new tests
November 14, 2025
Now testing for the following vulnerabilities
New tests built and released by Alfred, our AI Security Researcher:
Haven't met Alfred yet? You can read more about how we're using AI to discover, source, and build tests for CVEs here.
- CVE-2025-2264: Sante PACS Server Path Traversal [8.7 / High]
- CVE-2024-6782: Calibre Python Code Injection [9.3 / Critical]
- CVE-2023-27524: Apache Superset Authentication Bypass [9.3 / Critical]
- CVE-2021-24762: WordPress Plugin "Perfect Survey" 1.5.1 Unauthenticated SQL Injection [9.3 / Critical]
- CVE-2021-22948: Revive Adserver "breakdown" Reflected XSS [6.3 / Medium]
- CVE-2018-6526: MantisBT view_all_bug_page.php Full Path Disclosure [5.3 / Medium]
- CVE-2013-4888: Xibo "layout" Reflected XSS [6.3 / Medium]
- CVE-2011-2757: ManageEngine ServiceDesk Plus and Support Center Plus Path Traversal [6.9 / Medium]
- CVE-2009-4814: Wolfram webMathematica 3 "MSP" Cross-Site Scripting [6.3 / Medium]
- CVE-2008-6493: Easy News Content Management Database Disclosure [6.9 / Medium]
- CVE-2008-5602: Natterchat 1.12 Database Disclosure [6.9 / Medium]
- CVE-2007-6369: WordPress "PictPress" (pictpress) Path Traversal [7.5 / High]
- CVE-2007-5484: WWWISIS 7.1 Path Traversal [5.3 / Medium]
- CVE-2002-0576: ColdFusion on IIS "cfm/dbm" Diagnostic Error Path Disclosure [6.9 / Medium]
New tests released based on submissions by our Detectify Crowdsource hackers:
- CVE-2023-25717: Ruckus Wireless Products CSRF And Remote Code Execution [8.9 / High]
- Fortinet FortiWeb Authentication Bypass [10 / Critical]
- Mailhog Information Disclosure [6.9 / Medium]
- Samsung MagicInfo Exposure [6.9 / Medium]
- CVE-2024-5910: Palo Alto Networks Expedition Authentication Bypass [9.3 / Critical]
- CVE-2023-30258: MagnusBilling Application Unauthenticated Remote Command Execution [9.3 / Critical]
- Microsoft .NET Reflected XSS [6.3 / Medium]
- CVE-2019-8400: Ory Hydra Reflected XSS [6.3 / Medium]
- Ghost CMS Reflected XSS [6.5 / Medium]
Improved security tests:
- CVE-2025-59474: Jenkins Sidepanel Unauthorized Agent and Queue Information Exposure [6.9 / Medium]
- CVE-2025-56520: Dify SSRF [6.9 / Medium]
- CVE-2025-54249: Adobe Experience Manager ≤ 6.5.23.0 SSRF [7.1 / High]
- CVE-2025-36845: Eveo URVE Web Manager SSRF [8.7 / High]
- CVE-2025-34035: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Command Injection Leading To Root Remote Code Execution [9.3 / Critical]
- CVE-2025-32429: XWiki Platform SQL Injection [9.3 / Critical]
- CVE-2025-31486: Vite "server.fs.deny" Path Traversal Leading to File Disclosure [8.7 / High]
- CVE-2025-27817: Apache Kafka Clients Arbitrary File Read And Server-Side Request Forgery [8.7 / High]
- CVE-2025-25257: Fortinet FortiWeb Fabric Connector SQL Injection [9.3 / Critical]
- CVE-2025-24813: Apache Tomcat Path Equivalence Remote Code Execution [9.3 / Critical]
- CVE-2025-24813: Apache Tomcat Path Equivalence Leading to Remote Code Execution [9.3 / Critical]
- CVE-2025-22711: WordPress Plugin "Image Source Control Lite / Show Image Credits and Captions" (image-source-control-isc) Image Credit Output DOM XSS [6.4 / Medium]
- CVE-2025-10645: WordPress Plugin "WP Reset" (wp-reset) Unauthenticated Sensitive Information Disclosure via wf-licensing.log [6.9 / Medium]
- CVE-2025-3472: WordPress Plugin "Ocean Extra" (ocean-extra) Unauthenticated Arbitrary Shortcode Execution Allowing Remote Code Execution [9.3 / Critical]
- CVE-2024-57050: TP-Link WR840N v6 Firmware Authentication Bypass [9.3 / Critical]
- CVE-2024-56159: Astro Sourcemap Exposure [8.7 / High]
- CVE-2024-54152: Angular Expressions RCE [8.8 / High]
- CVE-2024-52875: GFI Kerio Control v9.2.5 CRLF Injection [7.0 / High]
- CVE-2024-51739: Combodo iTop REST Endpoint User Enumeration [6.9 / Medium]
- CVE-2024-41713: Mitel MiCollab Path Traversal [9.3 / Critical]
- CVE-2024-39713: Rocket.Chat Server-Side Request Forgery [8.7 / High]
- CVE-2024-38856: Apache OFBiz Incorrect Authorization Leading to Remote Code Execution [9.3 / Critical]
- CVE-2024-38475: Apache HTTP Server and SonicWall Arbitrary File Read And Improper Escaping Of Output [9.3 / Critical]
- CVE-2024-36991: Splunk Enterprise Path Traversal Leading to Local File Inclusion [8.7 / High]
- CVE-2024-29269: Telesquare "TLR-2005KSH" Remote Command Execution [9.3 / Critical]
- CVE-2024-29059: "Microsoft .NET Framework" "ASP.NET" Remote Code Execution And Information Disclosure [9.3 / Critical]
- CVE-2024-26291: Avid NEXIS LFI [8.7 / High]
- CVE-2024-24919: Check Point Quantum Security Gateways Arbitrary File Read [9.2 / Critical]
- CVE-2024-22207: Fastify Swagger-UI Information Disclosure [6.9 / Medium]
- CVE-2024-10585: WordPress Plugin "InfiniteWP Client" (iwp-client) Unauthenticated Path Traversal [6.9 / Medium]
- CVE-2024-10486: WordPress Plugin "Google for WooCommerce" (google-listings-and-ads) Unauthenticated Information Disclosure via publicly accessible phpinfo.php [6.9 / Medium]
- CVE-2024-7714: WordPress Plugin "AI ChatBot with ChatGPT and Content Generator by AYS" (ays-chatgpt-assistant) <= 2.0.9 Improper Access Control Via Unauthenticated AJAX [6.9 / Medium]
- CVE-2024-7332: TOTOLINK CP450 Firmware Hard-Coded Credentials [9.3 / Critical]
- CVE-2024-6646: Netgear WN604 "downloadFile.php" Information Disclosure [6.9 / Medium]
- CVE-2024-4956: Sonatype Nexus Repository Manager 3 Local File Inclusion [7.7 / High]
- CVE-2024-4882: Sitefinity Open Redirect [5.1 / Medium]
- CVE-2024-3273: D-Link NAS Backdoor Remote Code Execution And Command Injection [9.3 / Critical]
- CVE-2024-3272: D-Link NAS Hard-Coded Credentials Backdoor And Remote Code Execution [9.3 / Critical]
- CVE-2024-3097: WordPress Plugin "Photo Gallery, Sliders, Proofing and Themes / NextGEN Gallery" (nextgen-gallery) Unauthenticated Information Disclosure via Public Gallery Endpoints [6.9 / Medium]
- CVE-2023-50968: Apache OFBiz Server Side Request Forgery [8.8 / High]
- CVE-2023-43472: MLflow < 2.8.1 Sensitive Information Disclosure [6.9 / Medium]
- CVE-2023-42442: JumpServer > 3.6.4 Information Disclosure [6.9 / Medium]
- CVE-2023-41763: Microsoft Skype for Business Server-Side Request Forgery And Privilege Escalation [6.9 / Medium]
- CVE-2023-41266: Qlik Sense Path Traversal [6.9 / Medium]
- CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass [9.3 / Critical]
- CVE-2023-22232: Adobe Connect < 12.1.5 Local File Disclosure [6.9 / Medium]
- CVE-2023-6020: Ray Static Local File Inclusion And Arbitrary File Read [8.7 / High]
- CVE-2023-3188: Owncast Server-Side Request Forgery [7.9 / High]
- CVE-2022-41697: Ghost Information Disclosure [5.5 / Medium]
- CVE-2022-40870: Parallels RAS Open Redirect [6.9 / Medium]
- CVE-2022-37122: Carel pCOWeb HVAC BACnet Gateway 2.1.0 Path Traversal and Local File Inclusion [8.7 / High]
- CVE-2022-35914: GLPI htmLawed Remote Code Execution [9.3 / Critical]
- CVE-2022-31132: Nextcloud Server Side Request Forgery [7.9 / High]
- CVE-2022-23808: "phpMyAdmin" < 5.1.2 Cross-Site Scripting [6.3 / Medium]
- CVE-2022-22965: Spring Framework (Spring4Shell) JDK 9+ Remote Code Execution [9.3 / Critical]
- CVE-2022-22965: Spring Framework Spring4Shell Remote Code Execution [9.3 / Critical]
- CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution [9.3 / Critical]
- CVE-2022-4057: WordPress Plugin "Autoptimize" (autoptimize) < 3.1.0 Sensitive Data Disclosure [6.9 / Medium]
- CVE-2022-2487: "Wavlink WN535K2/WN535K3" OS Command Injection [9.3 / Critical]
- CVE-2022-1390: WordPress Plugin "Admin Word Count Column" ("admin-word-count-column") Path Traversal Leading To Local File Inclusion [8.7 / High]
- CVE-2021-44228: Apache Log4j2 "Log4Shell" Remote Code Execution [10.0 / Critical]
- CVE-2021-43798: Grafana Path Traversal [8.7 / High]
- CVE-2021-42071: Visual Tools "DVR VX16" 4.2.28.0 Unauthenticated OS Command Injection [9.3 / Critical]
- CVE-2021-42013: Apache HTTP Server Path Traversal [6.9 / Medium]
- CVE-2021-41773: Apache HTTP Server Path Traversal [8.7 / High]
- CVE-2021-41097: NPM Aurelia-Path Prototype Pollution [7.8 / High]
- CVE-2021-39165: Cachet <=2.3.18 Pre-Authenticated SQL Injection [7.1 / High]
- CVE-2021-37580: Apache ShenYu Admin JWT Authentication Bypass [9.3 / Critical]
- CVE-2021-37573: Tiny Java Web Server Servlet Container Cross-Site Scripting [6.3 / Medium]
- CVE-2021-32820: Express-Handlebars Local File Inclusion [9.2 / Critical]
- CVE-2021-32588: FortiPortal Authentication Bypass and RCE [9.3 / Critical]
- CVE-2021-31195: Microsoft Exchange Server Cross-Site Scripting [8.6 / High]
- CVE-2021-29622: Prometheus Open Redirect [6.9 / Medium]
- CVE-2021-26855: Microsoft Exchange Server SSRF And Remote Code Execution [9.3 / Critical]
- CVE-2021-26247: Cacti Cross-Site Scripting [6.3 / Medium]
- CVE-2021-26084: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Remote Code Execution [10.0 / Critical]
- CVE-2021-25118: WordPress Plugin "Yoast SEO / Advanced SEO with real-time guidance and built-in AI" (wordpress-seo) < 17.3 Unauthenticated Full Path Disclosure [6.9 / Medium]
- CVE-2021-24226: WordPress Plugin AccessAlly ("access-ally") Prior To 3.5.7 Environment Variables Disclosure [8.7 / High]
- CVE-2021-24073: Skype for Business processMessage XSS [7.8 / High]
- CVE-2021-23435: Ruby on Rails Clearance Open Redirect [6.3 / Medium]
- CVE-2021-22502: OpenText/Micro Focus Operations Bridge Report (OBR) Remote Code Execution [9.3 / Critical]
- CVE-2021-22145: Elasticsearch Memory Disclosure [5.1 / Medium]
- CVE-2021-21972: VMware vCenter Server vSphere Client (HTML5) Remote Code Execution [9.3 / Critical]
- CVE-2021-21311: Adminer Server-Side Request Forgery [7.8 / High]
- CVE-2021-20123: Draytek VigorConnect Path Traversal and Local File Inclusion [8.7 / High]
- CVE-2021-4191: GitLab GraphQL API User Enumeration [6.9 / Medium]
- CVE-2020-36289: Atlassian Jira Server And Data Center Unauthenticated User Enumeration And Information Disclosure [6.9 / Medium]
- CVE-2020-35848: Agentejo Cockpit (Cockpit CMS) <0.12.0 NoSQL Injection [9.3 / Critical]
- CVE-2020-35847: Agentejo Cockpit CMS NoSQL Injection [9.3 / Critical]
- CVE-2020-27982: IceWarp WebMail Cross-Site Scripting [7.8 / High]
- CVE-2020-27838: Keycloak Information Exposure [6.9 / Medium]
- CVE-2020-25540: ThinkAdmin 6 Local File Inclusion Leading To Arbitrary File Read [8.7 / High]
- CVE-2020-19363: Vtiger CRM Directory Listing [6.9 / Medium]
- CVE-2020-14179: Atlassian Jira Server/Data Center "<8.5.8, 8.6.0-8.11.1" Information Disclosure [6.9 / Medium]
- CVE-2020-13959: Velocity XSS [6.3 / Medium]
- CVE-2020-13167: Netsweeper "WebAdmin" "unixlogin.php" Python Code Injection Leading To Remote Code Execution [9.3 / Critical]
- CVE-2020-11991: Apache Cocoon 2.1.12 XML External Entity [8.7 / High]
- CVE-2020-11529: Grav < 1.7 Open Redirect [6.3 / Medium]
- CVE-2020-10549: rConfig <=3.9.4 SQL Injection [9.3 / Critical]
- CVE-2020-9496: Apache OFBiz Reflected XSS [6.3 / Medium]
- CVE-2020-8194: Citrix ADC and NetScaler Gateway Remote Code Injection [6.9 / Medium]
- CVE-2020-8193: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authentication and Authorization Bypass, Arbitrary File Read [6.9 / Medium]
- CVE-2020-7115: Aruba ClearPass Policy Manager 6.7.0 Remote Code Execution [9.3 / Critical]
- CVE-2020-5847: Unraid Remote Code Execution [9.3 / Critical]
- CVE-2020-5284: Next.js "<9.3.2" Path Traversal Leading To Local File Inclusion [4.8 / Medium]
- CVE-2019-19781: Citrix ADC, Gateway, And SD-WAN WANOP Path Traversal And Remote Code Execution [9.3 / Critical]
- CVE-2019-19368: Rumpus FTP Web File Manager Login Page Cross-Site Scripting [7.8 / High]
- CVE-2019-17574: WordPress Plugin "Popup Maker / Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder" (popup-maker) AJAX Authentication Bypass Allowing Unauthenticated Arbitrary Function Calls [2.7 / Low]
- CVE-2019-15889: WordPress Plugin "Download Manager" (download-manager) Reflected XSS via download parameter [6.3 / Medium]
- CVE-2019-14996: Atlassian Jira XSS [6.3 / Medium]
- CVE-2019-14974: SugarCRM Enterprise 9.0.0 XSS [6.3 / Medium]
- CVE-2019-14322: Odoo, Pallets Werkzeug (<0.15.5) Local File Inclusion [8.7 / High]
- CVE-2019-13335: SuiteCRM (SalesAgility) and SugarCRM CE Server-Side Request Forgery [9.3 / Critical]
- CVE-2019-12276: GrandNode 4.40 Path Traversal And Arbitrary File Download Leading To Local File Inclusion [6.9 / Medium]
- CVE-2019-11600: OpenProject 5.0.0-8.3.1 Unauthenticated SQL Injection [8.7 / High]
- CVE-2019-11510: Ivanti Pulse Connect Secure Path Traversal Arbitrary File Read [8.7 / High]
- CVE-2019-9184: Joomla! Component J2Store SQL Injection [9.3 / Critical]
- CVE-2019-7481: SonicWall SMA 100 SQL Injection [8.7 / High]
- CVE-2019-5447: NPM http-file-server Directory Listing [8.7 / High]
- CVE-2019-3929: "Barco WePresent" "file_transfer.cgi" Remote Code Execution and "Crestron Multiple Products" Command Injection [9.3 / Critical]
- CVE-2018-18809: TIBCO JasperReports Library Directory Traversal [6.9 / Medium]
- CVE-2018-18323: CentOS Web Panel 0.9.8.480 Local File Inclusion [6.9 / Medium]
- CVE-2018-11759: JK Status Manager Bypass [10.0 / Critical]
- CVE-2018-8024: Apache Spark UI Cross-Site Scripting [6.2 / Medium]
- CVE-2018-8006: Apache ActiveMQ "<=5.15.5" Reflected XSS [6.9 / Medium]
- CVE-2018-7251: Anchor CMS Error Log Exposure [9.3 / Critical]
- CVE-2018-6015: WordPress "Email Subscribers & Newsletters / Powerful Email Marketing, Post Notification & Newsletter Plugin for WordPress & WooCommerce" (email-subscribers) Unauthenticated Subscriber Data Disclosure via public API endpoint [8.7 / High]
- CVE-2018-3760: Ruby On Rails Path Traversal Leading To Local File Inclusion [8.7 / High]
- CVE-2017-12611: Apache Struts2 S2-053 Remote Code Execution [9.3 / Critical]
- CVE-2017-10075: Oracle Content Server Cross-Site Scripting [7.8 / High]
- CVE-2017-9506: Atlassian Jira IconURIServlet/OAuth Server-Side Request Forgery [7.8 / High]
- CVE-2017-5868: OpenVPN Access Server CRLF Injection [6.3 / Medium]
- CVE-2017-5616: cPanel Reflected XSS [7.8 / High]
- CVE-2017-5615: cPanel CRLF Injection [7.2 / High]
- CVE-2017-5614: cPanel Open Redirect [4.4 / Medium]
- CVE-2016-6601: WebNMS Framework Server Path Traversal Allowing Arbitrary Text File Download [8.7 / High]
- CVE-2016-3081: Apache Struts Dynamic Method Invocation Remote Code Execution [9.2 / Critical]
- CVE-2015-9481: Diplomat Theme <= 1.0.1 Sensitive Information Disclosure [6.9 / Medium]
- CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution [9.3 / Critical]
- CVE-2013-1965: Apache Struts2 S2-012 Remote Code Execution [9.5 / Critical]
- CVE-2012-0392: Apache Struts2 S2-008 Remote Code Execution [7.1 / High]
- CVE-2008-0332: Aria 0.99-6 "page" Local File Inclusion [8.7 / High]
- CVE-2007-1355: Apache Tomcat 6.0.10 Documentation Sample Application IE-Only Reflected XSS [6.3 / Medium]
- CVE-2007-0885: Atlassian Jira "Rainbow.Zen" Reflected XSS [7.8 / High]
- Path Traversal [6.9 / Medium]
- cPanel Path Traversal [7.5 / High]
Thanks for your feedback