[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":86,"FormattedDate_XoBkHpdldfMfZsFXE4cGCWeUmKdyjo7C1hKCiWzZG0":93,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":100,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":106,"$f17q7jdn7tll3p":113,"$f2r4b9phgo6bha":146,"finding-templates-{\"q\":\"\",\"page\":1}":148},[4,13,23,35,43,50,57,65,70,75,79],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",{"title":58,"slug":59,"text":60,"link":27,"external":9,"targets":61,"cta":34,"variant":63,"priority":64,"campaign_id":59},"Apache HTTP\u002F2 RCE - HP, Vuln DB, product page","apache-rce-detection","🚨 Detect CVE-2026-119618 (Apache HTTP\u002F2 RCE) on your servers with any paid plan",[29,30,33,62],"\u002Fvulnerabilities-exploits\u002Fapache-http-server-race-condition_30011","primary","main",{"title":66,"slug":59,"text":67,"link":27,"external":18,"targets":68,"cta":69,"variant":63,"priority":64,"campaign_id":59},"Apache RCE detection - Detection on the NS page","🚨 Now in every paid plan: detection for CVE-2026-119618 (Apache HTTP\u002F2 RCE)",[48],"Pick your plan",{"title":71,"slug":59,"text":72,"link":27,"external":9,"targets":73,"cta":34,"variant":63,"priority":64,"campaign_id":59},"Apache HTTP\u002F2 RCE - Port Scanner page","🚨 Found Apache on your web ports? Check it for CVE-2026-119618 with any paid plan",[74],"\u002Fnetwork-vulnerability-scanning\u002Fport-scanner-online-nmap",{"title":76,"slug":59,"text":77,"link":27,"external":18,"targets":78,"cta":34,"variant":63,"priority":64,"campaign_id":59},"Apache RCE detection - WS, free tools","🚨 Running your web app on Apache? Detect CVE-2026-119618 (HTTP\u002F2 RCE) with any paid plan",[55,56],{"title":80,"slug":59,"text":81,"link":27,"external":9,"targets":82,"cta":85,"variant":63,"priority":64,"campaign_id":59},"Apache HTTP\u002F2 RCE - URL fuzzer, Subdomain Finder","🚨 PHP2Shell, Node2Shell, *sshole & CVE-2026-119618 (Apache) detection in every paid plan, with unlimited rescans for patch validation",[83,84],"\u002Fwebsite-vulnerability-scanning\u002Fdiscover-hidden-directories-and-files","\u002Finformation-gathering\u002Ffind-subdomains-of-domain","Find out with any plan",["Island",87],{"key":88,"params":89,"result":91},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":90},"{}",{"head":92},{},["Island",94],{"key":95,"params":96,"result":98},"FormattedDate_XoBkHpdldfMfZsFXE4cGCWeUmKdyjo7C1hKCiWzZG0",{"props":97},"{\"date\":1794485181,\"format\":\"MMMM dd, yyyy\"}",{"head":99},{},["Island",101],{"key":102,"params":103,"result":104},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":90},{"head":105},{},["Island",107],{"key":108,"params":109,"result":111},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":110},"{\"text-color\":\"gray\"}",{"head":112},{},{"count":114,"next":115,"previous":8,"results":116},17644,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",[117],{"id":118,"detectable_with":119,"vuln_details":126,"vuln_id":143,"name":144,"published":145,"updated":8},30003,{"tool":120,"engine":123},{"id":121,"name":122},1,"Network Scanner",{"id":124,"name":125},2,"Nuclei",{"id":118,"epss_score":127,"epss_percentile":128,"in_cisa_catalog":9,"codename":8,"public_description":129,"description":8,"severity":130,"risk_description":131,"public_recommendation":132,"recommendation":8,"references":133,"cvssv3":137,"cve":138,"date":140,"software_type":8,"vendor":141,"product":142,"ptt_exploit_capabilities":8,"category":8},0.0035,0.28994,"Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal caused by improper '\u002F..\u002F' substring check in static file handler Munin::Master::HTML::handle_request, letting unauthenticated attackers read files outside the static directory.","medium","The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","Update to a version later than 2.999.18 or the latest available version.",[134,135,136],"https:\u002F\u002Fgithub.com\u002Fmunin-monitoring\u002Fmunin\u002Fcommit\u002Fe7b6f452cc","https:\u002F\u002Fgithub.com\u002Fmunin-monitoring\u002Fmunin\u002Fissues\u002F1710","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-125357",5.3,[139],"CVE-2026-125357","2026-11-10T00:00:00Z","munin","munin-httpd","NETSCAN-NUCLEI-CVE-CVE-2026-125357","Munin munin-httpd 2.99.1-2.999.18 - Unauthenticated Path Traversal (CVE-2026-125357)","2026-11-12T00:00:00Z",{"count":147},223,{"count":114,"next":149,"previous":8,"results":150},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[151,174,197,222,244,265,286,309,317,337,361,383,405,427,450,474,497,521,543,564,587,610,633,648,661],{"id":152,"detectable_with":153,"vuln_details":156,"vuln_id":172,"name":173,"published":145,"updated":8},30010,{"tool":154,"engine":155},{"id":121,"name":122},{"id":124,"name":125},{"id":152,"codename":8,"description":8,"severity":157,"risk_description":158,"public_description":159,"public_recommendation":160,"recommendation":8,"references":161,"cvssv3":165,"epss_score":166,"epss_percentile":167,"cve":168,"in_cisa_catalog":9,"date":170,"software_type":8,"vendor":171,"product":171,"ptt_exploit_capabilities":8},"critical","Remote attackers can leak sensitive memory contents including environment variables, API keys, and user data, leading to information disclosure.","Ollama \u003C 0.17.1 contains a heap out-of-bounds read caused by improper validation of tensor offset and size in GGUF model loader, letting remote attackers leak sensitive memory data via \u002Fapi\u002Fcreate and \u002Fapi\u002Fpush endpoints, exploit requires no authentication.","Update to version 0.17.1 or later.",[162,163,164],"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-x8qc-fggm-mpqg","https:\u002F\u002Fgithub.com\u002Follama\u002Follama\u002Fcommit\u002F88d57d0483cca907e0b23a968c83627a20b21047","https:\u002F\u002Fgithub.com\u002Fszybnev\u002FCVE-2026-7482",9.1,0.02241,0.83068,[169],"CVE-2026-7482","2026-05-04T00:00:00Z","ollama","NETSCAN-NUCLEI-CVE-CVE-2026-7482","Ollama \u003C 0.17.1 - Information Disclosure",{"id":175,"detectable_with":176,"vuln_details":179,"vuln_id":195,"name":196,"published":145,"updated":8},30008,{"tool":177,"engine":178},{"id":121,"name":122},{"id":124,"name":125},{"id":175,"codename":8,"description":8,"severity":157,"risk_description":180,"public_description":181,"public_recommendation":182,"recommendation":8,"references":183,"cvssv3":187,"epss_score":188,"epss_percentile":189,"cve":190,"in_cisa_catalog":9,"date":192,"software_type":8,"vendor":193,"product":194,"ptt_exploit_capabilities":8},"The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","MLflow Tracking Server is vulnerable to an unauthenticated path traversal in the model-version creation API. The server validates the `source` parameter and rejects relative\u002Flocal paths, but skips that validation entirely when the request carries the `mlflow.prompt.is_prompt` tag (the request is then treated as a prompt). An unauthenticated attacker can supply an arbitrary traversal path as the model version `source`, writing attacker-controlled files to arbitrary locations on the server filesystem and achieving remote code execution under the service account. The fix adds an opt-in MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX allowlist; with the default (unset) configuration the bypass remains exploitable even on 2.22.4.","Upgrade MLflow and set MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX to a strict allowlist that rejects local\u002Frelative source paths, and restrict network access to the Tracking Server to trusted users.",[184,185,186],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-11201","https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-931\u002F","https:\u002F\u002Fmallory.ai\u002Fvulnerabilities\u002FCVE-2025-11201",9.8,0.28203,0.98138,[191],"CVE-2025-11201","2025-10-29T00:00:00Z","lfprojects","mlflow","NETSCAN-NUCLEI-CVE-CVE-2025-11201","MLflow Tracking Server - Unauthenticated Model Source Path Traversal RCE",{"id":198,"detectable_with":199,"vuln_details":202,"vuln_id":220,"name":221,"published":145,"updated":8},30004,{"tool":200,"engine":201},{"id":121,"name":122},{"id":124,"name":125},{"id":198,"codename":8,"description":8,"severity":203,"risk_description":204,"public_description":205,"public_recommendation":206,"recommendation":8,"references":207,"cvssv3":212,"epss_score":213,"epss_percentile":214,"cve":215,"in_cisa_catalog":18,"date":217,"software_type":8,"vendor":218,"product":219,"ptt_exploit_capabilities":8},"high","An unauthenticated attacker can obtain an administrator token and access protected platform data and functions.","JFrog Artifactory Self-Hosted can disclose an anonymous token through the trailing-slash AWS token endpoint (CVE-2026-42018), and affected releases can use that token to issue an administrator-scoped token without enforcing its scope (CVE-2026-42016).","Upgrade to a JFrog Artifactory release that fixes both CVE-2026-42016 and CVE-2026-42018; consult the JFrog advisory for the applicable release branch.",[208,209,210,211],"https:\u002F\u002Fdocs.jfrog.com\u002Freleases\u002Fdocs\u002Fjfrog-security-advisories","https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fartifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","https:\u002F\u002Fdocs.jfrog.com\u002Fadministration\u002Freference\u002FcreateToken","https:\u002F\u002Fdocs.jfrog.com\u002Fadministration\u002Freference\u002FgetUserList",8.8,0.08643,0.95178,[216],"CVE-2026-42016","2026-07-27T00:00:00Z","jfrog","artifactory","NETSCAN-NUCLEI-CVE-CVE-2026-42016","JFrog Artifactory - Unauthenticated Admin Token Minting via Token Scope Bypass",{"id":223,"detectable_with":224,"vuln_details":227,"vuln_id":242,"name":243,"published":145,"updated":8},30006,{"tool":225,"engine":226},{"id":121,"name":122},{"id":124,"name":125},{"id":223,"codename":8,"description":8,"severity":157,"risk_description":228,"public_description":229,"public_recommendation":230,"recommendation":8,"references":231,"cvssv3":165,"epss_score":235,"epss_percentile":236,"cve":237,"in_cisa_catalog":9,"date":239,"software_type":8,"vendor":240,"product":241,"ptt_exploit_capabilities":8},"Unauthenticated attackers can create and modify schedulers, potentially compromising connected ICS\u002FSCADA environments.","FUXA 1.2.8 through 1.2.10 contains an authorization bypass caused by improper access control in scheduler management, letting unauthenticated remote attackers create and modify schedulers, exploit requires no authentication.","Upgrade to version 1.2.11 or later.",[232,233,234],"https:\u002F\u002Fgithub.com\u002Ffrangoteam\u002FFUXA\u002Fsecurity\u002Fadvisories\u002FGHSA-c869-jx4c-q5fc","https:\u002F\u002Fgithub.com\u002Ffrangoteam\u002FFUXA\u002Fcommit\u002F5782b35117a9bd14ffcb881f8dfb8c6680157d9b","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25939",0.12536,0.96284,[238],"CVE-2026-25939","2026-02-09T00:00:00Z","frangoteam","fuxa","NETSCAN-NUCLEI-CVE-CVE-2026-25939","FUXA - Authorization Bypass",{"id":245,"detectable_with":246,"vuln_details":249,"vuln_id":263,"name":264,"published":145,"updated":8},30005,{"tool":247,"engine":248},{"id":121,"name":122},{"id":124,"name":125},{"id":245,"codename":8,"description":8,"severity":130,"risk_description":250,"public_description":251,"public_recommendation":252,"recommendation":8,"references":253,"cvssv3":137,"epss_score":256,"epss_percentile":257,"cve":258,"in_cisa_catalog":9,"date":260,"software_type":8,"vendor":261,"product":262,"ptt_exploit_capabilities":8},"Attackers can identify valid users, aiding targeted attacks or account harvesting.","Stop User Enumeration 1.3.8 contains a user enumeration vulnerability via the REST API, letting attackers identify valid users, exploit requires sending specific API requests.","Update to the latest version that fixes the vulnerability or apply security patches.",[254,255],"https:\u002F\u002Fadvisories.dxw.com\u002Fadvisories\u002Fstop-user-enumeration-rest-api\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2017-1000226",0.01385,0.72567,[259],"CVE-2017-1000226","2017-11-17T00:00:00Z","fullworks","stop-user-enumeration","NETSCAN-NUCLEI-CVE-CVE-2017-1000226","Stop User Enumeration \u003C= 1.3.8 - REST API User Enumeration Bypass",{"id":266,"detectable_with":267,"vuln_details":270,"vuln_id":284,"name":285,"published":145,"updated":8},30011,{"tool":268,"engine":269},{"id":121,"name":122},{"id":124,"name":125},{"id":266,"codename":8,"description":8,"severity":157,"risk_description":271,"public_description":272,"public_recommendation":273,"recommendation":8,"references":274,"cvssv3":187,"epss_score":8,"epss_percentile":8,"cve":279,"in_cisa_catalog":9,"date":281,"software_type":8,"vendor":282,"product":283,"ptt_exploit_capabilities":8},"The risk exists that a remote unauthenticated attacker can corrupt heap memory and potentially execute arbitrary code on the server, leading to full server compromise, data theft, or pivoting into the internal network.","Apache HTTP Server 2.4.55 through 2.4.70, when the HTTP\u002F2 module (mod_http2) is enabled, contains a race condition (CWE-362) in the assign_headers() function in modules\u002Fhttp2\u002Fh2_request.c. Concurrent HTTP\u002F2 streams access and modify shared request state without proper synchronization, leading to heap corruption that can crash a worker or allow remote code execution under the web server user's privileges.","Upgrade Apache HTTP Server to 2.4.71 or later (or mod_h2 to 2.0.43). As a mitigation, disable mod_http2 and remove h2 and h2c from the Protocols directive.",[275,276,277,278],"https:\u002F\u002Fhttpd.apache.org\u002Fsecurity\u002Fvulnerabilities_24.html","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-119618","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-119618","https:\u002F\u002Fwww.thehackerwire.com\u002Fcritical-alert-cve-2026-119618-exposes-apache-http-2-servers-to-remote-code-execution\u002F",[280],"CVE-2026-119618","2026-11-11T00:00:00Z","apache","http_server","NETSCAN-NUCLEI-CVE-CVE-2026-119618","Apache HTTP Server - Race Condition",{"id":287,"detectable_with":288,"vuln_details":291,"vuln_id":307,"name":308,"published":145,"updated":8},30007,{"tool":289,"engine":290},{"id":121,"name":122},{"id":124,"name":125},{"id":287,"codename":8,"description":8,"severity":203,"risk_description":292,"public_description":293,"public_recommendation":294,"recommendation":8,"references":295,"cvssv3":212,"epss_score":300,"epss_percentile":301,"cve":302,"in_cisa_catalog":9,"date":304,"software_type":8,"vendor":305,"product":306,"ptt_exploit_capabilities":8},"An unauthenticated attacker can create arbitrary site-wide 301 redirects, silently sending visitors to attacker-controlled URLs.","The Simple 301 Redirects by BetterLinks plugin for WordPress before 2.0.4 registers its import_data() handler on admin_init with no capability check. In versions 2.0.0 - 2.0.2 the import block also has no nonce check, so an unauthenticated attacker can import an arbitrary set of 301 redirects by POSTing a JSON file to admin-post.php, pointing any path on the site to an attacker-controlled destination (phishing, malware distribution, SEO abuse). 2.0.3 added a nonce check (partial fix) and 2.0.4 added the capability check (full fix). This template proves impact by importing a redirect with no authentication and then confirming the source path now returns a 301 to the injected destination.","Update Simple 301 Redirects by BetterLinks to 2.0.4 or later, which adds a capability check before the import and export routines.",[296,297,298,299],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-24353","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fce8f9648-30fb-4fb9-894e-879dc0f26f98\u002F","https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fsimple-301-redirects-addon-bulk-uploader\u002Fvulnerability\u002F","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=\u002Fsimple-301-redirects\u002Ftags\u002F2.0.3&new_path=\u002Fsimple-301-redirects\u002Ftags\u002F2.0.4",0.01112,0.66399,[303],"CVE-2021-24353","2021-06-14T00:00:00Z","betterlinks","simple-301-redirects","NETSCAN-NUCLEI-CVE-CVE-2021-24353","Simple 301 Redirects by BetterLinks \u003C= 2.0.3 - Unauthenticated Arbitrary Redirect Import",{"id":118,"detectable_with":310,"vuln_details":313,"vuln_id":143,"name":316,"published":145,"updated":8},{"tool":311,"engine":312},{"id":121,"name":122},{"id":124,"name":125},{"id":118,"codename":8,"description":8,"severity":130,"risk_description":131,"public_description":129,"public_recommendation":132,"recommendation":8,"references":314,"cvssv3":137,"epss_score":127,"epss_percentile":128,"cve":315,"in_cisa_catalog":9,"date":140,"software_type":8,"vendor":141,"product":142,"ptt_exploit_capabilities":8},[134,135,136],[139],"Munin munin-httpd 2.99.1-2.999.18 - Unauthenticated Path Traversal",{"id":318,"detectable_with":319,"vuln_details":322,"vuln_id":335,"name":336,"published":145,"updated":8},30009,{"tool":320,"engine":321},{"id":121,"name":122},{"id":124,"name":125},{"id":318,"codename":8,"description":8,"severity":157,"risk_description":180,"public_description":323,"public_recommendation":324,"recommendation":8,"references":325,"cvssv3":187,"epss_score":329,"epss_percentile":330,"cve":331,"in_cisa_catalog":9,"date":333,"software_type":8,"vendor":8,"product":334,"ptt_exploit_capabilities":8},"WordPress Simple File List plugin before version 4.2.3 is vulnerable to unauthenticated remote code execution. The ee-upload-engine.php and ee-file-engine.php scripts register their WordPress nonce checks via add_action('plugins_loaded', ...) after including wp-load.php, making the security checks dead code since the hook has already fired. Combined with a deterministic upload token (md5('unique_salt' + timestamp)) and no file extension validation on the rename action, an attacker can upload a PHP payload disguised as a .png file and rename it to .php, achieving arbitrary code execution.","Update Simple File List to version 4.2.3 or later, which adds file extension validation to the rename action and fixes the token verification.",[326,327,328],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-36847","https:\u002F\u002Fwww.exploit-db.com\u002Fexploits\u002F48979","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F10249",0.43519,0.98756,[332],"CVE-2020-36847","2025-07-12T00:00:00Z","simple-file-list","NETSCAN-NUCLEI-CVE-CVE-2020-36847","WordPress Simple File List \u003C 4.2.3 - Unauthenticated Remote Code Execution",{"id":338,"detectable_with":339,"vuln_details":342,"vuln_id":359,"name":360,"published":281,"updated":8},29994,{"tool":340,"engine":341},{"id":121,"name":122},{"id":124,"name":125},{"id":338,"codename":8,"description":8,"severity":203,"risk_description":131,"public_description":343,"public_recommendation":344,"recommendation":8,"references":345,"cvssv3":352,"epss_score":353,"epss_percentile":354,"cve":355,"in_cisa_catalog":9,"date":357,"software_type":8,"vendor":358,"product":358,"ptt_exploit_capabilities":8},"EduSoho \u003C 22.4.7 contains a path traversal caused by crafted path traversal sequences in the fileNames[] parameter in classroom-course-statistics export functionality, letting remote unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication.","Update to version 22.4.7 or later.",[346,347,348,349,350,351],"https:\u002F\u002Fvulncheck.com\u002Fadvisories\u002Fedusoho-arbitrary-file-read-via-classroom-course-statistics","https:\u002F\u002Fgithub.com\u002Fgobysec\u002FGobyVuls\u002Fblob\u002Fmaster\u002FCNVD-2023-03903.md","https:\u002F\u002Fgithub.com\u002FzeroChen00\u002Fexp-poc","https:\u002F\u002Fwww.cnvd.org.cn\u002Fflaw\u002Fshow\u002FCNVD-2023-03903","https:\u002F\u002Fgithub.com\u002Fedusoho\u002Fedusoho\u002Freleases\u002Ftag\u002Fv22.4.7","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-7335",8.7,0.00756,0.55595,[356],"CVE-2023-7335","2026-01-22T00:00:00Z","edusoho","NETSCAN-NUCLEI-CVE-CVE-2023-7335","EduSoho \u003C 22.4.7 - Unauthenticated Arbitrary File Read",{"id":362,"detectable_with":363,"vuln_details":366,"vuln_id":381,"name":382,"published":281,"updated":8},29990,{"tool":364,"engine":365},{"id":121,"name":122},{"id":124,"name":125},{"id":362,"codename":8,"description":8,"severity":157,"risk_description":180,"public_description":367,"public_recommendation":368,"recommendation":8,"references":369,"cvssv3":187,"epss_score":374,"epss_percentile":375,"cve":376,"in_cisa_catalog":9,"date":378,"software_type":8,"vendor":379,"product":380,"ptt_exploit_capabilities":8},"The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file upload in all versions up to and including 2.2.1 due to missing file type validation in the temp_file_upload() function. The handler is registered on the wp_ajax_nopriv_ht_form_temp_file_upload action, so an unauthenticated attacker holding a form nonce (exposed on any page rendering the [ht_form] widget) can upload a PHP file to wp-content\u002Fuploads\u002Fht_form\u002Ftemp\u002F and execute it, achieving remote code execution.","Update HT Contact Form Widget to 2.2.2 or later, which validates the uploaded file extension with wp_check_filetype() and rejects disallowed types.",[370,371,372,373],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-7340","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-85f4-4cwm-5xmr","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F91f39d58-1379-4908-bdeb-9c9bce39fb2c\u002F","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=\u002Fht-contactform\u002Ftags\u002F2.2.1&new_path=\u002Fht-contactform\u002Ftags\u002F2.2.2",0.01751,0.78167,[377],"CVE-2025-7340","2025-07-15T00:00:00Z","hasthemes","ht-contactform","NETSCAN-NUCLEI-CVE-CVE-2025-7340","HT Contact Form Widget for Elementor \u003C= 2.2.1 - Unauthenticated Arbitrary File Upload",{"id":384,"detectable_with":385,"vuln_details":388,"vuln_id":403,"name":404,"published":281,"updated":8},29991,{"tool":386,"engine":387},{"id":121,"name":122},{"id":124,"name":125},{"id":384,"codename":8,"description":8,"severity":203,"risk_description":389,"public_description":390,"public_recommendation":391,"recommendation":8,"references":392,"cvssv3":396,"epss_score":397,"epss_percentile":398,"cve":399,"in_cisa_catalog":9,"date":401,"software_type":8,"vendor":402,"product":402,"ptt_exploit_capabilities":8},"Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft or database compromise.","The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.","Upgrade to version 1.1.3 or later.",[393,394,395],"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-92998","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92998","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fclick-n-chat\u002F",8.6,0.00359,0.30022,[400],"CVE-2026-92998","2026-10-21T00:00:00Z","click-n-chat","NETSCAN-NUCLEI-CVE-CVE-2026-92998","Click n Chat \u003C 1.1.3 - Unauthenticated SQL Injection",{"id":406,"detectable_with":407,"vuln_details":410,"vuln_id":425,"name":426,"published":281,"updated":8},29992,{"tool":408,"engine":409},{"id":121,"name":122},{"id":124,"name":125},{"id":406,"codename":8,"description":8,"severity":157,"risk_description":411,"public_description":412,"public_recommendation":413,"recommendation":8,"references":414,"cvssv3":187,"epss_score":418,"epss_percentile":419,"cve":420,"in_cisa_catalog":9,"date":422,"software_type":8,"vendor":423,"product":424,"ptt_exploit_capabilities":8},"An unauthenticated attacker can obtain administrative access to the WordPress site, leading to full site compromise.","Profile Builder and Profile Builder Pro WordPress plugins up to and including 3.11.8 compare the submitted registration email against existing users and pending signups without trimming whitespace. Because MySQL string equality ignores trailing spaces but PHP does not, and a leading space desyncs the two checks entirely, an unauthenticated attacker can register a pending signup bound to an existing user's email (e.g. the administrator) by submitting that email with a leading space. When the signup is later activated it collides with the existing account, granting the attacker administrative access without holding any account on the site. Exploitation requires the plugin's Email Confirmation feature to be enabled and a page containing the [wppb-register] shortcode.","Update Profile Builder \u002F Profile Builder Pro to 3.11.9 or later, which trims the email before the duplicate-account and pending-signup checks.",[415,416,417],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6695","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002FCVE-2024-6695","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=\u002Fprofile-builder\u002Ftags\u002F3.11.8&new_path=\u002Fprofile-builder\u002Ftags\u002F3.11.9",0.00796,0.56898,[421],"CVE-2024-6695","2024-07-31T00:00:00Z","cozmoslabs","profile-builder","NETSCAN-NUCLEI-CVE-CVE-2024-6695","Profile Builder \u003C= 3.11.8 - Unauthenticated Privilege Escalation",{"id":428,"detectable_with":429,"vuln_details":432,"vuln_id":448,"name":449,"published":281,"updated":8},29993,{"tool":430,"engine":431},{"id":121,"name":122},{"id":124,"name":125},{"id":428,"codename":8,"description":8,"severity":130,"risk_description":131,"public_description":433,"public_recommendation":434,"recommendation":8,"references":435,"cvssv3":440,"epss_score":441,"epss_percentile":442,"cve":443,"in_cisa_catalog":9,"date":445,"software_type":8,"vendor":446,"product":447,"ptt_exploit_capabilities":8},"WP e-Commerce Shop Styling plugin for WordPress versions 2.5 and below contains a directory traversal vulnerability in includes\u002Fdownload.php. The 'filename' parameter is passed directly to readfile() without sanitization, allowing authenticated users to read arbitrary files on the server. Any authenticated WordPress user (including subscriber-level) can exploit this to download sensitive files such as \u002Fetc\u002Fpasswd or wp-config.php. The endpoint requires WordPress authentication via wp-admin\u002Fadmin.php; unauthenticated requests are redirected to wp-login.php. This template authenticates to WordPress first, then exploits the traversal.","Upgrade to WP e-Commerce Shop Styling version 2.6 or later, which rejects filenames containing \"\u002F\" and requires the .pdf extension. Alternatively, remove the plugin if no longer needed.",[436,437,438,439],"https:\u002F\u002Fcve.mitre.org\u002Fcgi-bin\u002Fcvename.cgi?name=CVE-2015-5468","https:\u002F\u002Fwww.exploit-db.com\u002Fexploits\u002F37422","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F2f084e8a-c7d6-43c2-8834-7e4a6d501c8a","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-ecommerce-shop-styling\u002F",6.5,0.24093,0.97874,[444],"CVE-2015-5468","2017-05-23T00:00:00Z","haet","wp-ecommerce-shop-styling","NETSCAN-NUCLEI-CVE-CVE-2015-5468","WP e-Commerce Shop Styling \u003C= 2.5 - Authenticated Directory Traversal \u002F Arbitrary File Read",{"id":451,"detectable_with":452,"vuln_details":455,"vuln_id":472,"name":473,"published":281,"updated":8},29995,{"tool":453,"engine":454},{"id":121,"name":122},{"id":124,"name":125},{"id":451,"codename":8,"description":8,"severity":203,"risk_description":456,"public_description":457,"public_recommendation":458,"recommendation":8,"references":459,"cvssv3":464,"epss_score":465,"epss_percentile":466,"cve":467,"in_cisa_catalog":9,"date":469,"software_type":8,"vendor":470,"product":471,"ptt_exploit_capabilities":8},"Arbitrary JavaScript execution in the browser of every visitor to the site, enabling session theft, admin\naccount takeover, and site defacement.","The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","Update WP DSGVO Tools (GDPR) to 3.1.24 or later, which escapes the integration tracking code and restricts the integration save handlers.",[460,461,462,463],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-4358","https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fwordpress-plugins\u002Fshapepress-dsgvo","https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fshapepress-dsgvo\u002Fvulnerability\u002F","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=\u002Fshapepress-dsgvo\u002Ftags\u002F3.1.23&new_path=\u002Fshapepress-dsgvo\u002Ftags\u002F3.1.24",7.2,0.00779,0.56342,[468],"CVE-2021-4358","2023-06-07T00:00:00Z","shapepress","shapepress-dsgvo","NETSCAN-NUCLEI-CVE-CVE-2021-4358","WP DSGVO Tools (GDPR) \u003C= 3.1.22 - Unauthenticated Stored Cross-Site Scripting",{"id":475,"detectable_with":476,"vuln_details":479,"vuln_id":495,"name":496,"published":281,"updated":8},29996,{"tool":477,"engine":478},{"id":121,"name":122},{"id":124,"name":125},{"id":475,"codename":8,"description":8,"severity":157,"risk_description":180,"public_description":480,"public_recommendation":481,"recommendation":8,"references":482,"cvssv3":187,"epss_score":488,"epss_percentile":489,"cve":490,"in_cisa_catalog":9,"date":492,"software_type":8,"vendor":493,"product":494,"ptt_exploit_capabilities":8},"Redpanda Connect 4.39.0 through 4.110.0 exposes an unauthenticated streams management API by default; an attacker can register and trigger a stream containing a command processor.","Upgrade to 4.111.0 or later, where the streams management API is disabled by default; bind any enabled API to a trusted interface and require authentication.",[483,484,485,486,487],"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-123270","https:\u002F\u002Fdocs.redpanda.com\u002Fconnect\u002Fguides\u002Fstreams_mode\u002Fabout\u002F","https:\u002F\u002Fdocs.redpanda.com\u002Fconnect\u002Fcomponents\u002Fprocessors\u002Fcommand\u002F","https:\u002F\u002Fgithub.com\u002Fpagvac\u002Fredpanda-connect-unauth-rce","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-123270",0.00644,0.51362,[491],"CVE-2026-123270","2026-11-09T00:00:00Z","redpanda","redpanda-connect","NETSCAN-NUCLEI-CVE-CVE-2026-123270","Redpanda Connect Streams API - Unauthenticated Remote Code Execution",{"id":498,"detectable_with":499,"vuln_details":502,"vuln_id":519,"name":520,"published":281,"updated":8},30000,{"tool":500,"engine":501},{"id":121,"name":122},{"id":124,"name":125},{"id":498,"codename":8,"description":8,"severity":157,"risk_description":503,"public_description":504,"public_recommendation":505,"recommendation":8,"references":506,"cvssv3":187,"epss_score":512,"epss_percentile":513,"cve":514,"in_cisa_catalog":9,"date":516,"software_type":8,"vendor":517,"product":518,"ptt_exploit_capabilities":8},"Remote attackers can read and modify the database, including setting admin flags or overwriting password hashes, leading to full administrator access.","Craft CMS \u003C 4.18.9, \u003C 5.11.2 contain an unauthenticated SQL injection caused by unsanitized concatenation of the attribute parameter in the element search endpoint, letting remote attackers read and write the database to gain administrator access, exploit requires no authentication.","Upgrade to Craft CMS 4.18.9 or 5.11.2 or later.",[507,508,509,510,511],"https:\u002F\u002Fgithub.com\u002Fcraftcms\u002Fcms\u002Fsecurity\u002Fadvisories\u002FGHSA-qcvp-ggx3-97r6","https:\u002F\u002Fgithub.com\u002Fcraftcms\u002Fcms\u002Fcompare\u002F4.18.8...4.18.9","https:\u002F\u002Fgithub.com\u002Fdinosn\u002FCVE-2026-123488-CraftCMS-Lab","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fcraft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-123488",0.00476,0.41562,[515],"CVE-2026-123488","2026-11-06T00:00:00Z","craftcms","craft_cms","NETSCAN-NUCLEI-CVE-CVE-2026-123488","Craft CMS \u003C 4.18.9, \u003C 5.11.2 - Unauthenticated SQL Injection",{"id":522,"detectable_with":523,"vuln_details":526,"vuln_id":541,"name":542,"published":281,"updated":8},29999,{"tool":524,"engine":525},{"id":121,"name":122},{"id":124,"name":125},{"id":522,"codename":8,"description":8,"severity":203,"risk_description":527,"public_description":528,"public_recommendation":529,"recommendation":8,"references":530,"cvssv3":396,"epss_score":534,"epss_percentile":535,"cve":536,"in_cisa_catalog":9,"date":538,"software_type":8,"vendor":539,"product":540,"ptt_exploit_capabilities":8},"An unauthenticated attacker can read internal HTTP services and cloud metadata through the Postiz server.","Postiz before 2.21.3 exposes an unauthenticated GET \u002Fpublic\u002Fstream endpoint that fetches a user-supplied URL and returns its response; a weak mp4 suffix check allows requests to internal HTTP services.","Upgrade to Postiz 2.21.3 or later, which rejects unsafe URLs and requires public HTTPS destinations.",[531,532,533],"https:\u002F\u002Fgithub.com\u002Fgitroomhq\u002Fpostiz-app\u002Fsecurity\u002Fadvisories\u002FGHSA-mv6h-v3jg-g539","https:\u002F\u002Fgithub.com\u002Fgitroomhq\u002Fpostiz-app\u002Freleases\u002Ftag\u002Fv2.21.3","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34577",0.00482,0.42026,[537],"CVE-2026-34577","2026-04-02T00:00:00Z","gitroomhq","postiz","NETSCAN-NUCLEI-CVE-CVE-2026-34577","Postiz \u003C 2.21.3 - Unauthenticated Server-Side Request Forgery",{"id":544,"detectable_with":545,"vuln_details":548,"vuln_id":562,"name":563,"published":281,"updated":8},30001,{"tool":546,"engine":547},{"id":121,"name":122},{"id":124,"name":125},{"id":544,"codename":8,"description":8,"severity":130,"risk_description":549,"public_description":550,"public_recommendation":551,"recommendation":8,"references":552,"cvssv3":137,"epss_score":557,"epss_percentile":558,"cve":559,"in_cisa_catalog":9,"date":516,"software_type":8,"vendor":561,"product":561,"ptt_exploit_capabilities":8},"An unauthenticated attacker can enumerate server file and directory paths and make unthrottled guesses of application and database secrets.","FreeScout before 1.8.225 exposes the maintenance endpoint \u002Ftools.php without authentication; different responses to existing and non-existing PHP paths disclose filesystem path existence before credential validation.","Upgrade FreeScout to 1.8.225 or later and restrict access to the maintenance endpoint.",[553,554,555,556],"https:\u002F\u002Fgithub.com\u002Ffreescout-help-desk\u002Ffreescout\u002Fsecurity\u002Fadvisories\u002FGHSA-w2p9-3666-vw9j","https:\u002F\u002Fgithub.com\u002Ffreescout-help-desk\u002Ffreescout\u002Fcommit\u002F8bb0594e95eab6661b4372e94ac02f62a6c3cb28","https:\u002F\u002Fgithub.com\u002Ffreescout-help-desk\u002Ffreescout\u002Freleases\u002Ftag\u002F1.8.225","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-62850",0.00272,0.1978,[560],"CVE-2026-62850","freescout","NETSCAN-NUCLEI-CVE-CVE-2026-62850","FreeScout \u003C 1.8.225 - Unauthenticated Maintenance File Existence Oracle",{"id":565,"detectable_with":566,"vuln_details":569,"vuln_id":585,"name":586,"published":281,"updated":8},29997,{"tool":567,"engine":568},{"id":121,"name":122},{"id":124,"name":125},{"id":565,"codename":8,"description":8,"severity":203,"risk_description":570,"public_description":571,"public_recommendation":572,"recommendation":8,"references":573,"cvssv3":212,"epss_score":578,"epss_percentile":579,"cve":580,"in_cisa_catalog":9,"date":582,"software_type":8,"vendor":583,"product":584,"ptt_exploit_capabilities":8},"Cross-site request forgery allowing arbitrary file upload, which can lead to remote code execution on the server.","The Directorist plugin for WordPress before 7.0.6.2 does not verify a CSRF nonce on its front-end listing submission handler (the add_listing_action AJAX action, registered for unauthenticated users via wp_ajax_nopriv). An attacker can forge a listing submission - including file uploads - on behalf of a logged-in user, leading to arbitrary file upload and potential remote code execution. The fix adds directorist_verify_nonce() to atbdp_submit_listing(). This template detects the missing nonce check by sending a listing submission with no nonce: a vulnerable build processes it (failing later at field validation) while a patched build rejects it at the nonce gate.","Update Directorist to 7.0.6.2 or later, which verifies the directorist nonce before processing a listing submission.",[574,575,576,577],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-24981","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g47h-745c-4p4f","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F4c45df6d-b3f6-49e5-8b1f-edd32a12d71c\u002F","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=\u002Fdirectorist\u002Ftags\u002F7.0.6.1&new_path=\u002Fdirectorist\u002Ftags\u002F7.0.6.2",0.00837,0.58206,[581],"CVE-2021-24981","2021-12-21T00:00:00Z","wpwax","directorist","NETSCAN-NUCLEI-CVE-CVE-2021-24981","Directorist \u003C 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload",{"id":588,"detectable_with":589,"vuln_details":592,"vuln_id":608,"name":609,"published":281,"updated":8},29998,{"tool":590,"engine":591},{"id":121,"name":122},{"id":124,"name":125},{"id":588,"codename":8,"description":8,"severity":203,"risk_description":593,"public_description":594,"public_recommendation":595,"recommendation":8,"references":596,"cvssv3":600,"epss_score":601,"epss_percentile":602,"cve":603,"in_cisa_catalog":9,"date":605,"software_type":8,"vendor":606,"product":607,"ptt_exploit_capabilities":8},"Unauthenticated attackers can gain full administrative privileges and forge password-reset tokens, compromising system security.","Kener 3.0.0 before 4.1.10 falls back to the hardcoded JWT secret \"DUMMY_SECRET\" when the KENER_SECRET_KEY environment variable is unset or empty. An unauthenticated attacker can forge session cookies and password-reset tokens signed with that key. A forged password-reset token accepted by POST \u002Faccount\u002Fforgot\u002Fapi\u002Fpassword-reset produces a distinct response: the request passes token verification and fails only later at user lookup (\"User does not exist\"), whereas patched versions reject the token signature immediately with \"Invalid or expired token\".","Update to version 4.1.10 or later.",[597,598,599],"https:\u002F\u002Fgithub.com\u002Frajnandan1\u002Fkener\u002Fcommit\u002Fff636483544c926eab5b5e3e26b811c0f52bcaf8","https:\u002F\u002Fgithub.com\u002Frajnandan1\u002Fkener\u002Fissues\u002F871","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116747",8.1,0.00623,0.50327,[604],"CVE-2026-116747","2026-10-26T00:00:00Z","rajnandan1","kener","NETSCAN-NUCLEI-CVE-CVE-2026-116747","Kener - Authentication Bypass",{"id":611,"detectable_with":612,"vuln_details":615,"vuln_id":631,"name":632,"published":281,"updated":8},30002,{"tool":613,"engine":614},{"id":121,"name":122},{"id":124,"name":125},{"id":611,"codename":8,"description":8,"severity":130,"risk_description":616,"public_description":617,"public_recommendation":618,"recommendation":8,"references":619,"cvssv3":623,"epss_score":624,"epss_percentile":625,"cve":626,"in_cisa_catalog":9,"date":628,"software_type":8,"vendor":629,"product":630,"ptt_exploit_capabilities":8},"An Author can store JavaScript in an uploaded SVG that executes in a visitor's browser when the SVG is opened.","GutenKit Blocks Addon before 2.5.0 lets an authenticated Author upload an unsanitized SVG through the WordPress REST media endpoint; JavaScript in the SVG can execute when a user opens its URL.","Update GutenKit Blocks Addon to version 2.5.0 or later.",[620,621,622],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fd144679c-10ef-4a69-b0e9-fd9e18a2aafc","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fgutenkit-blocks-addon\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-19697",6.8,0.00431,0.37771,[627],"CVE-2026-19697","2026-08-20T00:00:00Z","wpmet","gutenkit-blocks-addon","NETSCAN-NUCLEI-CVE-CVE-2026-19697","GutenKit Blocks Addon \u003C 2.5.0 - Stored Cross-Site Scripting",{"id":634,"detectable_with":635,"vuln_details":638,"vuln_id":646,"name":647,"published":140,"updated":8},29988,{"tool":636,"engine":637},{"id":121,"name":122},{"id":124,"name":125},{"id":634,"codename":8,"description":8,"severity":130,"risk_description":639,"public_description":640,"public_recommendation":641,"recommendation":8,"references":642,"cvssv3":8,"epss_score":8,"epss_percentile":8,"cve":8,"in_cisa_catalog":9,"date":8,"software_type":8,"vendor":645,"product":645,"ptt_exploit_capabilities":8},"The risk exists that the data is unknowingly exposed to the internet, making it accessible to remote threat actors that can leverage it to attack the target, or the entire company, depending on the sensitivity of the data.","Meilisearch ships without a master key by default. Instances deployed without one expose the index API to any network-reachable client: an unauthenticated GET \u002Findexes returns the full index listing, and the same unauthenticated access allows searching the documents inside those indexes.","Set a master key via the MEILI_MASTER_KEY environment variable (or the --master-key flag) to enforce API-key authentication, and restrict network access to the Meilisearch instance.",[643,644],"https:\u002F\u002Fwww.meilisearch.com\u002Fdocs\u002Freference\u002Fapi\u002Foverview","https:\u002F\u002Fwww.meilisearch.com\u002Fdocs\u002Flearn\u002Fsecurity\u002Fmaster_key","meilisearch","NETSCAN-NUCLEI-EXPOSURES-MEILISEARCH-UNAUTH","Meilisearch - Unauthenticated Index Exposure",{"id":649,"detectable_with":650,"vuln_details":653,"vuln_id":659,"name":660,"published":140,"updated":8},29989,{"tool":651,"engine":652},{"id":121,"name":122},{"id":124,"name":125},{"id":649,"codename":8,"description":8,"severity":130,"risk_description":639,"public_description":654,"public_recommendation":655,"recommendation":8,"references":656,"cvssv3":8,"epss_score":8,"epss_percentile":8,"cve":8,"in_cisa_catalog":9,"date":8,"software_type":8,"vendor":658,"product":658,"ptt_exploit_capabilities":8},"Dashdot is a self-hosted server dashboard that ships with no authentication by design, and its backend serves an unauthenticated \u002Finfo endpoint returning static host information: operating system and kernel details, CPU brand and model, memory and storage layout, network interface details including the public IP, and the running Dashdot version. Any unauthenticated visitor to an internet-facing instance can read this host inventory without a credential.","Do not expose Dashdot on a public interface. Put it behind an authenticated reverse proxy, a VPN, or network-level access control, as the application itself provides no login mechanism.",[657],"https:\u002F\u002Fgithub.com\u002FMauriceNino\u002Fdashdot","dashdot","NETSCAN-NUCLEI-EXPOSURES-DASHDOT-INFO-EXPOSURE","Dashdot - Server Information Exposure",{"id":662,"detectable_with":663,"vuln_details":666,"vuln_id":682,"name":683,"published":492,"updated":8},29984,{"tool":664,"engine":665},{"id":121,"name":122},{"id":124,"name":125},{"id":662,"codename":8,"description":8,"severity":203,"risk_description":667,"public_description":668,"public_recommendation":669,"recommendation":8,"references":670,"cvssv3":674,"epss_score":675,"epss_percentile":676,"cve":677,"in_cisa_catalog":9,"date":679,"software_type":8,"vendor":680,"product":681,"ptt_exploit_capabilities":8},"Unauthenticated attackers can execute scripts in administrator browsers, potentially leading to session hijacking or full admin control.","SlimStat Analytics WordPress plugin \u003C 5.5.0 contains a stored XSS caused by unescaped visitor-controlled geolocation value in admin analytics reports, letting unauthenticated visitors execute scripts in admin browsers, exploit requires Cloudflare geolocation provider configuration.","Update to the latest version beyond 5.1.4.",[671,672,673],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F3658cae6-f6ae-4ecc-8d74-bb402e61f5d5","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-12592","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-slimstat\u002F",7.5,0.00968,0.62277,[678],"CVE-2026-12592","2026-07-20T00:00:00Z","wp-slimstat","slimstat-analytics","NETSCAN-NUCLEI-CVE-CVE-2026-12592","SlimStat Analytics \u003C 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header"]