[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":70,"FormattedDate_LLxvRZHG9rJDBHDTP6zdPnJRlAdU99Efbb3pKncowTw":77,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":84,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":90,"$f17q7jdn7tll3p":97,"$f2r4b9phgo6bha":129,"finding-templates-{\"q\":\"\",\"page\":1}":131},[4,15,24,31,38,45,65],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","secondary","php2shell-rce",{"title":16,"slug":17,"text":18,"link":19,"external":20,"targets":21,"cta":23,"variant":13,"campaign_id":17},"Node2Shell - Exploit on Sniper: Auto-Exploiter page","node2shell-exploit","🚨 Exclusive exploit for Node2Shell now live","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-sniper",false,[22],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan",{"title":25,"slug":17,"text":26,"link":27,"external":9,"targets":28,"cta":30,"variant":13,"campaign_id":17},"Node2Shell exploit - Exploit on the NS page","🚨 Go beyond Node2Shell detection: exploit it with our exclusive module","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-network",[29],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":32,"slug":33,"text":34,"link":35,"external":9,"targets":36,"cta":30,"variant":13,"campaign_id":17},"Node2Shell exploit - CVE page","node2shell-exploit-1","🚨 Detect + prove Node2Shell with our exclusive Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-vulndb",[37],"\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":39,"slug":17,"text":40,"link":35,"external":9,"targets":41,"cta":44,"variant":13,"campaign_id":17},"Node2Shell exploit - Vuln DB homepage, product","🚨 CISA reports active Node2Shell exploitation. Use our exclusive exploit to get proof",[42,43],"\u002Fvulnerabilities-exploits","\u002Fproduct","Get the Exploit plan",{"title":46,"slug":17,"text":47,"link":8,"external":9,"targets":48,"cta":12,"variant":13,"campaign_id":17},"Node2Shell exploit - top pages, pricing CTA","Detect PHP2Shell & Node2Shell with every paid plan. Prove Node2Shell with the Exploit plan.",[49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",{"title":66,"slug":17,"text":47,"link":67,"external":20,"targets":68,"cta":67,"variant":13,"campaign_id":17},"Node2Shell exploit - pricing page",null,[69],"\u002Fpricing",["Island",71],{"key":72,"params":73,"result":75},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":74},"{}",{"head":76},{},["Island",78],{"key":79,"params":80,"result":82},"FormattedDate_LLxvRZHG9rJDBHDTP6zdPnJRlAdU99Efbb3pKncowTw",{"props":81},"{\"date\":1793189346,\"format\":\"MMMM dd, yyyy\"}",{"head":83},{},["Island",85],{"key":86,"params":87,"result":88},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":74},{"head":89},{},["Island",91],{"key":92,"params":93,"result":95},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":94},"{\"text-color\":\"gray\"}",{"head":96},{},{"count":98,"next":99,"previous":67,"results":100},17593,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",[101],{"id":102,"detectable_with":103,"vuln_details":110,"vuln_id":126,"name":127,"published":128,"updated":67},29951,{"tool":104,"engine":107},{"id":105,"name":106},1,"Network Scanner",{"id":108,"name":109},2,"Nuclei",{"id":102,"epss_score":111,"epss_percentile":112,"in_cisa_catalog":20,"codename":67,"public_description":113,"description":67,"severity":114,"risk_description":115,"public_recommendation":116,"recommendation":67,"references":117,"cvssv3":121,"cve":122,"date":124,"software_type":67,"vendor":125,"product":125,"ptt_exploit_capabilities":67,"category":67},0.00235,0.14431,"Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the \u002Fapi\u002Fv1\u002Fmeta endpoint due to missing output encoding in the renderMeta() function in system\u002Ftypemill\u002FAssets.php.","medium","An authenticated attacker can inject arbitrary HTML attributes into meta tags, potentially leading to stored cross-site scripting (XSS) and execution of attacker-controlled JavaScript in the victim's browser context.","Update Typemill CMS to version 2.23.0 or later, which applies htmlspecialchars() encoding to metadata values before rendering.",[118,119,120],"https:\u002F\u002Fgithub.com\u002Ftypemill\u002Ftypemill\u002Fsecurity\u002Fadvisories\u002FGHSA-wg6r-jwmr-p7gr","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53468","https:\u002F\u002Fgithub.com\u002Ftypemill\u002Ftypemill",4.6,[123],"CVE-2026-53468","2026-08-21T00:00:00Z","typemill","NETSCAN-NUCLEI-CVE-CVE-2026-53468","Typemill CMS \u003C 2.23.0 - Cross-Site Scripting (CVE-2026-53468)","2026-11-03T00:00:00Z",{"count":130},222,{"count":98,"next":132,"previous":67,"results":133},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[134,159,167,180,204,228,242,264,287,308,331,357,380,401,416,437,460,483,506,527,550,572,592,605,618],{"id":135,"detectable_with":136,"vuln_details":139,"vuln_id":157,"name":158,"published":128,"updated":67},29956,{"tool":137,"engine":138},{"id":105,"name":106},{"id":108,"name":109},{"id":135,"codename":67,"description":67,"severity":140,"risk_description":141,"public_description":142,"public_recommendation":143,"recommendation":67,"references":144,"cvssv3":149,"epss_score":150,"epss_percentile":151,"cve":152,"in_cisa_catalog":9,"date":154,"software_type":67,"vendor":155,"product":156,"ptt_exploit_capabilities":67},"critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.","Apply the BT26-05-RS patch or upgrade to a fixed BeyondTrust Remote Support build. SaaS instances were patched by the vendor.",[145,146,147,148],"https:\u002F\u002Fwww.beyondtrust.com\u002Ftrust-center\u002Fsecurity-advisories\u002Fbt26-05","https:\u002F\u002Fgithub.com\u002Frapid7\u002Fmetasploit-framework\u002Fpull\u002F22083","https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102764",9.3,0.1895,0.97299,[153],"CVE-2026-102764","2026-10-15T00:00:00Z","beyondtrust","remote_support","NETSCAN-NUCLEI-CVE-CVE-2026-102764","BeyondTrust Remote Support \u003C= 26.2.3 - Origin Validation File Upload",{"id":102,"detectable_with":160,"vuln_details":163,"vuln_id":126,"name":166,"published":128,"updated":67},{"tool":161,"engine":162},{"id":105,"name":106},{"id":108,"name":109},{"id":102,"codename":67,"description":67,"severity":114,"risk_description":115,"public_description":113,"public_recommendation":116,"recommendation":67,"references":164,"cvssv3":121,"epss_score":111,"epss_percentile":112,"cve":165,"in_cisa_catalog":20,"date":124,"software_type":67,"vendor":125,"product":125,"ptt_exploit_capabilities":67},[118,119,120],[123],"Typemill CMS \u003C 2.23.0 - Cross-Site Scripting",{"id":168,"detectable_with":169,"vuln_details":172,"vuln_id":178,"name":179,"published":128,"updated":67},29959,{"tool":170,"engine":171},{"id":105,"name":106},{"id":108,"name":109},{"id":168,"codename":67,"description":67,"severity":140,"risk_description":173,"public_description":174,"public_recommendation":175,"recommendation":67,"references":176,"cvssv3":67,"epss_score":67,"epss_percentile":67,"cve":67,"in_cisa_catalog":20,"date":67,"software_type":67,"vendor":67,"product":67,"ptt_exploit_capabilities":67},"The risk exist that a remote attacker could take advantage of the default credentials for taking over the default account. If an authenticated vulnerability is present on the machine, it could also be leveraged to exploit the target, compromising the underlying system.","bWAPP (buggy Web Application) is a deliberately vulnerable test application for security training. The default credentials (bee:bug) are part of the intended security testing scenario and grant access to all vulnerable modules.","Change the default login credentials. Use a strong password, at least 10 characters long, preferably randomly generated. Unless the login panel is intended to be exposed to the internet, we strongly recommend placing it behind a firewall.",[177],"https:\u002F\u002Fitsecgames.com\u002F","NETSCAN-NUCLEI-DEFAULT-LOGINS-BWAPP-DEFAULT-LOGIN","bWAPP Default Login",{"id":181,"detectable_with":182,"vuln_details":185,"vuln_id":202,"name":203,"published":128,"updated":67},29957,{"tool":183,"engine":184},{"id":105,"name":106},{"id":108,"name":109},{"id":181,"codename":67,"description":67,"severity":186,"risk_description":187,"public_description":188,"public_recommendation":189,"recommendation":67,"references":190,"cvssv3":195,"epss_score":196,"epss_percentile":197,"cve":198,"in_cisa_catalog":20,"date":200,"software_type":67,"vendor":201,"product":201,"ptt_exploit_capabilities":67},"high","The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","MLflow 3.10.0 through 3.16.1 contains a path traversal in the prompt branch of the CreateModelVersion handler. The fix for CVE-2026-2614 only validated prompt sources that carry a URL scheme, so a schemeless relative path such as ..\u002F..\u002F..\u002Fetc is stored unchanged as the model version artifact location and later served by the model-versions\u002Fget-artifact endpoint, letting unauthenticated remote attackers read arbitrary files from the server filesystem.","Upgrade to version 3.17.0 or later.",[191,192,193,194],"https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Fsecurity\u002Fadvisories\u002FGHSA-m65p-9j7q-6w33","https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Fpull\u002F25870","https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Fcommit\u002F81730a2ce4ebcd60d5d18f68c96f422ad7e30772","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116690",7.5,0.00559,0.46562,[199],"CVE-2026-116690","2026-10-27T00:00:00Z","mlflow","NETSCAN-NUCLEI-CVE-CVE-2026-116690","MLflow 3.10.0-3.16.1 - Arbitrary File Read",{"id":205,"detectable_with":206,"vuln_details":209,"vuln_id":226,"name":227,"published":128,"updated":67},29955,{"tool":207,"engine":208},{"id":105,"name":106},{"id":108,"name":109},{"id":205,"codename":67,"description":67,"severity":140,"risk_description":141,"public_description":210,"public_recommendation":211,"recommendation":67,"references":212,"cvssv3":218,"epss_score":219,"epss_percentile":220,"cve":221,"in_cisa_catalog":20,"date":223,"software_type":67,"vendor":224,"product":225,"ptt_exploit_capabilities":67},"IBM Langflow OSS 1.0.0 through 1.10.0 contains a command injection caused by insufficient input validation, letting authenticated attackers execute arbitrary OS commands and read sensitive files, exploit requires authentication.","Update to the latest version beyond 1.10.0.",[213,214,215,216,217],"https:\u002F\u002Fwww.ibm.com\u002Fsupport\u002Fpages\u002Fnode\u002F7278441","https:\u002F\u002Fgithub.com\u002Flangflow-ai\u002Flangflow\u002Fsecurity\u002Fadvisories\u002FGHSA-w584-2h2r-2hvf","https:\u002F\u002Fgithub.com\u002Frapid7\u002Fmetasploit-framework\u002Fblob\u002Fmaster\u002Fmodules\u002Fexploits\u002Fmulti\u002Fhttp\u002Flangflow_auth_rce_cve_2026_7873.rb","https:\u002F\u002Fgithub.com\u002Frmhowe425\u002FPOC-CVE-2026-7873","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7873",9.9,0.0155,0.75087,[222],"CVE-2026-7873","2026-06-30T00:00:00Z","langflow-ai","langflow","NETSCAN-NUCLEI-CVE-CVE-2026-7873","Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution",{"id":229,"detectable_with":230,"vuln_details":233,"vuln_id":240,"name":241,"published":128,"updated":67},29954,{"tool":231,"engine":232},{"id":105,"name":106},{"id":108,"name":109},{"id":229,"codename":67,"description":67,"severity":114,"risk_description":234,"public_description":235,"public_recommendation":236,"recommendation":67,"references":237,"cvssv3":67,"epss_score":67,"epss_percentile":67,"cve":67,"in_cisa_catalog":20,"date":67,"software_type":67,"vendor":239,"product":239,"ptt_exploit_capabilities":67},"The risk exists that an attacker can use the vulnerability identified to perform further attacks on the server.","Elementor's Editor Events REST authentication filter in versions 4.3.0 and 4.3.1 trusts an events-route marker anywhere in the request URI. This template logs in through the standard \u002Fwp-login.php form with supplied administrator username and password, then compares denied baseline and near-miss requests with access to WordPress settings using the exact marker. The Editor Events experiment must be enabled. Custom login paths, SSO, and MFA are outside the validated login flow; no finding in those configurations does not establish that the issue is absent.","Update Elementor to 4.3.2 or later.",[238],"https:\u002F\u002Fpatchstack.com\u002Farticles\u002Fcross-site-request-forgery-in-elementor-plugin-affecting-2-million-sites\u002F","elementor","NETSCAN-NUCLEI-VULNERABILITIES-ELEMENTOR-REST-NONCE-BYPASS","Elementor 4.3.0 - 4.3.1 - REST Nonce Bypass",{"id":243,"detectable_with":244,"vuln_details":247,"vuln_id":262,"name":263,"published":128,"updated":67},29960,{"tool":245,"engine":246},{"id":105,"name":106},{"id":108,"name":109},{"id":243,"codename":67,"description":67,"severity":140,"risk_description":141,"public_description":248,"public_recommendation":249,"recommendation":67,"references":250,"cvssv3":255,"epss_score":256,"epss_percentile":257,"cve":258,"in_cisa_catalog":9,"date":260,"software_type":67,"vendor":261,"product":261,"ptt_exploit_capabilities":67},"GitLab CE\u002FEE 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 contain a remote code execution caused by insufficient regular expression validation in CI\u002FCD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI\u002FCD config","Upgrade to GitLab CE\u002FEE 19.2.8, 19.3.5, 19.4.2 or later.",[251,252,253,254],"https:\u002F\u002Fgithub.com\u002Fjburgess-r7\u002FCVE-2026-97229-PoC","https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab","https:\u002F\u002Fdocs.gitlab.com\u002Freleases\u002Fpatches\u002Fpatch-release-gitlab-19-4-2-released\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97229",10,0.273,0.9806,[259],"CVE-2026-97229","2026-10-13T00:00:00Z","gitlab","NETSCAN-NUCLEI-CVE-CVE-2026-97229","GitLab CE\u002FEE \u003C 19.2.8 \u002F 19.3.5 \u002F 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow",{"id":265,"detectable_with":266,"vuln_details":269,"vuln_id":285,"name":286,"published":128,"updated":67},29958,{"tool":267,"engine":268},{"id":105,"name":106},{"id":108,"name":109},{"id":265,"codename":67,"description":67,"severity":140,"risk_description":141,"public_description":270,"public_recommendation":271,"recommendation":67,"references":272,"cvssv3":279,"epss_score":280,"epss_percentile":280,"cve":281,"in_cisa_catalog":9,"date":283,"software_type":67,"vendor":284,"product":284,"ptt_exploit_capabilities":67},"PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same worker; exploitation requires a crafted request sequence and a reachable session or INI consumer. This template performs a passive version check against the PHP version disclosed in the X-Powered-By or Server response header and does not send a crafted request. It follows same-origin redirects (same host and port); redirects to another origin are ignored so a third-party response cannot be attributed to the scanned host. Limitations: detection requires the version to be exposed, so hosts with expose_php=Off and no PHP version in the Server header, hosts behind a proxy or FastCGI configuration that strips these headers, and applications that override them are not detected. These headers can also be spoofed, so a match is only as trustworthy as the disclosed header. Builds that backport the fix while keeping the upstream version number (for example 8.2.34-1ubuntu1) still match, so a match reports an affected upstream version rather than confirmed exploitability. Pre-release or development builds of a fixed version (for example 8.2.35RC1) and responses that advertise conflicting versions in different headers are not matched.","Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart all PHP workers. Until patched, set session.upload_progress.enabled=0 and memory_limit=-1 as partial mitigations.",[273,274,275,276,277,278],"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp","https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php#2026-10-21-5","https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F10\u002F21\u002F7","https:\u002F\u002Fcalif.io\u002Fphp2shell\u002F","https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fphp2shell-php-rce","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-109619",9.2,0.99999,[282],"CVE-2026-109619","2026-10-21T00:00:00Z","php","NETSCAN-NUCLEI-CVE-CVE-2026-109619","PHP 8.2 \u003C 8.2.35, 8.3 \u003C 8.3.36, 8.4 \u003C 8.4.27, 8.5 \u003C 8.5.12 - Use-After-Free Remote Code Execution",{"id":288,"detectable_with":289,"vuln_details":292,"vuln_id":306,"name":307,"published":128,"updated":67},29952,{"tool":290,"engine":291},{"id":105,"name":106},{"id":108,"name":109},{"id":288,"codename":67,"description":67,"severity":140,"risk_description":293,"public_description":294,"public_recommendation":295,"recommendation":67,"references":296,"cvssv3":149,"epss_score":299,"epss_percentile":300,"cve":301,"in_cisa_catalog":20,"date":303,"software_type":67,"vendor":304,"product":305,"ptt_exploit_capabilities":67},"Attackers can perform blind SQL injection to extract or manipulate database information, potentially compromising data integrity and confidentiality.","WPFactory Product Filter by WBW woo-product-filter \u003C= 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.","Update to the latest version beyond 3.4.6.",[297,298],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fwoo-product-filter\u002Fvulnerability\u002Fwordpress-product-filter-by-wbw-plugin-3-4-6-sql-injection-vulnerability","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-112866",0.00356,0.2931,[302],"CVE-2026-112866","2026-10-24T00:00:00Z","woobewoo","woo-product-filter","NETSCAN-NUCLEI-CVE-CVE-2026-112866","Product Filter by WBW \u003C= 3.4.6 - SQL Injection",{"id":309,"detectable_with":310,"vuln_details":313,"vuln_id":329,"name":330,"published":128,"updated":67},29953,{"tool":311,"engine":312},{"id":105,"name":106},{"id":108,"name":109},{"id":309,"codename":67,"description":67,"severity":186,"risk_description":314,"public_description":315,"public_recommendation":316,"recommendation":67,"references":317,"cvssv3":321,"epss_score":322,"epss_percentile":323,"cve":324,"in_cisa_catalog":20,"date":326,"software_type":67,"vendor":327,"product":328,"ptt_exploit_capabilities":67},"Attackers can execute arbitrary JavaScript in browsers of logged-in administrators or instructors, potentially leading to session hijacking or privilege escalation.","LearnPress \u003C 4.4.1 does not escape the c_search parameter before reflecting it into the value attribute of the search input on the Course Builder questions page (\u002Fcourse-builder\u002Fquestions\u002F), allowing attribute-injection reflected XSS against authenticated admins\u002Finstructors.","Update the plugin to version 4.4.1 or later.",[318,319,320],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fd0a2780f-ab13-4bb8-935d-2aeba1de12d2\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Flearnpress\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-12970",7.1,0.00251,0.16604,[325],"CVE-2026-12970","2026-07-20T00:00:00Z","thimpress","learnpress","NETSCAN-NUCLEI-CVE-CVE-2026-12970","WordPress LearnPress \u003C 4.4.1 - Cross-Site Scripting",{"id":332,"detectable_with":333,"vuln_details":336,"vuln_id":354,"name":355,"published":356,"updated":67},29938,{"tool":334,"engine":335},{"id":105,"name":106},{"id":108,"name":109},{"id":332,"codename":67,"description":67,"severity":114,"risk_description":337,"public_description":338,"public_recommendation":339,"recommendation":67,"references":340,"cvssv3":346,"epss_score":347,"epss_percentile":348,"cve":349,"in_cisa_catalog":9,"date":351,"software_type":67,"vendor":352,"product":353,"ptt_exploit_capabilities":67},"Attackers can make the server send arbitrary POST requests to attacker-controlled destinations, potentially leading to internal network attacks or data exfiltration.","Plex Media Server \u003C 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in \u002Fplayer\u002Ftimeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value.","Update to version 1.43.3.10861 or later.",[341,342,343,344,345],"https:\u002F\u002Fzmain.info\u002Fblog\u002Fplex2shell","https:\u002F\u002Fgithub.com\u002Fgmh5225\u002Fplex2shell","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-96652","https:\u002F\u002Fraw.githubusercontent.com\u002Fcisagov\u002FCSAF\u002Fdevelop\u002Fcsaf_files\u002FIT\u002Fwhite\u002F2026\u002Fva-26-266-01.json","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5p7w-r379-3c2m",4.3,0.01821,0.78759,[350],"CVE-2026-96652","2026-09-23T00:00:00Z","plex","plex_media_server","NETSCAN-NUCLEI-CVE-CVE-2026-96652","Plex Media Server \u003C 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)","2026-11-02T00:00:00Z",{"id":358,"detectable_with":359,"vuln_details":362,"vuln_id":378,"name":379,"published":356,"updated":67},29939,{"tool":360,"engine":361},{"id":105,"name":106},{"id":108,"name":109},{"id":358,"codename":67,"description":67,"severity":140,"risk_description":141,"public_description":363,"public_recommendation":364,"recommendation":67,"references":365,"cvssv3":370,"epss_score":371,"epss_percentile":372,"cve":373,"in_cisa_catalog":20,"date":375,"software_type":67,"vendor":376,"product":377,"ptt_exploit_capabilities":67},"Langchain-Chatchat \u003C= 0.3.1.3 contains a command injection caused by unauthenticated access to the \u002Ftools\u002Fcall API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.","Update to the latest version of Langchain-Chatchat.",[366,367,368,369],"https:\u002F\u002Fwww.lasso.security\u002Fvulnerability-database\u002Fcve-2026-75128","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Flangchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint","https:\u002F\u002Fgithub.com\u002Fchatchat-space\u002FLangchain-Chatchat","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-75128",9.8,0.00632,0.50273,[374],"CVE-2026-75128","2026-10-20T00:00:00Z","chatchat-space","langchain-chatchat","NETSCAN-NUCLEI-CVE-CVE-2026-75128","Langchain-Chatchat \u003C= 0.3.1.3 - Unauthenticated RCE",{"id":381,"detectable_with":382,"vuln_details":385,"vuln_id":399,"name":400,"published":356,"updated":67},29937,{"tool":383,"engine":384},{"id":105,"name":106},{"id":108,"name":109},{"id":381,"codename":67,"description":67,"severity":140,"risk_description":386,"public_description":387,"public_recommendation":388,"recommendation":67,"references":389,"cvssv3":393,"epss_score":394,"epss_percentile":395,"cve":396,"in_cisa_catalog":20,"date":398,"software_type":67,"vendor":67,"product":67,"ptt_exploit_capabilities":67},"Unauthenticated attackers with network access can execute arbitrary code on the server, potentially leading to full system compromise.","ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.","Upgrade to a fixed ClickHouse release that ships brotli v1.2.1: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable or later. brotli v1.2.1 returns a hard BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) error immediately on invalid block switch, preventing the infinite loop.",[390,391,392],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116366","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111497","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fbrotli\u002Fcompare\u002Fv1.2.0...v1.2.1",9.5,0.00395,0.33764,[397],"CVE-2026-116366","2026-10-30T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-116366","ClickHouse Server - Brotli v1.2.0 Decoder DoS\u002FOOB-Write",{"id":402,"detectable_with":403,"vuln_details":406,"vuln_id":414,"name":415,"published":398,"updated":67},29935,{"tool":404,"engine":405},{"id":105,"name":106},{"id":108,"name":109},{"id":402,"codename":67,"description":67,"severity":140,"risk_description":234,"public_description":407,"public_recommendation":408,"recommendation":67,"references":409,"cvssv3":67,"epss_score":67,"epss_percentile":67,"cve":67,"in_cisa_catalog":20,"date":67,"software_type":67,"vendor":412,"product":413,"ptt_exploit_capabilities":67},"NUUO Crystal Server 3.19.0.85 exposes an unauthenticated file upload handler at upload.php that echoes the client-supplied multipart filename and passes it directly to copy() as the destination, with no authentication, extension, MIME or path validation. An anonymous POST writes an attacker-named PHP file into the served document root, and a single GET triggers the lighttpd fastcgi mapping to execute it, yielding remote code execution as the product's PHP service account.","Restrict access to upload.php, require authentication, and enforce extension, MIME and destination-path validation on uploads. Apply vendor updates when available.",[410,411],"https:\u002F\u002F0day-rubbish.com\u002Fblog\u002Fnuuo-crystal-server-unauth-upload-php-webroot-write-rce","https:\u002F\u002Fgithub.com\u002FExploit-Garbage\u002F0day-Rubbish","nuuo","crystal-server","NETSCAN-NUCLEI-VULNERABILITIES-NUUO-UNAUTH-RCE","NUUO Crystal Server - Unauthenticated File Upload Remote Code Execution",{"id":417,"detectable_with":418,"vuln_details":421,"vuln_id":435,"name":436,"published":398,"updated":67},29934,{"tool":419,"engine":420},{"id":105,"name":106},{"id":108,"name":109},{"id":417,"codename":67,"description":67,"severity":114,"risk_description":422,"public_description":423,"public_recommendation":424,"recommendation":67,"references":425,"cvssv3":429,"epss_score":430,"epss_percentile":431,"cve":432,"in_cisa_catalog":20,"date":434,"software_type":67,"vendor":67,"product":67,"ptt_exploit_capabilities":67},"Attackers can perform unauthorized RPC calls to execute scripts, change download directories, or delete torrents and data.","Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.","Upgrade to Transmission 4.1.3 or later, which removes the CORS headers from the RPC server (commit c6a1bd20). Additionally restrict rpc-whitelist \u002F enable rpc authentication.",[426,427,428],"https:\u002F\u002Fgithub.com\u002Ftransmission\u002Ftransmission\u002Fcommit\u002Fc6a1bd2017a0fea9c956737c213f23e4b0f7929e","https:\u002F\u002Fgithub.com\u002Ftransmission\u002Ftransmission\u002Fpull\u002F8938","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116748",8.8,0.01246,0.6931,[433],"CVE-2026-116748","2026-10-26T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-116748","Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID",{"id":438,"detectable_with":439,"vuln_details":442,"vuln_id":457,"name":458,"published":459,"updated":67},29930,{"tool":440,"engine":441},{"id":105,"name":106},{"id":108,"name":109},{"id":438,"codename":67,"description":67,"severity":140,"risk_description":141,"public_description":443,"public_recommendation":444,"recommendation":67,"references":445,"cvssv3":370,"epss_score":451,"epss_percentile":452,"cve":453,"in_cisa_catalog":9,"date":455,"software_type":67,"vendor":456,"product":456,"ptt_exploit_capabilities":67},"Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.","Update to a version later than 6.5.4 or 7.1.3 where the vulnerability is not exploitable.",[446,447,448,449,450],"https:\u002F\u002Fzammad.com\u002Fen\u002Fadvisories\u002Fcve-2026-102489-cve-2026-102490","https:\u002F\u002Fcsirt.divd.nl\u002FCVE-2026-102489","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fdisclosures\u002Fcve-2026-102489-zammad-session-leak-rce\u002F","https:\u002F\u002Fgithub.com\u002Fhorizon3ai\u002FCVE-2026-102489","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102489",0.22478,0.97706,[454],"CVE-2026-102489","2026-09-30T00:00:00Z","zammad","NETSCAN-NUCLEI-CVE-CVE-2026-102489","Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution","2026-10-29T00:00:00Z",{"id":461,"detectable_with":462,"vuln_details":465,"vuln_id":481,"name":482,"published":459,"updated":67},29929,{"tool":463,"engine":464},{"id":105,"name":106},{"id":108,"name":109},{"id":461,"codename":67,"description":67,"severity":140,"risk_description":466,"public_description":467,"public_recommendation":468,"recommendation":67,"references":469,"cvssv3":370,"epss_score":474,"epss_percentile":475,"cve":476,"in_cisa_catalog":20,"date":478,"software_type":67,"vendor":479,"product":480,"ptt_exploit_capabilities":67},"Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.","FUXA \u003C= 1.1.12 contains a SQL injection caused by unsanitized input in \u002Fapi\u002Fsignin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.","Update to the latest version of FUXA to fix the vulnerability.",[470,471,472,473],"https:\u002F\u002Fgithub.com\u002FMateusTesser\u002FCVE-2023-31719","https:\u002F\u002Fgithub.com\u002Ffrangoteam\u002FFUXA\u002Fblob\u002Fv1.1.12\u002Fserver\u002Fruntime\u002Fusers\u002Fusrstorage.js","https:\u002F\u002Fgithub.com\u002Ffrangoteam\u002FFUXA\u002Fblob\u002Fv1.1.12\u002Fserver\u002Fapi\u002Fauth\u002Findex.js","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-31719",0.44088,0.98753,[477],"CVE-2023-31719","2023-09-22T00:00:00Z","frangoteam","fuxa","NETSCAN-NUCLEI-CVE-CVE-2023-31719","FUXA \u003C= 1.1.12 - Unauthenticated SQL Injection",{"id":484,"detectable_with":485,"vuln_details":488,"vuln_id":504,"name":505,"published":459,"updated":67},29931,{"tool":486,"engine":487},{"id":105,"name":106},{"id":108,"name":109},{"id":484,"codename":67,"description":67,"severity":186,"risk_description":489,"public_description":490,"public_recommendation":491,"recommendation":67,"references":492,"cvssv3":496,"epss_score":497,"epss_percentile":498,"cve":499,"in_cisa_catalog":20,"date":501,"software_type":67,"vendor":502,"product":503,"ptt_exploit_capabilities":67},"An unauthenticated attacker can coerce the GeoNetwork server into sending HTTP requests to internal hosts, enabling internal service interaction, cloud metadata access, and reconnaissance of the internal network from an anonymous position.","GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST \u002Fsrv\u002Fapi\u002Ftools\u002Fogc\u002Fsld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.","Upgrade GeoNetwork to version 4.2.17, 4.4.12, or later.",[493,494,495],"https:\u002F\u002Fgithub.com\u002Fgeonetwork\u002Fcore-geonetwork\u002Fsecurity\u002Fadvisories\u002FGHSA-5hx7-j24v-rffj","https:\u002F\u002Fgithub.com\u002Fgeonetwork\u002Fcore-geonetwork\u002Fpull\u002F9343","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55864",8.6,0.01446,0.73308,[500],"CVE-2026-55864","2026-09-15T00:00:00Z","geonetwork","core-geonetwork","NETSCAN-NUCLEI-CVE-CVE-2026-55864","GeoNetwork - Server-Side Request Forgery (SSRF)",{"id":507,"detectable_with":508,"vuln_details":511,"vuln_id":525,"name":526,"published":459,"updated":67},29926,{"tool":509,"engine":510},{"id":105,"name":106},{"id":108,"name":109},{"id":507,"codename":67,"description":67,"severity":140,"risk_description":512,"public_description":513,"public_recommendation":514,"recommendation":67,"references":515,"cvssv3":370,"epss_score":520,"epss_percentile":521,"cve":522,"in_cisa_catalog":20,"date":524,"software_type":67,"vendor":327,"product":328,"ptt_exploit_capabilities":67},"Unauthenticated attackers can inject PHP objects, potentially leading to remote code execution or full system compromise.","LearnPress WordPress plugin \u003C= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.","Update to the latest version beyond 4.4.10.",[516,517,518,519],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve","https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Flearnpress\u002Fvulnerability\u002Fwordpress-learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses-plugin-4-4-10-unauthenticated-php-object-injection-vulnerability","https:\u002F\u002Fgithub.com\u002Fmurrez\u002FCVE-2026-104736","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104736",0.02524,0.84869,[523],"CVE-2026-104736","2026-10-17T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-104736","LearnPress \u003C= 4.4.9.1 - PHP Object Injection",{"id":528,"detectable_with":529,"vuln_details":532,"vuln_id":548,"name":549,"published":459,"updated":67},29925,{"tool":530,"engine":531},{"id":105,"name":106},{"id":108,"name":109},{"id":528,"codename":67,"description":67,"severity":114,"risk_description":533,"public_description":534,"public_recommendation":535,"recommendation":67,"references":536,"cvssv3":540,"epss_score":541,"epss_percentile":542,"cve":543,"in_cisa_catalog":20,"date":545,"software_type":67,"vendor":546,"product":547,"ptt_exploit_capabilities":67},"Administrators can execute arbitrary SQL commands, potentially leading to data disclosure or modification.","The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","Update to version 2.0.15 or later.",[537,538,539],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F7b39bae3-41a2-4862-b7c3-1a386273d600\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-14554","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fcheck-email\u002F",6.5,0.01411,0.72665,[544],"CVE-2026-14554","2026-07-31T00:00:00Z","checkemail","check-email","NETSCAN-NUCLEI-CVE-CVE-2026-14554","WordPress Check & Log Email \u003C 2.0.15 - SQL Injection",{"id":551,"detectable_with":552,"vuln_details":555,"vuln_id":570,"name":571,"published":459,"updated":67},29927,{"tool":553,"engine":554},{"id":105,"name":106},{"id":108,"name":109},{"id":551,"codename":67,"description":67,"severity":186,"risk_description":556,"public_description":557,"public_recommendation":558,"recommendation":67,"references":559,"cvssv3":195,"epss_score":564,"epss_percentile":565,"cve":566,"in_cisa_catalog":20,"date":568,"software_type":67,"vendor":569,"product":569,"ptt_exploit_capabilities":67},"Unauthenticated attackers can reconstruct user password salts and hashes from LiveTableResults\nresponses, enabling offline credential cracking.","XWiki Platform is a generic wiki platform. The patch for GHSA-5cf8-vrr8-8hjm \u002F CVE-2023-26476 was insufficient. Starting with version 6.2.1 and prior to 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1, slightly modified LiveTableResults parameters (for example password_class) still allow an unauthenticated attacker to discover password hashes one bit at a time. With about 768 requests, the full password salt and hash of a user can be retrieved. The check for password and email properties does not consider the class passed via the _class parameters.","Upgrade XWiki to 16.10.17, 17.4.9, 17.10.13, 18.0.0RC1, or later. As a workaround, apply the patch manually to the wiki page XWiki.LiveTableResultsMacros.",[560,561,562,563],"https:\u002F\u002Fgithub.com\u002Fxwiki\u002Fxwiki-platform\u002Fsecurity\u002Fadvisories\u002FGHSA-rh28-mqj4-8x59","https:\u002F\u002Fjira.xwiki.org\u002Fbrowse\u002FXWIKI-23875","https:\u002F\u002Fgithub.com\u002Fxwiki\u002Fxwiki-platform\u002Fcommit\u002Fc4442716b02ffcdaa9d5e703b1db6203e36456fa","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48048",0.02008,0.80837,[567],"CVE-2026-48048","2026-08-10T00:00:00Z","xwiki","NETSCAN-NUCLEI-CVE-CVE-2026-48048","XWiki Platform - Password Hash Disclosure",{"id":573,"detectable_with":574,"vuln_details":577,"vuln_id":590,"name":591,"published":459,"updated":67},29932,{"tool":575,"engine":576},{"id":105,"name":106},{"id":108,"name":109},{"id":573,"codename":67,"description":67,"severity":186,"risk_description":187,"public_description":578,"public_recommendation":579,"recommendation":67,"references":580,"cvssv3":584,"epss_score":585,"epss_percentile":586,"cve":587,"in_cisa_catalog":20,"date":589,"software_type":67,"vendor":569,"product":569,"ptt_exploit_capabilities":67},"XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the \u002Fskin\u002F action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF\u002Fxwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.","Upgrade XWiki to later than 17.10.5 and 18.2.0.",[581,582,583],"https:\u002F\u002Fgithub.com\u002Fxwiki\u002Fxwiki-platform\u002Fsecurity\u002Fadvisories\u002FGHSA-qj4x-9g63-25g6","https:\u002F\u002Fjira.xwiki.org\u002Fbrowse\u002FXWIKI-24075","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34151",8.2,0.02469,0.84503,[588],"CVE-2026-34151","2026-09-14T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-34151","XWiki Platform - Path Traversal",{"id":593,"detectable_with":594,"vuln_details":597,"vuln_id":603,"name":604,"published":459,"updated":67},29933,{"tool":595,"engine":596},{"id":105,"name":106},{"id":108,"name":109},{"id":593,"codename":67,"description":67,"severity":186,"risk_description":598,"public_description":599,"public_recommendation":600,"recommendation":67,"references":601,"cvssv3":67,"epss_score":67,"epss_percentile":67,"cve":67,"in_cisa_catalog":20,"date":67,"software_type":67,"vendor":67,"product":67,"ptt_exploit_capabilities":67},"The risk exists that a remote attacker might leverage the misconfigurations in order to compromise the target.","A Damn Vulnerable Web Application (DVWA) setup page is exposed. An unauthenticated attacker can use the setup page to reset the database, which restores the default credentials (admin:password), and the page discloses database configuration details.","We recommend you to analyze if this resource should be available or not.",[602],"https:\u002F\u002Fgithub.com\u002Fdigininja\u002FDVWA","NETSCAN-NUCLEI-MISCONFIGURATION-DVWA-SETUP","DVWA Exposed Setup Page",{"id":606,"detectable_with":607,"vuln_details":610,"vuln_id":616,"name":617,"published":459,"updated":67},29924,{"tool":608,"engine":609},{"id":105,"name":106},{"id":108,"name":109},{"id":606,"codename":67,"description":67,"severity":114,"risk_description":234,"public_description":611,"public_recommendation":612,"recommendation":67,"references":613,"cvssv3":67,"epss_score":67,"epss_percentile":67,"cve":67,"in_cisa_catalog":20,"date":67,"software_type":67,"vendor":615,"product":615,"ptt_exploit_capabilities":67},"Diafan CMS 6.0 contains a reflected cross-site scripting vulnerability in the shop search functionality. The \"a\" parameter is not properly sanitized before being reflected in the response, allowing attackers to inject and execute arbitrary JavaScript in the context of a victim's browser.","Apply context-aware HTML output encoding to the \"a\" search parameter and validate user input before reflecting it into responses.",[614],"https:\u002F\u002Fgithub.com\u002Fdiafan\u002Fdiafan","diafan","NETSCAN-NUCLEI-VULNERABILITIES-DIAFAN-CMS-XSS","Diafan CMS 6.0 - Cross-Site Scripting",{"id":619,"detectable_with":620,"vuln_details":623,"vuln_id":637,"name":638,"published":459,"updated":67},29928,{"tool":621,"engine":622},{"id":105,"name":106},{"id":108,"name":109},{"id":619,"codename":67,"description":67,"severity":140,"risk_description":624,"public_description":625,"public_recommendation":626,"recommendation":67,"references":627,"cvssv3":370,"epss_score":631,"epss_percentile":632,"cve":633,"in_cisa_catalog":20,"date":635,"software_type":67,"vendor":636,"product":636,"ptt_exploit_capabilities":67},"An unauthenticated attacker gains an administrator session in the file manager, giving full read\u002Fwrite access to the server filesystem and leading to remote code execution.","eXtplorer \u003C= 2.1.14 contains an authentication bypass in ext_find_user() (include\u002Fusers.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default \"admin\" account, an unauthenticated attacker can log in as administrator.","Upgrade to a patched eXtplorer release in which ext_find_user() requires a non-null password.",[628,629,630],"https:\u002F\u002Fwww.exploit-db.com\u002Fexploits\u002F51067","https:\u002F\u002Fgithub.com\u002Fsoerennb\u002Fextplorer\u002Fblob\u002Fv2.1.14\u002Finclude\u002Fusers.php","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-54335",0.13662,0.96487,[634],"CVE-2023-54335","2026-01-13T00:00:00Z","extplorer","NETSCAN-NUCLEI-CVE-CVE-2023-54335","eXtplorer \u003C= 2.1.14 - Authentication Bypass"]