbitrary File Read",{"id":433,"detectable_with":434,"vuln_details":437,"vuln_id":450,"name":451,"published":452,"updated":76},29803,{"tool":435,"engine":436},{"id":82,"name":83},{"id":85,"name":86},{"id":433,"codename":76,"description":76,"severity":91,"risk_description":416,"public_description":438,"public_recommendation":439,"recommendation":76,"references":440,"cvssv3":422,"epss_score":443,"epss_percentile":444,"cve":445,"in_cisa_catalog":9,"date":447,"software_type":76,"vendor":448,"product":449,"ptt_exploit_capabilities":76},"Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.","Upgrade Eclipse Theia to the patched version.",[441,442],"https:\u002F\u002Fgithub.com\u002Feclipse-theia\u002Ftheia\u002Fsecurity\u002Fadvisories\u002FGHSA-qmm6-p8q4-2g48","https:\u002F\u002Fgitlab.eclipse.org\u002Fsecurity\u002Fcve-assignment\u002F-\u002Fwork_items\u002F133",0.01644,0.75823,[446],"CVE-2026-12609","2026-08-05T00:00:00Z","eclipse","theia","NETSCAN-NUCLEI-CVE-CVE-2026-12609","Eclipse Theia - Unauthenticated Path Traversal","2026-10-12T00:00:00Z",{"id":454,"detectable_with":455,"vuln_details":458,"vuln_id":472,"name":473,"published":452,"updated":76},29801,{"tool":456,"engine":457},{"id":82,"name":83},{"id":85,"name":86},{"id":454,"codename":76,"description":76,"severity":137,"risk_description":459,"public_description":460,"public_recommendation":461,"recommendation":76,"references":462,"cvssv3":76,"epss_score":466,"epss_percentile":467,"cve":468,"in_cisa_catalog":9,"date":470,"software_type":76,"vendor":471,"product":471,"ptt_exploit_capabilities":76},"An unauthenticated remote attacker can invoke privileged FOSSBilling system API methods and may access or modify administrator-managed data.","FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.","Upgrade FOSSBilling to 0.8.0 or later, or block external access to \u002Fapi\u002Fsystem\u002F*.",[463,464,465],"https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Fsecurity\u002Fadvisories\u002FGHSA-78x5-c8gw-8279","https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Freleases\u002Ftag\u002F0.8.0","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27604",0.01264,0.68962,[469],"CVE-2026-27604","2026-06-23T00:00:00Z","fossbilling","NETSCAN-NUCLEI-CVE-CVE-2026-27604","FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass",{"id":475,"detectable_with":476,"vuln_details":479,"vuln_id":491,"name":492,"published":452,"updated":76},29802,{"tool":477,"engine":478},{"id":82,"name":83},{"id":85,"name":86},{"id":475,"codename":76,"description":76,"severity":236,"risk_description":480,"public_description":481,"public_recommendation":482,"recommendation":76,"references":483,"cvssv3":485,"epss_score":486,"epss_percentile":487,"cve":488,"in_cisa_catalog":9,"date":490,"software_type":76,"vendor":128,"product":128,"ptt_exploit_capabilities":76},"An unauthenticated attacker can forge bounce-status webhook events to artificially inflate a user's bounce score, causing that user's legitimate emails to be disabled.","Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints (including \u002Fwebhooks\u002Fmailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost) without validating a token when none is configured, which is the default state, letting an unauthenticated attacker forge webhook payloads.","Upgrade Discourse to the patched version, which rejects any provider webhook request with HTTP 406 when no authentication token is configured for that provider.",[484],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-j67c-53j2-4hfw",6.5,0.01111,0.65081,[489],"CVE-2026-26077","2026-02-26T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-26077","Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery",{"id":494,"detectable_with":495,"vuln_details":498,"vuln_id":512,"name":513,"published":514,"updated":76},29800,{"tool":496,"engine":497},{"id":82,"name":83},{"id":85,"name":86},{"id":494,"codename":76,"description":76,"severity":137,"risk_description":211,"public_description":499,"public_recommendation":500,"recommendation":76,"references":501,"cvssv3":195,"epss_score":505,"epss_percentile":506,"cve":507,"in_cisa_catalog":9,"date":509,"software_type":76,"vendor":510,"product":511,"ptt_exploit_capabilities":76},"Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST \u002Fapi\u002Fv1\u002Fvalidate\u002Fcode endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax. Combined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET \u002Fapi\u002Fv1\u002Fauto_login with no credentials) and the custom_component exec() sink (POST \u002Fapi\u002Fv1\u002Fcustom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution. Fixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).","Upgrade to Langflow OSS 1.12.3 or later. As a temporary mitigation, set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials and restrict network access to the Langflow instance.",[502,503,504],"https:\u002F\u002Fwww.pruva.dev\u002Freproductions\u002FREPRO-2026-00381","https:\u002F\u002Fgithub.com\u002Flangflow-ai\u002Flangflow","https:\u002F\u002Fgithub.com\u002Flangflow-ai\u002Flangflow\u002Fcommit\u002F461506ac2f38f70a994b5140572b876448c11e4c",0.02662,0.85332,[508],"CVE-2026-93674","2026-10-07T00:00:00Z","langflow-ai","langflow","NETSCAN-NUCLEI-CVE-CVE-2026-93674","Langflow OSS \u003C=1.12.2 - Unauthenticated RCE via Import Code Execution","2026-10-11T00:00:00Z",{"id":516,"detectable_with":517,"vuln_details":520,"vuln_id":539,"name":540,"published":541,"updated":76},29799,{"tool":518,"engine":519},{"id":82,"name":83},{"id":85,"name":86},{"id":516,"codename":76,"description":76,"severity":91,"risk_description":211,"public_description":521,"public_recommendation":522,"recommendation":76,"references":523,"cvssv3":531,"epss_score":532,"epss_percentile":533,"cve":534,"in_cisa_catalog":224,"date":536,"software_type":76,"vendor":537,"product":538,"ptt_exploit_capabilities":76},"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 \u002F 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.",[524,525,526,527,528,529,530],"http:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F168146\u002FZimbra-Zip-Path-Traversal.html","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FSecurity_Center","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FZimbra_Releases\u002F9.0.0\u002FP24","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FZimbra_Releases\u002F8.8.15\u002FP31","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FZimbra_Security_Advisories","https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2022\u002F08\u002F10\u002Fmass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-27925",7.2,0.98676,0.99923,[535],"CVE-2022-27925","2022-04-21T00:00:00Z","synacor","zimbra_collaboration_suite","NETSCAN-NUCLEI-CVE-CVE-2022-27925","Zimbra Collaboration Suite 8.8.15\u002F9.0 - Zip Path Traversal","2026-10-08T00:00:00Z",{"id":543,"detectable_with":544,"vuln_details":547,"vuln_id":560,"name":561,"published":509,"updated":76},29797,{"tool":545,"engine":546},{"id":82,"name":83},{"id":85,"name":86},{"id":543,"codename":76,"description":76,"severity":137,"risk_description":416,"public_description":548,"public_recommendation":549,"recommendation":76,"references":550,"cvssv3":195,"epss_score":553,"epss_percentile":554,"cve":555,"in_cisa_catalog":9,"date":557,"software_type":76,"vendor":558,"product":559,"ptt_exploit_capabilities":76},"Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.","Update to the fixed versions: Jira 9.12.40\u002F10.3.26\u002F11.3.12, Confluence 9.2.26\u002F10.2.19, Bitbucket 9.4.26\u002F10.2.8\u002F10.5.1, Bamboo 10.2.24\u002F12.1.12, Crowd 6.3.7\u002F7.0.3\u002F7.1.7\u002F7.2.4, Crucible 4.9.15, Fisheye 4.9.15.",[551,552],"https:\u002F\u002Flabs.watchtowr.com\u002Fyou-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21589",0.02777,0.86018,[556],"CVE-2026-21589","2026-10-05T00:00:00Z","atlassian","jira,confluence,bitbucket","NETSCAN-NUCLEI-CVE-CVE-2026-21589","Atlassian Jira\u002FConfluence\u002FBitbucket - Pre-Auth Arbitrary File Read",{"id":563,"detectable_with":564,"vuln_details":567,"vuln_id":583,"name":584,"published":509,"updated":76},29798,{"tool":565,"engine":566},{"id":82,"name":83},{"id":85,"name":86},{"id":563,"codename":76,"description":76,"severity":91,"risk_description":568,"public_description":569,"public_recommendation":570,"recommendation":76,"references":571,"cvssv3":575,"epss_score":576,"epss_percentile":577,"cve":578,"in_cisa_catalog":9,"date":580,"software_type":76,"vendor":581,"product":582,"ptt_exploit_capabilities":76},"The risk exists that a remote attacker can relay the Exchange machine account to bypass authentication, access all mailboxes, and, when chained with a path-validation weakness, write an ASPX webshell to achieve SYSTEM-level remote code execution.","Microsoft Exchange Server on-premises (2016 CU23, 2019 CU14\u002FCU15, and Subscription Edition RTM) contains an authentication-bypass-by-capture-replay vulnerability in the HTTP.sys-hosted MRSProxy endpoint, which accepts Negotiate authentication without enforcing Extended Protection for Authentication channel bindings. An attacker can relay the Exchange machine account via NTLM to bypass authentication and elevate privileges, and when chained with a path-validation weakness, write an ASPX webshell to disk for pre-auth remote code execution as SYSTEM. Detection is version-based, comparing the OWA build number exposed in the \u002Fowa\u002Fauth\u002F\u003Cbuild>\u002F static resource path against Microsoft's August 2026 patched builds.","Install the August 2026 security update for your Exchange build (2016 CU23 >= 15.1.2507.72, 2019 CU14 >= 15.2.1544.44, 2019 CU15 >= 15.2.1748.49, SE RTM >= 15.2.2562.46) and enable Extended Protection for Authentication.",[572,573,574],"https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2026-62911","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-62911","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fexchange\u002Fnew-features\u002Fbuild-numbers-and-release-dates",8,0.00694,0.51679,[579],"CVE-2026-62911","2026-08-11T00:00:00Z","microsoft","exchange_server","NETSCAN-NUCLEI-CVE-CVE-2026-62911","Microsoft Exchange Server - Authentication Bypass",{"id":586,"detectable_with":587,"vuln_details":590,"vuln_id":603,"name":604,"published":605,"updated":76},29795,{"tool":588,"engine":589},{"id":82,"name":83},{"id":85,"name":86},{"id":586,"codename":76,"description":76,"severity":91,"risk_description":591,"public_description":592,"public_recommendation":593,"recommendation":76,"references":594,"cvssv3":597,"epss_score":598,"epss_percentile":599,"cve":600,"in_cisa_catalog":9,"date":602,"software_type":76,"vendor":385,"product":386,"ptt_exploit_capabilities":76},"An unauthenticated network caller can cause the gateway to make outbound HTTP requests. Dynamically linked builds that can load a compatible Go plugin may permit code execution.","When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code execution on statically linked builds.","Upgrade Bifrost to a release that requires genuine admin authentication for custom plugin paths, such as transports v2.1.0 or later, and enable dashboard authentication.",[595,596],"https:\u002F\u002Fgithub.com\u002Fmaximhq\u002Fbifrost\u002Fsecurity\u002Fadvisories\u002FGHSA-2qp8-4xgm-fw6g","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86242",8.1,0.03575,0.89132,[601],"CVE-2026-86242","2026-09-06T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-86242","Bifrost \u003C 1.6.3 - Unauthenticated Remote Plugin URL Fetch","2026-10-06T00:00:00Z",{"id":607,"detectable_with":608,"vuln_details":611,"vuln_id":625,"name":626,"published":605,"updated":76},29796,{"tool":609,"engine":610},{"id":82,"name":83},{"id":85,"name":86},{"id":607,"codename":76,"description":76,"severity":91,"risk_description":612,"public_description":613,"public_recommendation":614,"recommendation":76,"references":615,"cvssv3":597,"epss_score":618,"epss_percentile":619,"cve":620,"in_cisa_catalog":9,"date":622,"software_type":76,"vendor":623,"product":624,"ptt_exploit_capabilities":76},"Unauthenticated attackers can plant arbitrary files in the webroot, which can lead to remote code execution when the written file is reachable and interpreted by the server.","WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content\u002Fuploads\u002Fwpforms\u002Ftmp\u002F before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.","Update WPForms Pro to a version later than 1.10.1.1.",[616,617],"https:\u002F\u002Fgithub.com\u002FNxploited\u002FCVE-2026-10818","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10818",0.02482,0.84181,[621],"CVE-2026-10818","2026-07-25T00:00:00Z","awesome-motive","wpforms","NETSCAN-NUCLEI-CVE-CVE-2026-10818","WPForms Pro \u003C= 1.10.1.1 - Unauthenticated Arbitrary File Upload"]