[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":32,"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk":39,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":46,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":52,"$f2r4b9phgo6bha":59,"$f17q7jdn7tll3p":61,"finding-templates-{\"q\":\"\",\"page\":1}":95},[4,16],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":13,"variant":14,"campaign_id":15},"Office Hours #13 recording","office-hours-13-recording","[Office Hours recording] How to consolidate your security testing stack without the lock-in","https:\u002F\u002Fyoutu.be\u002FsHCpNHhQVec?list=PLLUQRPAOwP1i1eLSch35xjgyX4Pe3r-9q",true,[11,12],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Watch the recording","secondary","office-hours-13",{"title":17,"slug":18,"text":19,"link":20,"external":9,"targets":21,"cta":31,"variant":14,"campaign_id":18},"PHP2Shell detection - CVE-2026-109618 & CVE-2026-109619","php2shell-rce","🚨 Detection for PHP2Shell now live. Are you exposed?","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[22,23,24,25,26,27,28,29,30],"\u002F","\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Fvulnerabilities-exploits","\u002Fproduct","Find out with any plan",["Island",33],{"key":34,"params":35,"result":37},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":36},"{}",{"head":38},{},["Island",40],{"key":41,"params":42,"result":44},"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk",{"props":43},"{\"date\":1791358396,\"format\":\"MMMM dd, yyyy\"}",{"head":45},{},["Island",47],{"key":48,"params":49,"result":50},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":36},{"head":51},{},["Island",53],{"key":54,"params":55,"result":57},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":56},"{\"text-color\":\"gray\"}",{"head":58},{},{"count":60},210,{"count":62,"next":63,"previous":64,"results":65},17509,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",null,[66],{"id":67,"detectable_with":68,"vuln_details":75,"vuln_id":92,"name":93,"published":94,"updated":64},29860,{"tool":69,"engine":72},{"id":70,"name":71},1,"Network Scanner",{"id":73,"name":74},2,"Nuclei",{"id":67,"epss_score":76,"epss_percentile":77,"in_cisa_catalog":78,"codename":64,"public_description":79,"description":64,"severity":80,"risk_description":81,"public_recommendation":82,"recommendation":64,"references":83,"cvssv3":86,"cve":87,"date":89,"software_type":64,"vendor":90,"product":91,"ptt_exploit_capabilities":64,"category":64},0.00454,0.38144,false,"The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec\u002Fv1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.","critical","Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.","Upgrade to a version later than 6.16.2 or the latest available version.",[84,85],"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-49772","https:\u002F\u002Fgithub.com\u002Fjoshuavanderpoll\u002FCVE-2026-49772",9.3,[88],"CVE-2026-49772","2026-06-16T00:00:00Z","theeventscalendar","the_events_calendar","NETSCAN-NUCLEI-CVE-CVE-2026-49772","The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection (CVE-2026-49772)","2026-10-21T00:00:00Z",{"count":62,"next":96,"previous":64,"results":97},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[98,123,146,170,188,208,216,239,262,285,302,325,346,365,382,395,413,423,435,452,465,476,488,501,511],{"id":99,"detectable_with":100,"vuln_details":103,"vuln_id":121,"name":122,"published":94,"updated":64},29871,{"tool":101,"engine":102},{"id":70,"name":71},{"id":73,"name":74},{"id":99,"codename":64,"description":64,"severity":104,"risk_description":105,"public_description":106,"public_recommendation":107,"recommendation":64,"references":108,"cvssv3":113,"epss_score":114,"epss_percentile":115,"cve":116,"in_cisa_catalog":9,"date":118,"software_type":64,"vendor":119,"product":120,"ptt_exploit_capabilities":64},"high","Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.","Ahsay AhsayCBS \u003C= 10.3.2 contains an authentication bypass caused by manipulation of the \"random\" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.","Upgrade to version 10.3.4.",[109,110,111,112],"https:\u002F\u002Fwww.ahsay.com\u002Fen\u002Fcompany\u002Fannouncements","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fattack-blogs\u002Fahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis\u002F","https:\u002F\u002Fgithub.com\u002Fhorizon3ai\u002FAhsayCBS-Auth-Bypass-RCE","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-105133",7.3,0.00854,0.57658,[117],"CVE-2026-105133","2026-10-04T00:00:00Z","ahsay","ahsaycbs","NETSCAN-NUCLEI-CVE-CVE-2026-105133","AhsayCBS - JSON API Authentication Bypass",{"id":124,"detectable_with":125,"vuln_details":128,"vuln_id":144,"name":145,"published":94,"updated":64},29861,{"tool":126,"engine":127},{"id":70,"name":71},{"id":73,"name":74},{"id":124,"codename":64,"description":64,"severity":80,"risk_description":129,"public_description":130,"public_recommendation":131,"recommendation":64,"references":132,"cvssv3":136,"epss_score":137,"epss_percentile":138,"cve":139,"in_cisa_catalog":78,"date":141,"software_type":64,"vendor":142,"product":143,"ptt_exploit_capabilities":64},"The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","Theme-one The Grid \u003C= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.","Update to the latest version beyond 2.8.1.",[133,134,135],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fthe-grid\u002Fvulnerability\u002Fwordpress-the-grid-plugin-2-8-1-remote-code-execution-rce-vulnerability","https:\u002F\u002Fgithub.com\u002Fkize7\u002FCVE-2026-94169","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-94169",10,0.00985,0.61775,[140],"CVE-2026-94169","2026-10-16T00:00:00Z","theme-one","the-grid","NETSCAN-NUCLEI-CVE-CVE-2026-94169","The Grid \u003C= 2.8.1 - Unauthenticated Code Injection",{"id":147,"detectable_with":148,"vuln_details":151,"vuln_id":168,"name":169,"published":94,"updated":64},29866,{"tool":149,"engine":150},{"id":70,"name":71},{"id":73,"name":74},{"id":147,"codename":64,"description":64,"severity":80,"risk_description":152,"public_description":153,"public_recommendation":154,"recommendation":64,"references":155,"cvssv3":160,"epss_score":161,"epss_percentile":162,"cve":163,"in_cisa_catalog":78,"date":165,"software_type":64,"vendor":166,"product":167,"ptt_exploit_capabilities":64},"The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","The Avada Builder (fusion-builder) plugin for WordPress (versions \u003C= 3.15.2) is vulnerable to unauthenticated remote code execution via PHP function injection. The fusion_get_widget_markup AJAX action is registered for unauthenticated users (wp_ajax_nopriv_fusion_get_widget_markup) and is gated only by check_ajax_referer('fusion_load_nonce') - which validates nonce integrity, not user identity. That nonce is minted with wp_create_nonce() for user ID 0 and is deterministically inlined into the JavaScript (fusionPostCardsVars \u002F fusionTableOfContentsVars, key \"nonce\") of any public page that renders a [fusion_post_cards] or [fusion_table_of_contents] shortcode. The attacker-controlled render_logics parameter is base64-decoded and JSON-decoded, and in the wp_conditional_tags case of Fusion_Builder_Conditional_Render_Helper::get_value() the decoded function and args are passed directly to call_user_func() with no allowlist, enabling arbitrary PHP function (and thus OS command) execution.","Update Avada Theme \u002F Avada Builder (fusion-builder) to version 3.15.3 or later, which adds a function allowlist to the wp_conditional_tags render_logics handler.",[156,157,158,159],"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-f53p-382v-8pj7","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6279","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffusion-builder\u002Ftags\u002F3.15.0\u002Finc\u002Fhelpers\u002Fclass-fusion-builder-conditional-render-helper.php#L1531","https:\u002F\u002Fgithub.com\u002Fxxconi\u002FCVE-2026-6279",9.8,0.02387,0.83708,[164],"CVE-2026-6279","2026-05-21T00:00:00Z","themefusion","fusion-builder","NETSCAN-NUCLEI-CVE-CVE-2026-6279","Avada Builder (fusion-builder) \u003C= 3.15.2 - Unauthenticated RCE via PHP Function Injection",{"id":171,"detectable_with":172,"vuln_details":175,"vuln_id":186,"name":187,"published":94,"updated":64},29870,{"tool":173,"engine":174},{"id":70,"name":71},{"id":73,"name":74},{"id":171,"codename":176,"description":64,"severity":80,"risk_description":177,"public_description":178,"public_recommendation":179,"recommendation":64,"references":180,"cvssv3":183,"epss_score":64,"epss_percentile":64,"cve":184,"in_cisa_catalog":78,"date":94,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"PHP2Shell","Running an unpatched, affected PHP version exposes the host to unauthenticated\nRemote Code Execution (CVE-2026-109618 & CVE-2026-109619), which can lead to full host compromise.\nDisclosing the exact PHP version in HTTP headers further aids attackers in\nfingerprinting and targeting the host.","The target discloses, via the Server \u002F X-Powered-By HTTP response header, a PHP\nversion that falls within the range affected by CVE-2026-109618 & CVE-2026-109619, a Remote Code\nExecution vulnerability. An unauthenticated attacker can leverage the flaw to\nexecute arbitrary code on the host. This template performs passive, version-based\ndetection from the disclosed PHP version and does not actively exploit the flaw.","Upgrade PHP to a fixed release and set expose_php = Off to stop disclosing the version.",[181,182],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-109618","https:\u002F\u002Fwww.php.net\u002FChangeLog-8.php",9.2,[185],"CVE-2026-109618","NETSCAN-NUCLEI-CVE-CVE-2026-109618","PHP2Shell - Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)",{"id":189,"detectable_with":190,"vuln_details":193,"vuln_id":206,"name":207,"published":94,"updated":64},29864,{"tool":191,"engine":192},{"id":70,"name":71},{"id":73,"name":74},{"id":189,"codename":64,"description":64,"severity":80,"risk_description":194,"public_description":195,"public_recommendation":196,"recommendation":64,"references":197,"cvssv3":86,"epss_score":200,"epss_percentile":201,"cve":202,"in_cisa_catalog":78,"date":89,"software_type":64,"vendor":204,"product":205,"ptt_exploit_capabilities":64},"Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.","The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.","Update to a version later than 4.5.5 or the latest available version.",[198,199],"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-52715","https:\u002F\u002Fdev.to\u002Fguidance_white\u002Fcve-2026-52715-unauthenticated-sql-injection-in-geo-my-wp-via-map-boundary-search-2fij",0.004,0.32862,[203],"CVE-2026-52715","eyal-fitoussi","geo-my-wp","NETSCAN-NUCLEI-CVE-CVE-2026-52715","GEO my WP \u003C= 4.5.5 - Unauthenticated SQL Injection",{"id":67,"detectable_with":209,"vuln_details":212,"vuln_id":92,"name":215,"published":94,"updated":64},{"tool":210,"engine":211},{"id":70,"name":71},{"id":73,"name":74},{"id":67,"codename":64,"description":64,"severity":80,"risk_description":81,"public_description":79,"public_recommendation":82,"recommendation":64,"references":213,"cvssv3":86,"epss_score":76,"epss_percentile":77,"cve":214,"in_cisa_catalog":78,"date":89,"software_type":64,"vendor":90,"product":91,"ptt_exploit_capabilities":64},[84,85],[88],"The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection",{"id":217,"detectable_with":218,"vuln_details":221,"vuln_id":237,"name":238,"published":94,"updated":64},29862,{"tool":219,"engine":220},{"id":70,"name":71},{"id":73,"name":74},{"id":217,"codename":64,"description":64,"severity":104,"risk_description":222,"public_description":223,"public_recommendation":224,"recommendation":64,"references":225,"cvssv3":229,"epss_score":230,"epss_percentile":231,"cve":232,"in_cisa_catalog":78,"date":234,"software_type":64,"vendor":235,"product":236,"ptt_exploit_capabilities":64},"Attackers can execute arbitrary JavaScript in browsers of logged-in users, potentially leading to session hijacking or privilege escalation.","The Ajax Load More WordPress plugin \u003C 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting attack which could be used against high privilege users such as administrators.","Update the plugin to version 7.8.4 or later.",[226,227,228],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6495","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fc52f28c5-547d-48ae-89dd-edcdaeadcec5\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fajax-load-more\u002F",7.1,0.00251,0.15507,[233],"CVE-2026-6495","2026-05-18T00:00:00Z","darren-cooney","ajax-load-more","NETSCAN-NUCLEI-CVE-CVE-2026-6495","WordPress Ajax Load More \u003C 7.8.4 - Reflected Cross-Site Scripting",{"id":240,"detectable_with":241,"vuln_details":244,"vuln_id":260,"name":261,"published":94,"updated":64},29865,{"tool":242,"engine":243},{"id":70,"name":71},{"id":73,"name":74},{"id":240,"codename":64,"description":64,"severity":80,"risk_description":245,"public_description":246,"public_recommendation":247,"recommendation":64,"references":248,"cvssv3":160,"epss_score":253,"epss_percentile":254,"cve":255,"in_cisa_catalog":78,"date":257,"software_type":64,"vendor":258,"product":259,"ptt_exploit_capabilities":64},"Unauthenticated remote attackers can obtain Bearer tokens bound to a WordPress administrator account, granting complete administrative control via the MCP interface including read\u002Fwrite access to all posts, pages, users, plugins, themes, site settings, and database options.","MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) \u003C= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (\u002Fmcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (\u002Fwp-json\u002Fmountdev-ai-mcp-connector\u002Fv1\u002Foauth\u002Fauthorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at \u002Fmcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.","Update the MountDev AI MCP Connector plugin to version 1.6.2 or later, which adds proper authorization checks to the Dynamic Client Registration and authorization endpoints.",[249,250,251,252],"https:\u002F\u002Fgithub.com\u002Fles-k\u002Fwp-secure-mcp","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmountdev-ai-mcp-connector\u002Ftags\u002F1.6.0\u002Fincludes\u002Fclass-oauth-controller.php#L370","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-15015","https:\u002F\u002Fwww.rapid7.com\u002Fdb\u002Fvulnerabilities\u002Fcve-2026-15015\u002F",0.00712,0.52779,[256],"CVE-2026-15015","2026-07-23T00:00:00Z","developer-developer-developer","mountdev-ai-mcp-connector","NETSCAN-NUCLEI-CVE-CVE-2026-15015","MountDev AI MCP Connector \u003C= 1.6.1 - Unauthenticated Admin OAuth Token Exposure",{"id":263,"detectable_with":264,"vuln_details":267,"vuln_id":283,"name":284,"published":94,"updated":64},29869,{"tool":265,"engine":266},{"id":70,"name":71},{"id":73,"name":74},{"id":263,"codename":64,"description":64,"severity":268,"risk_description":64,"public_description":269,"public_recommendation":270,"recommendation":64,"references":271,"cvssv3":275,"epss_score":276,"epss_percentile":277,"cve":278,"in_cisa_catalog":78,"date":280,"software_type":64,"vendor":281,"product":282,"ptt_exploit_capabilities":64},"medium","The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to execute arbitrary SQL commands.","We recommend you to upgrade the affected software to the latest version, which mitigates this vulnerability.",[272,273,274],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fa0285ba3-0741-4382-a037-db0ac3fc49d2\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82186","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fgdpr-cookie-consent\u002F",4.1,0.00311,0.22504,[279],"CVE-2026-82186","2026-09-04T00:00:00Z","wp-legal-pages","gdpr-cookie-consent","NETSCAN-NUCLEI-CVE-CVE-2026-82186","WordPress WPLP Cookie Consent \u003C 4.4.2 - SQL Injection",{"id":286,"detectable_with":287,"vuln_details":290,"vuln_id":300,"name":301,"published":94,"updated":64},29872,{"tool":288,"engine":289},{"id":70,"name":71},{"id":73,"name":74},{"id":286,"codename":64,"description":64,"severity":268,"risk_description":291,"public_description":292,"public_recommendation":293,"recommendation":64,"references":294,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":64,"software_type":64,"vendor":298,"product":299,"ptt_exploit_capabilities":64},"The risk exists that an attacker can use the vulnerability identified to perform further attacks on the server.","GLPI exposes the check availability planning view at front\u002Fplanning.php without authentication when the genical parameter is set, allowing unauthenticated attackers to enumerate user display names by iterating users_id in Planning::checkAvailability(), leading to full username enumeration and a valid-id oracle with no credentials.","Upgrade to a GLPI release that adds a right check to the planning form dispatcher (GHSA-j5vx-jrmw-2498). As an interim measure, restrict access to the planning feature to trusted profiles.",[295,296,297],"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-j5vx-jrmw-2498","https:\u002F\u002Fgithub.com\u002Fglpi-project\u002Fglpi\u002Fcommit\u002Fddc88ad6e0","https:\u002F\u002Fgithub.com\u002Fglpi-project\u002Fglpi","glpi-project","glpi","NETSCAN-NUCLEI-VULNERABILITIES-GLPI-PLANNING-USER-ENUM","GLPI Planning - Unauthenticated Username Enumeration",{"id":303,"detectable_with":304,"vuln_details":307,"vuln_id":323,"name":324,"published":94,"updated":64},29868,{"tool":305,"engine":306},{"id":70,"name":71},{"id":73,"name":74},{"id":303,"codename":64,"description":64,"severity":80,"risk_description":308,"public_description":309,"public_recommendation":310,"recommendation":64,"references":311,"cvssv3":160,"epss_score":316,"epss_percentile":317,"cve":318,"in_cisa_catalog":78,"date":320,"software_type":64,"vendor":321,"product":322,"ptt_exploit_capabilities":64},"Unauthenticated attackers can take over any user account, including administrators, leading to full account compromise.","TrueBooker – Appointment Booking and Scheduler System WordPress plugin \u003C= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and using lost-password flow, exploit requires no authentication.","Update to the latest version of the TrueBooker plugin.",[312,313,314,315],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Ftruebooker-appointment-booking\u002Fvulnerability\u002Fwordpress-truebooker-plugin-1-2-6-unauthenticated-authorization-bypass-through-user-controlled-key-to-account-takeover-to-truebooker-wp-user-id-parameter-vulnerability","https:\u002F\u002Fgithub.com\u002Fnastar-id\u002FCVE-2026-18315-PoC","https:\u002F\u002Fplugins.svn.wordpress.org\u002Ftruebooker-appointment-booking\u002Ftags\u002F1.2.6\u002Fmain\u002Ffunction_ajax.php","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-18315",0.00598,0.47669,[319],"CVE-2026-18315","2026-08-19T00:00:00Z","truebooker","truebooker-appointment-booking","NETSCAN-NUCLEI-CVE-CVE-2026-18315","TrueBooker \u003C= 1.2.6 - Unauthenticated Authorization Bypass",{"id":326,"detectable_with":327,"vuln_details":330,"vuln_id":344,"name":345,"published":94,"updated":64},29867,{"tool":328,"engine":329},{"id":70,"name":71},{"id":73,"name":74},{"id":326,"codename":64,"description":64,"severity":80,"risk_description":152,"public_description":331,"public_recommendation":332,"recommendation":64,"references":333,"cvssv3":337,"epss_score":338,"epss_percentile":339,"cve":340,"in_cisa_catalog":78,"date":342,"software_type":64,"vendor":343,"product":343,"ptt_exploit_capabilities":64},"Dokploy \u003C= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch \u003CcustomGitBranch> ... and executed via \u002Fbin\u002Fsh during deploy (packages\u002Fserver\u002Fsrc\u002Futils\u002Fproviders\u002Fgit.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.","Upgrade to version 0.29.13 or later.",[334,335,336],"https:\u002F\u002Flulztigre.pw\u002Fposts\u002Fdokploy-cve-2026-72867-working-poc.html","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-72867","https:\u002F\u002Fgithub.com\u002Fdokploy\u002Fdokploy",9.9,0.00954,0.60773,[341],"CVE-2026-72867","2026-08-10T00:00:00Z","dokploy","NETSCAN-NUCLEI-CVE-CVE-2026-72867","Dokploy \u003C= 0.29.12 - Authenticated RCE via Command Injection",{"id":347,"detectable_with":348,"vuln_details":351,"vuln_id":363,"name":364,"published":94,"updated":64},29863,{"tool":349,"engine":350},{"id":70,"name":71},{"id":73,"name":74},{"id":347,"codename":64,"description":64,"severity":80,"risk_description":194,"public_description":352,"public_recommendation":353,"recommendation":64,"references":354,"cvssv3":86,"epss_score":200,"epss_percentile":357,"cve":358,"in_cisa_catalog":78,"date":360,"software_type":64,"vendor":361,"product":362,"ptt_exploit_capabilities":64},"Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb->esc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.","Update to the latest version beyond 1.4.4.",[355,356],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-56070","https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fth-advance-product-search\u002Fvulnerability\u002Fwordpress-advance-product-search-plugin-1-4-4-sql-injection-vulnerability?_s_id=cve",0.32848,[359],"CVE-2026-56070","2026-06-26T00:00:00Z","th-advance-product-search","advance-product-search","NETSCAN-NUCLEI-CVE-CVE-2026-56070","Advance Product Search \u003C= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection",{"id":366,"detectable_with":367,"vuln_details":370,"vuln_id":380,"name":381,"published":379,"updated":64},29834,{"tool":368,"engine":369},{"id":70,"name":71},{"id":73,"name":74},{"id":366,"codename":64,"description":64,"severity":104,"risk_description":371,"public_description":372,"public_recommendation":373,"recommendation":64,"references":374,"cvssv3":378,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that an unauthenticated remote attacker can tunnel into internal services running in pods on the node, such as databases, admin interfaces or internal APIs, bypassing network policies and firewalls that are meant to keep them private.","The Kubernetes Kubelet API exposes the \u002FportForward endpoint to unauthenticated users. This endpoint is part of the Kubelet debugging handlers and forwards traffic to any port of any pod on the node. Detection sends an unauthenticated port forward request for a random, non-existent pod and confirms that the Kubelet answers with \"pod does not exist\" instead of an authentication or authorization error. No connection is forwarded during the check.","We recommend disabling anonymous authentication on the Kubelet (--anonymous-auth=false), using the Webhook authorization mode (--authorization-mode=Webhook) instead of AlwaysAllow, and restricting network access to the Kubelet port so that only the control plane can reach it. If the debugging handlers are not needed, disable them with --enable-debugging-handlers=false.",[375,376,377],"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Faccess-authn-authz\u002Fkubelet-authn-authz\u002F","https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Fcommand-line-tools-reference\u002Fkubelet\u002F","https:\u002F\u002Fgithub.com\u002Fkubernetes\u002Fkubernetes\u002Fblob\u002Fmaster\u002Fpkg\u002Fkubelet\u002Fserver\u002Fserver.go",8.6,"2026-10-20T00:00:00Z","NETSCAN-NUCLEI-MISCONFIGURATION-KUBELET-EXPOSED-PORT-FORWARD","Kubernetes Kubelet - Unauthenticated Port Forward",{"id":383,"detectable_with":384,"vuln_details":387,"vuln_id":393,"name":394,"published":379,"updated":64},29828,{"tool":385,"engine":386},{"id":70,"name":71},{"id":73,"name":74},{"id":383,"codename":64,"description":64,"severity":104,"risk_description":64,"public_description":388,"public_recommendation":389,"recommendation":64,"references":390,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":64,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"Scans for kube secrets endpoint","We recommend you to analyze if this resource should be available or not.",[391,392],"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Faccess-authn-authz\u002Fauthentication\u002F#anonymous-requests","https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Faccess-authn-authz\u002Frbac\u002F","NETSCAN-NUCLEI-TECH-KUBE-API-SECRETS","Kube API Secrets",{"id":396,"detectable_with":397,"vuln_details":400,"vuln_id":411,"name":412,"published":379,"updated":64},29835,{"tool":398,"engine":399},{"id":70,"name":71},{"id":73,"name":74},{"id":396,"codename":64,"description":64,"severity":268,"risk_description":401,"public_description":402,"public_recommendation":403,"recommendation":64,"references":404,"cvssv3":406,"epss_score":407,"epss_percentile":408,"cve":409,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that an unauthenticated remote attacker could cause a Denial of Service attack.","We found that the target uses a Kubernetes version with a HTTP\u002F2 implementation that is vulnerable to reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. Detection is based on the Kubernetes version only (fixed in v1.13.10, v1.14.6, v1.15.3).","We recommend updating to a patched version.",[405],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-9514",7.5,0.82813,0.99669,[410],"CVE-2019-9514","NETSCAN-NUCLEI-CVE-CVE-2019-9514-K8S","Kubernetes - HTTP\u002F2 Reset Flood",{"id":414,"detectable_with":415,"vuln_details":418,"vuln_id":421,"name":422,"published":379,"updated":64},29852,{"tool":416,"engine":417},{"id":70,"name":71},{"id":73,"name":74},{"id":414,"codename":64,"description":64,"severity":104,"risk_description":64,"public_description":419,"public_recommendation":389,"recommendation":64,"references":420,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":64,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"Scans for kube nodes",[391,392],"NETSCAN-NUCLEI-TECH-KUBE-API-NODES","Kube API Nodes",{"id":424,"detectable_with":425,"vuln_details":428,"vuln_id":433,"name":434,"published":379,"updated":64},29833,{"tool":426,"engine":427},{"id":70,"name":71},{"id":73,"name":74},{"id":424,"codename":64,"description":64,"severity":268,"risk_description":429,"public_description":430,"public_recommendation":373,"recommendation":64,"references":431,"cvssv3":432,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that an unauthenticated remote attacker can learn how the Kubelet is configured, including which security features are enabled and where its credentials are stored, and use this information to plan further attacks against the node. The other pprof endpoints exposed alongside it can also be abused to put extra load on the Kubelet.","The Kubernetes Kubelet API exposes the \u002Fdebug\u002Fpprof\u002Fcmdline endpoint to unauthenticated users. This endpoint is part of the Kubelet debugging handlers and returns the full command line used to start the Kubelet, including all flags and the paths to its configuration, kubeconfig and certificate files. Detection is based on an unauthenticated request to \u002Fdebug\u002Fpprof\u002Fcmdline returning the Kubelet command line.",[375,376,377],5.3,"NETSCAN-NUCLEI-MISCONFIGURATION-KUBELET-EXPOSED-CMDLINE","Kubernetes Kubelet - Exposed Command Line",{"id":436,"detectable_with":437,"vuln_details":440,"vuln_id":450,"name":451,"published":379,"updated":64},29836,{"tool":438,"engine":439},{"id":70,"name":71},{"id":73,"name":74},{"id":436,"codename":64,"description":64,"severity":104,"risk_description":441,"public_description":442,"public_recommendation":403,"recommendation":64,"references":443,"cvssv3":445,"epss_score":446,"epss_percentile":447,"cve":448,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that a remote attacker with access to custom resources in a single namespace can access custom resources with cluster scope.","We found that the target uses a Kubernetes version in which the kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view, update, or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions before 1.13.9, versions before 1.14.5, versions before 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, and 1.12. Detection is based on the Kubernetes version only (fixed in v1.13.9, v1.14.5, v1.15.2).",[444],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-11247",8.1,0.0215,0.81871,[449],"CVE-2019-11247","NETSCAN-NUCLEI-CVE-CVE-2019-11247-K8S","Kubernetes - Arbitrary Access To Cluster Scoped Resources",{"id":453,"detectable_with":454,"vuln_details":457,"vuln_id":463,"name":464,"published":379,"updated":64},29846,{"tool":455,"engine":456},{"id":70,"name":71},{"id":73,"name":74},{"id":453,"codename":64,"description":64,"severity":458,"risk_description":459,"public_description":460,"public_recommendation":461,"recommendation":64,"references":462,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"low","The risk exists that an unauthenticated remote attacker can gain access to sensitive information about the cluster.","We found that the Kubelet returns its health state on the \u002Fhealthz endpoint without authentication. Detection checks that \u002Fhealthz returns ok and that \u002Fpods answers like a Kubelet, so the Kubernetes API server, which also serves \u002Fhealthz, does not match.","We recommend disabling anonymous access to the Kubelet (--anonymous-auth=false with Webhook authorization) and disabling the read-only port (--read-only-port=0).",[375,376],"NETSCAN-NUCLEI-MISCONFIGURATION-KUBELET-HEALTHZ-EXPOSED","Kubernetes Kubelet - Health Endpoint Exposed",{"id":466,"detectable_with":467,"vuln_details":470,"vuln_id":474,"name":475,"published":379,"updated":64},29829,{"tool":468,"engine":469},{"id":70,"name":71},{"id":73,"name":74},{"id":466,"codename":64,"description":64,"severity":80,"risk_description":471,"public_description":472,"public_recommendation":373,"recommendation":64,"references":473,"cvssv3":160,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that an unauthenticated remote attacker can execute arbitrary commands inside any container running on the node with a single HTTP request, steal secrets and service account tokens, install malware or ransomware and use the compromised containers to take over the node and the rest of the cluster.","The Kubernetes Kubelet API exposes the \u002Frun endpoint to unauthenticated users. This endpoint is part of the Kubelet debugging handlers and runs a single command inside any container on the node, returning its output in the HTTP response. Detection sends an unauthenticated run request for a random, non-existent pod and confirms that the Kubelet answers with \"pod does not exist\" instead of an authentication or authorization error. No command is executed during the check.",[375,376,377],"NETSCAN-NUCLEI-MISCONFIGURATION-KUBELET-EXPOSED-RUN","Kubernetes Kubelet - Unauthenticated Run Inside Container",{"id":477,"detectable_with":478,"vuln_details":481,"vuln_id":486,"name":487,"published":379,"updated":64},29827,{"tool":479,"engine":480},{"id":70,"name":71},{"id":73,"name":74},{"id":477,"codename":64,"description":64,"severity":104,"risk_description":482,"public_description":483,"public_recommendation":484,"recommendation":64,"references":485,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that an unauthenticated remote attacker with access to the target Kubernetes API can read the RBAC configuration of the cluster. Depending on the other permissions that anonymous users have, the attacker may also change the state of the cluster.","We were able to list the RBAC Roles or ClusterRoles of the cluster through the Kubernetes API without authentication. This shows that the anonymous user has read permissions on RBAC resources.","We recommend reviewing the RBAC permissions to Kubernetes API server for the anonymous account. Remove the bindings that grant permissions to system:anonymous or system:unauthenticated.",[392,391],"NETSCAN-NUCLEI-MISCONFIGURATION-KUBE-API-LIST-ROLES","Kubernetes API Server - Unauthenticated Role Listing",{"id":489,"detectable_with":490,"vuln_details":493,"vuln_id":499,"name":500,"published":379,"updated":64},29832,{"tool":491,"engine":492},{"id":70,"name":71},{"id":73,"name":74},{"id":489,"codename":64,"description":64,"severity":458,"risk_description":494,"public_description":495,"public_recommendation":496,"recommendation":64,"references":497,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that the provided email address can be abused for further email-based attacks.","We found that a Kubernetes component (API server, Kubelet or etcd) presents a TLS certificate that includes an email address. The email address may provide additional information about the target organization to an attacker.","We recommend not including email addresses in the certificates of the Kubernetes components.",[498],"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fsetup\u002Fbest-practices\u002Fcertificates\u002F","NETSCAN-NUCLEI-SSL-KUBERNETES-CERTIFICATE-EMAIL","Kubernetes - TLS Certificate Includes Email Address",{"id":502,"detectable_with":503,"vuln_details":506,"vuln_id":509,"name":510,"published":379,"updated":64},29859,{"tool":504,"engine":505},{"id":70,"name":71},{"id":73,"name":74},{"id":502,"codename":64,"description":64,"severity":268,"risk_description":64,"public_description":507,"public_recommendation":389,"recommendation":64,"references":508,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":64,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"Scans for kubelet running pods",[375],"NETSCAN-NUCLEI-TECH-KUBELET-SCAN","Kubelet Running Pods",{"id":512,"detectable_with":513,"vuln_details":516,"vuln_id":522,"name":523,"published":379,"updated":64},29842,{"tool":514,"engine":515},{"id":70,"name":71},{"id":73,"name":74},{"id":512,"codename":64,"description":64,"severity":104,"risk_description":517,"public_description":518,"public_recommendation":519,"recommendation":64,"references":520,"cvssv3":64,"epss_score":64,"epss_percentile":64,"cve":64,"in_cisa_catalog":78,"date":379,"software_type":64,"vendor":64,"product":64,"ptt_exploit_capabilities":64},"The risk exists that an unauthenticated remote attacker can access the dashboard, learn about the cluster and potentially create new resources.","We found an open Kubernetes Dashboard. The Kubernetes Dashboard can be used by an attacker to learn about the cluster and potentially to create new resources. Detection is based on the Dashboard API returning the cluster node list without authentication.","We recommend securing the access to the Kubernetes Dashboard. Require a bearer token or an authenticating proxy, and do not expose the Dashboard outside the cluster.",[521],"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Faccess-application-cluster\u002Fweb-ui-dashboard\u002F","NETSCAN-NUCLEI-MISCONFIGURATION-KUBERNETES-DASHBOARD-UNAUTH-API","Kubernetes Dashboard - Unauthenticated API Access"]