Vulnerabilities with Nuclei Scanner Templates
Updated 3h agoSearch and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.
4,077 results
Clear all
CVE-2025-27225
7.5
HIGH
1 Writeup
NUCLEI
EPSS 0.22
TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.
CWE-200
Oct 27, 2025
CVE-2025-27223
7.5
HIGH
EXPLOITED
1 Writeup
NUCLEI
EPSS 0.06
TRUfusion Enterprise <= 7.10.4.0 - Authentication Bypass
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
CWE-1004
Oct 27, 2025
CVE-2025-27222
8.6
HIGH
EXPLOITED
1 Writeup
NUCLEI
EPSS 0.05
TRUfusion Enterprise <= 7.10.4.0 - Path Traversal
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
CWE-22
Oct 27, 2025
CVE-2025-12055
7.5
HIGH
EXPLOITED
NUCLEI
EPSS 0.22
MPDV Mikrolab GmbH - Info Disclosure
HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.
CWE-22
Oct 27, 2025
CVE-2025-5605
4.3
MEDIUM
EXPLOITED
NUCLEI
EPSS 0.05
Wso2 API Control Plane - Authentication Bypass by Spoofing
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.
The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.
CWE-290
Oct 24, 2025
CVE-2025-8848
5.4
MEDIUM
NUCLEI
EPSS 0.00
Librechat - Code Injection
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.
CWE-94
Oct 22, 2025
CVE-2025-11750
5.3
MEDIUM
1 PoC
Analysis
NUCLEI
EPSS 0.00
langgenius/dify-web <1.6.0 - Info Disclosure
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found." Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks.
CWE-544
Oct 22, 2025
CVE-2025-61757
9.8
CRITICAL
KEV
3 PoCs
Analysis
NUCLEI
EPSS 0.88
Oracle Identity Manager - Missing Authentication
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CWE-306
Oct 21, 2025
CVE-2025-62522
MEDIUM
1 Writeup
NUCLEI
EPSS 0.01
NPM Vite < 7.1.11 - Path Traversal
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
CWE-22
Oct 20, 2025
CVE-2025-59287
9.8
CRITICAL
KEV
RANSOMWARE
25 PoCs
Analysis
NUCLEI
EPSS 0.74
Microsoft Windows Server 2012 - Insecure Deserialization
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
CWE-502
Oct 14, 2025
CVE-2025-61884
7.5
HIGH
KEV
RANSOMWARE
4 PoCs
Analysis
NUCLEI
EPSS 0.61
Oracle Configurator < 12.2.14 - SSRF
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CWE-93
Oct 12, 2025
CVE-2025-9196
5.3
MEDIUM
2 PoCs
Analysis
NUCLEI
EPSS 0.00
Trinity Audio - Text to Speech AI <5.21.0 - Info Disclosure
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.
CWE-200
Oct 11, 2025
CVE-2025-11580
5.3
MEDIUM
NUCLEI
EPSS 0.02
Powerjob < 5.1.2 - Incorrect Authorization
A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CWE-863
Oct 10, 2025
CVE-2025-11371
7.5
HIGH
KEV
2 PoCs
Analysis
NUCLEI
EPSS 0.68
Gladinet CentreStack/Triofox Path Traversal
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CWE-552
Oct 09, 2025
CVE-2025-10353
CRITICAL
EXPLOITED
2 PoCs
1 Writeup
Analysis
NUCLEI
EPSS 0.01
Melisplatform Melis-cms-slider < 5.3.1 - Remote Code Execution
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
CWE-43
Oct 08, 2025
CVE-2025-52472
CRITICAL
EXPLOITED
1 PoC
1 Writeup
Analysis
NUCLEI
EPSS 0.00
Org.xwiki.platform Xwiki-platform-rest-server < 17.4.2 - SQL Injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.
CWE-89
Oct 06, 2025
CVE-2025-61882
9.8
CRITICAL
KEV
RANSOMWARE
18 PoCs
Analysis
NUCLEI
EPSS 0.89
Oracle E-Business Suite CVE-2025-61882 RCE
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CWE-287
Oct 05, 2025
CVE-2025-49844
9.9
CRITICAL
EXPLOITED
RANSOMWARE
24 PoCs
Analysis
NUCLEI
EPSS 0.14
Redis < 6.2.20 - Use After Free
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CWE-416
Oct 03, 2025
CVE-2025-46819
6.3
MEDIUM
1 Writeup
NUCLEI
EPSS 0.05
Redis <8.2.2 - DoS
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
CWE-190
Oct 03, 2025
CVE-2025-46818
6.0
MEDIUM
1 Writeup
NUCLEI
EPSS 0.03
Redis <8.2.2 - RCE
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
CWE-94
Oct 03, 2025