Exploit-DB
989122095f
DB: 2025-04-04
...
11 changes to exploits/shellcodes/ghdb
AppSmith 1.47 - Remote Code Execution (RCE)
ollama 0.6.4 - Server Side Request Forgery (SSRF)
Vite 6.2.2 - Arbitrary File Read
ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated)
Nagios Log Server 2024R1.3.1 - Stored XSS
Webmin Usermin 2.100 - Username Enumeration
ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials
openSIS 9.1 - SQLi (Authenticated)
Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure
ProSSHD 1.2 - Denial of Service (DOS)
2025-04-04 00:16:25 +00:00
Exploit-DB
c773b14d1c
DB: 2025-04-03
...
6 changes to exploits/shellcodes/ghdb
Mitel mitel-cs018 - Call Data Information Disclosure
SAP NetWeaver - 7.53 - HTTP Request Smuggling
ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
ABB Cylon Aspect 3.08.01 - Arbitrary File Delete
Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
ProSSHD 1.2 - Denial of Service (DOS)
2025-04-03 00:16:28 +00:00
Exploit-DB
353059c64d
DB: 2025-03-29
...
6 changes to exploits/shellcodes/ghdb
Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
Sonatype Nexus Repository 3.53.0-01 - Path Traversal
CodeCanyon RISE CRM 3.7.0 - SQL Injection
Litespeed Cache 6.5.0.1 - Authentication Bypass
Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)
2025-03-29 00:16:38 +00:00
Exploit-DB
15b516383f
DB: 2025-03-28
...
4 changes to exploits/shellcodes/ghdb
KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)
MoziloCMS 3.0 - Remote Code Execution (RCE)
X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
2025-03-28 00:16:32 +00:00
Exploit-DB
04fa5ba95d
DB: 2025-03-20
...
6 changes to exploits/shellcodes/ghdb
Gitea 1.24.0 - HTML Injection
Extensive VC Addons for WPBakery page builder 1.9.0 - Remote Code Execution (RCE)
Loaded Commerce 6.6 - Client-Side Template Injection(CSTI)
TranzAxis 3.2.41.10.26 - Stored Cross-Site Scripting (XSS) (Authenticated)
VeeVPN 1.6.1 - Unquoted Service Path
2025-03-20 00:16:32 +00:00
Exploit-DB
b86fb6e1b7
DB: 2024-10-02
...
4 changes to exploits/shellcodes/ghdb
dizqueTV 1.5.3 - Remote Code Execution (RCE)
reNgine 2.2.0 - Command Injection (Authenticated)
openSIS 9.1 - SQLi (Authenticated)
2024-10-02 00:16:50 +00:00
Exploit-DB
32e0cc5e7f
DB: 2024-08-29
...
5 changes to exploits/shellcodes/ghdb
Gitea 1.22.0 - Stored XSS
NoteMark < 0.13.0 - Stored XSS
Invesalius3 - Remote Code Execution
Windows TCP/IP - RCE Checker and Denial of Service
2024-08-29 00:16:41 +00:00
Exploit-DB
809d81619e
DB: 2024-08-24
...
4 changes to exploits/shellcodes/ghdb
Calibre-web 0.6.21 - Stored XSS
Helpdeskz v2.0.2 - Stored XSS
2024-08-24 00:16:35 +00:00
Exploit-DB
507bd26e3e
DB: 2024-08-05
...
6 changes to exploits/shellcodes/ghdb
Ivanti vADC 9.9 - Authentication Bypass
Devika v1 - Path Traversal via 'snapshot_path'
Genexus Protection Server 9.7.2.10 - 'protsrvservice' Unquoted Service Path
Oracle Database 12c Release 1 - Unquoted Service Path
SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path
2024-08-05 00:16:24 +00:00
Exploit-DB
859e322e5c
DB: 2024-07-03
...
13 changes to exploits/shellcodes/ghdb
ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) & SSH Access
Zyxel IKE Packet Decoder - Unauthenticated Remote Code Execution (Metasploit)
Rebar3 3.13.2 - Command Injection
Craft CMS Logs Plugin 3.0.3 - Path Traversal (Authenticated)
ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure
2024-07-03 00:16:27 +00:00
Exploit-DB
2680e71d44
DB: 2024-06-27
...
5 changes to exploits/shellcodes/ghdb
SolarWinds Platform 2024.1 SR1 - Race Condition
Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)
Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
Poultry Farm Management System v1.0 - Remote Code Execution (RCE)
2024-06-27 00:16:25 +00:00
Exploit-DB
1064b5c455
DB: 2024-06-15
...
12 changes to exploits/shellcodes/ghdb
Zyxel IKE Packet Decoder - Unauthenticated Remote Code Execution (Metasploit)
Rebar3 3.13.2 - Command Injection
AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability.
AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS)
AEGON LIFE v1.0 Life Insurance Management System - Unauthenticated Remote Code Execution (RCE)
Boelter Blue System Management 1.3 - SQL Injection
Carbon Forum 5.9.0 - Stored XSS
PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows)
WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated)
XMB 1.9.12.06 - Stored XSS
ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
2024-06-15 00:16:21 +00:00
Exploit-DB
8a32e340d5
DB: 2024-06-04
...
8 changes to exploits/shellcodes/ghdb
Sitefinity 15.0 - Cross-Site Scripting (XSS)
appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated)
CMSimple 5.15 - Remote Code Execution (RCE) (Authenticated)
Dotclear 2.29 - Remote Code Execution (RCE)
Monstra CMS 3.0.4 - Remote Code Execution (RCE)
Serendipity 2.5.0 - Remote Code Execution (RCE)
WBCE CMS v1.6.2 - Remote Code Execution (RCE)
2024-06-04 00:16:25 +00:00
Exploit-DB
3ac07794c9
DB: 2024-06-01
...
7 changes to exploits/shellcodes/ghdb
Aquatronica Control System 5.1.6 - Information Disclosure
Check Point Security Gateway - Information Disclosure (Unauthenticated)
changedetection < 0.45.20 - Remote Code Execution (RCE)
BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection
ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)
iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
2024-06-01 00:16:48 +00:00
Exploit-DB
9d17a3d6ca
DB: 2024-05-14
...
10 changes to exploits/shellcodes/ghdb
CrushFTP < 11.1.0 - Directory Traversal
Apache mod_proxy_cluster - Stored XSS
CE Phoenix Version 1.0.8.20 - Stored XSS
Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
Prison Management System - SQL Injection Authentication Bypass
PyroCMS v3.0.1 - Stored XSS
Plantronics Hub 3.25.1 - Arbitrary File Read
2024-05-14 00:16:26 +00:00
Exploit-DB
edacab1df2
DB: 2024-05-09
...
3 changes to exploits/shellcodes/ghdb
iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)
Clinic Queuing System 1.0 - RCE
2024-05-09 00:16:23 +00:00
Exploit-DB
aa67db6cea
DB: 2024-04-13
...
15 changes to exploits/shellcodes/ghdb
MinIO < 2024-01-31T20-20-33Z - Privilege Escalation
PrusaSlicer 2.6.1 - Arbitrary code execution
GUnet OpenEclass E-learning platform 3.15 - 'certbadge.php' Unrestricted File Upload
HTMLy Version v2.9.6 - Stored XSS
Moodle 3.10.1 - Authenticated Blind Time-Based SQL Injection - _sort_ parameter
PopojiCMS Version 2.0.1 - Remote Command Execution
Quick CMS v6.7 en 2023 - 'password' SQLi
Service Provider Management System v1.0 - SQL Injection
WBCE 1.6.0 - Unauthenticated SQL injection
WBCE CMS Version 1.6.1 - Remote Command Execution (Authenticated)
Wordpress Plugin Playlist for Youtube 1.32 - Stored Cross-Site Scripting (XSS)
Wordpress Plugin WP Video Playlist 1.1.1 - Stored Cross-Site Scripting (XSS)
Ray OS v2.6.3 - Command Injection RCE(Unauthorized)
Terratec dmx_6fire USB - Unquoted Service Path
2024-04-13 00:16:27 +00:00
Exploit-DB
e791587e41
DB: 2024-03-29
...
10 changes to exploits/shellcodes/ghdb
RouterOS 6.40.5 - 6.44 and 6.48.1 - 6.49.10 - Denial of Service
Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure
Dell Security Management Server <1.9.0 - Local Privilege Escalation
Asterisk AMI - Partial File Content & Path Disclosure (Authenticated)
Broken Access Control - on NodeBB v3.6.7
liveSite Version 2019.1 - Remote Code Execution
Purei CMS 1.0 - SQL Injection
Workout Journal App 1.0 - Stored XSS
WinRAR version 6.22 - Remote Code Execution via ZIP archive
2024-03-29 00:16:30 +00:00
Exploit-DB
c9576b1787
DB: 2024-03-26
...
11 changes to exploits/shellcodes/ghdb
LBT-T300-mini1 - Remote Buffer Overflow
Nagios XI Version 2024R1.01 - SQL Injection
Craft CMS 4.4.14 - Unauthenticated Remote Code Execution
Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS
LimeSurvey Community 5.3.32 - Stored XSS
MobileShop master v1.0 - SQL Injection Vuln.
SPA-CART CMS - Stored XSS
Tourism Management System v2.0 - Arbitrary File Upload
Wallos < 1.11.2 - File Upload RCE
2024-03-26 00:16:32 +00:00
Exploit-DB
bbffa273d4
DB: 2024-03-19
...
13 changes to exploits/shellcodes/ghdb
TELSAT marKoni FM Transmitter 1.9.5 - Backdoor Account Information Disclosure
TELSAT marKoni FM Transmitter 1.9.5 - Insecure Access Control Change Password
TELSAT marKoni FM Transmitter 1.9.5 - Root Command Injection
Atlassian Confluence < 8.5.3 - Remote Code Execution
Backdrop CMS 1.23.0 - Stored XSS
Gibbon LMS < v26.0.00 - Authenticated RCE
Quick.CMS 6.7 - SQL Injection Login Bypass
TYPO3 11.5.24 - Path Traversal (Authenticated)
WEBIGniter v28.7.23 - Stored XSS
WordPress File Upload Plugin < 4.23.3 - Stored XSS
xbtitFM 4.1.18 - Multiple Vulnerabilities
ZoneMinder Snapshots < 1.37.33 - Unauthenticated RCE
2024-03-19 00:16:26 +00:00
Exploit-DB
8c78d80c78
DB: 2024-03-17
...
7 changes to exploits/shellcodes/ghdb
Karaf v4.4.3 Console - RCE
Nokia BMC Log Scanner - Remote Code Execution
vm2 - sandbox escape
UPS Network Management Card 4 - Path Traversal
Winter CMS 1.2.3 - Server-Side Template Injection (SSTI) (Authenticated)
LaborOfficeFree 19.10 - MySQL Root Password Calculator
2024-03-17 00:16:40 +00:00
Exploit-DB
98f7ce18e2
DB: 2024-03-13
...
8 changes to exploits/shellcodes/ghdb
Cisco Firepower Management Center < 6.6.7.1 - Authenticated RCE
VMware Cloud Director 10.5 - Bypass identity verification
OSGi v3.7.2 (and below) Console - RCE
OSGi v3.8-3.18 Console - RCE
SnipeIT 6.2.1 - Stored Cross Site Scripting
Client Details System 1.0 - SQL Injection
Human Resource Management System 1.0 - 'employeeid' SQL Injection
2024-03-13 00:16:28 +00:00
Exploit-DB
ce58678266
DB: 2024-03-12
...
7 changes to exploits/shellcodes/ghdb
Sitecore - Remote Code Execution v8.2
Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore < 14.8.7825.01 - IDOR
Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read
WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover
Microsoft Windows Defender / Trojan.Win32/Powessere.G - Detection Mitigation Bypass
2024-03-12 00:16:25 +00:00
Exploit-DB
7ef8e488d8
DB: 2024-03-04
...
22 changes to exploits/shellcodes/ghdb
GL.iNet AR300M v3.216 Remote Code Execution - CVE-2023-46456 Exploit
GL.iNet AR300M v4.3.7 Arbitrary File Read - CVE-2023-46455 Exploit
GL.iNet AR300M v4.3.7 Remote Code Execution - CVE-2023-46454 Exploit
Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated)
R Radio Network FM Transmitter 1.07 system.cgi - Password Disclosure
TitanNit Web Control 2.01 / Atemio 7600 - Root Remote Code Execution
TPC-110W - Missing Authentication for Critical Function
A-PDF All to MP3 Converter 2.0.0 - DEP Bypass via HeapCreate + HeapAlloc
Easywall 0.3.1 - Authenticated Remote Command Execution
Magento ver. 2.4.6 - XSLT Server Side Injection
AC Repair and Services System v1.0 - Multiple SQL Injection
Enrollment System v1.0 - SQL Injection
Petrol Pump Management Software v.1.0 - SQL Injection
Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file
Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting
Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload
Real Estate Management System v1.0 - Remote Code Execution via File Upload
Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection
Simple Student Attendance System v1.0 - Time Based Blind SQL Injection
Boss Mini 1.4.0 - local file inclusion
Windows PowerShell - Event Log Bypass Single Quote Code Execution
2024-03-04 00:16:34 +00:00
Exploit-DB
c1bcfc6347
DB: 2024-02-28
...
13 changes to exploits/shellcodes/ghdb
TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution
TEM Opera Plus FM Family Transmitter 35.45 - XSRF
Executables Created with perl2exe < V30.10C - Arbitrary Code Execution
Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit)
Automatic-Systems SOC FL9600 FastLine - Directory Transversal
Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin
dawa-pharma 1.0-2022 - Multiple-SQLi
Moodle 4.3 - Insecure Direct Object Reference
Moodle 4.3 - Reflected XSS
SuperStoreFinder - Multiple Vulnerabilities
Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)
Zoo Management System 1.0 - Unauthenticated RCE
2024-02-28 00:16:32 +00:00
Exploit-DB
9734fcef1e
DB: 2024-02-27
...
12 changes to exploits/shellcodes/ghdb
Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS'
Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration
Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure'
FAQ Management System v1.0 - 'faq' SQL Injection
Flashcard Quiz App v1.0 - 'card' SQL Injection
Simple Inventory Management System v1.0 - 'email' SQL Injection
comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset
Online Shopping System Advanced - Sql Injection
taskhub 2.8.7 - SQL Injection
IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
2024-02-27 00:16:33 +00:00
Exploit-DB
ba28fce174
DB: 2024-02-20
...
9 changes to exploits/shellcodes/ghdb
SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration
Wondercms 4.3.2 - XSS to RCE
Employee Management System v1 - 'email' SQL Injection
JFrog Artifactory < 7.25.4 - Blind SQL Injection
phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit
XAMPP - Buffer Overflow POC
Microsoft Windows Defender - VBScript Detection Bypass
Microsoft Windows Defender Bypass - Detection Mitigation Bypass
2024-02-20 00:16:25 +00:00
Exploit-DB
bdcc81a451
DB: 2024-02-16
...
4 changes to exploits/shellcodes/ghdb
DS Wireless Communication - Remote Code Execution
Metabase 0.46.6 - Pre-Auth Remote Code Execution
SISQUALWFM 7.1.319.103 - Host Header Injection
2024-02-16 00:16:25 +00:00
Exploit-DB
5c0c152cec
DB: 2024-02-14
...
6 changes to exploits/shellcodes/ghdb
VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) - Remote Denial Of Service
Splunk 9.0.4 - Information Disclosure
Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over
ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure
2024-02-14 00:16:18 +00:00
Exploit-DB
a846c2fd3a
DB: 2024-02-10
...
8 changes to exploits/shellcodes/ghdb
Zyxel zysh - Format string
Elasticsearch - StackOverflow DoS
Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site Scripting (XSS) (Authenticated)
Online Nurse Hiring System 1.0 - Time-Based SQL Injection
Rail Pass Management System 1.0 - Time-Based SQL Injection
Wordpress Augmented-Reality - Remote Code Execution Unauthenticated
Wordpress Seotheme - Remote Code Execution Unauthenticated
2024-02-10 00:16:32 +00:00
Exploit-DB
0c65b881ba
DB: 2024-02-06
...
10 changes to exploits/shellcodes/ghdb
Milesight Routers UR5X_ UR32L_ UR32_ UR35_ UR41 - Credential Leakage Through Unprotected System Logs and Weak Password Encryption
WhatsUp Gold 2022 (22.1.0 Build 39) - XSS
Clinic's Patient Management System 1.0 - Unauthenticated RCE
Curfew e-Pass Management System 1.0 - FromDate SQL Injection
GYM MS - GYM Management System - Cross Site Scripting (Stored)
MISP 2.4.171 - Stored XSS
TASKHUB-2.8.8 - XSS-Reflected
Wordpress 'simple urls' Plugin < 115 - XSS
2024-02-06 00:16:29 +00:00
Exploit-DB
2aed99237c
DB: 2024-02-01
...
8 changes to exploits/shellcodes/ghdb
Proxmox VE - TOTP Brute Force
RoyalTSX 6.0.1 - RTSZ File Handling Heap Memory Corruption PoC
GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities
101 News 1.0 - Multiple-SQLi
Academy LMS 6.2 - Reflected XSS
Academy LMS 6.2 - SQL Injection
Grocy <=4.0.2 - CSRF
2024-02-01 00:16:32 +00:00
Exploit-DB
f3649a641f
DB: 2023-10-10
...
24 changes to exploits/shellcodes/ghdb
Minio 2022-07-29T19-40-48Z - Path traversal
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service
Atcom 2.7.x.x - Authenticated Command Injection
Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE)
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction
OpenPLC WebServer 3 - Denial of Service
Splunk 9.0.5 - admin account take over
BoidCMS v2.0.0 - authenticated file upload vulnerability
Cacti 1.2.24 - Authenticated command injection when using SNMP options
Chitor-CMS v1.1.2 - Pre-Auth SQL Injection
Clcknshop 1.0.0 - SQL Injection
Coppermine Gallery 1.6.25 - RCE
Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
GLPI GZIP(Py3) 9.4.5 - RCE
Limo Booking Software v1.0 - CORS
Media Library Assistant Wordpress Plugin - RCE and LFI
Online ID Generator 1.0 - Remote Code Execution (RCE)
Shuttle-Booking-Software v1.0 - Multiple-SQLi
Webedition CMS v2.9.8.8 - Blind SSRF
WEBIGniter v28.7.23 File Upload - Remote Code Execution
Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation
Wordpress Sonaar Music Plugin 4.7 - Stored XSS
Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
2023-10-10 00:16:32 +00:00
Exploit-DB
cbe784b087
DB: 2023-09-09
...
16 changes to exploits/shellcodes/ghdb
Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS
Drupal 10.1.2 - web-cache-poisoning-External-service-interaction
Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure
soosyze 2.0.0 - File Upload
SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection
Wordpress Plugin Elementor 3.5.5 - Iframe Injection
Wp2Fac - OS Command Injection
Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
SyncBreeze 15.2.24 - 'login' Denial of Service
GOM Player 2.3.90.5360 - Buffer Overflow (PoC)
GOM Player 2.3.90.5360 - Remote Code Execution (RCE)
Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes)
2023-09-09 00:16:33 +00:00
Exploit-DB
4e246a01fb
DB: 2023-09-05
...
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
2023-09-05 00:16:27 +00:00
Exploit-DB
69f3ee7722
DB: 2023-08-09
...
8 changes to exploits/shellcodes/ghdb
Lucee 5.4.2.17 - Authenticated Reflected XSS
Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
Emagic Data Center Management Suite v6.0 - OS Command Injection
mooSocial 3.1.8 - Reflected XSS
PHPJabbers Vacation Rental Script 4.0 - CSRF
Social-Commerce 3.1.6 - Reflected XSS
Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
2023-08-09 00:16:24 +00:00
Exploit-DB
010e679abe
DB: 2023-08-05
...
25 changes to exploits/shellcodes/ghdb
ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)
Shelly PRO 4PM v0.11.0 - Authentication Bypass
Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
Academy LMS 6.0 - Reflected XSS
Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload
JLex GuestBook 1.6.4 - Reflected XSS
Joomla JLex Review 6.0.1 - Reflected XSS
News Portal v4.0 - SQL Injection (Unauthorized)
PHPJabbers Cleaning Business 1.0 - Reflected XSS
PHPJabbers Night Club Booking 1.0 - Reflected XSS
PHPJabbers Rental Property Booking 2.0 - Reflected XSS
PHPJabbers Service Booking Script 1.0 - Reflected XSS
PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
PHPJabbers Taxi Booking 2.0 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webutler v3.2 - Remote Code Execution (RCE)
WordPress adivaha Travel Plugin 2.3 - Reflected XSS
WordPress adivaha Travel Plugin 2.3 - SQL Injection
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS
Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)
2023-08-05 00:16:32 +00:00
Exploit-DB
c18d9953a2
DB: 2023-07-29
...
22 changes to exploits/shellcodes/ghdb
Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping
Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities
Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS)
Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities
Joomla HikaShop 4.7.4 - Reflected XSS
Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS
mooDating 1.2 - Reflected Cross-site scripting (XSS)
October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)
PaulPrinting CMS - (Search Delivery) Cross Site Scripting
Perch v3.2 - Persistent Cross Site Scripting (XSS)
RosarioSIS 10.8.4 - CSV Injection
WordPress Plugin AN_Gradebook 5.0.1 - SQLi
Zomplog 3.9 - Cross-site scripting (XSS)
zomplog 3.9 - Remote Code Execution (RCE)
copyparty 1.8.2 - Directory Traversal
copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)
GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution
mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory
Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
2023-07-29 00:16:43 +00:00
Exploit-DB
98cdb05106
DB: 2023-07-21
...
10 changes to exploits/shellcodes/ghdb
Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.
RWS WorldServer 11.7.3 - Session Token Enumeration
Aures Booking & POS Terminal - Local Privilege Escalation
Boom CMS v8.0.7 - Cross Site Scripting
PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities
pfSense v2.7.0 - OS Command Injection
Webile v1.0.1 - Multiple Cross Site Scripting
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
RaidenFTPD 2.4.4005 - Buffer Overflow (SEH)
2023-07-21 00:16:29 +00:00
Exploit-DB
3a3c03321c
DB: 2023-07-20
...
18 changes to exploits/shellcodes/ghdb
Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution
ABB FlowX v4.00 - Exposure of Sensitive Information
TP-Link TL-WR740N - Authenticated Directory Transversal
Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure
Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS)
Blackcat Cms v1.4 - Remote Code Execution (RCE)
Blackcat Cms v1.4 - Stored XSS
CmsMadeSimple v2.2.17 - Remote Code Execution (RCE)
CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI)
CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)
Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration)
Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
phpfm v1.7.9 - Authentication type juggling
PimpMyLog v1.7.14 - Improper access control
PMB 7.4.6 - SQL Injection
Statamic 4.7.0 - File-Inclusion
Vaidya-Mitra 1.0 - Multiple SQLi
2023-07-20 00:16:46 +00:00
Exploit-DB
743db0e747
DB: 2023-07-08
...
4 changes to exploits/shellcodes/ghdb
Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Faculty Evaluation System v1.0 - SQL Injection
Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
2023-07-08 00:16:23 +00:00
Exploit-DB
ef9b4e5962
DB: 2023-07-04
...
20 changes to exploits/shellcodes/ghdb
TP-Link TL-WR940N V4 - Buffer OverFlow
D-Link DAP-1325 - Broken Access Control
Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE)
FuguHub 8.1 - Remote Code Execution
GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)
PodcastGenerator 3.2.9 - Blind SSRF via XML Injection
POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)
Prestashop 8.0.4 - Cross-Site Scripting (XSS)
Rukovoditel 3.4.1 - Multiple Stored XSS
Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)
spip v4.1.10 - Spoofing Admin account
Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS)
Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)
WBCE CMS 1.6.1 - Open Redirect & CSRF
WebsiteBaker v2.13.3 - Directory Traversal
WebsiteBaker v2.13.3 - Stored XSS
WP AutoComplete 1.0.4 - Unauthenticated SQLi
2023-07-04 00:16:26 +00:00
Exploit-DB
7807e6f266
DB: 2023-06-27
...
7 changes to exploits/shellcodes/ghdb
Azure Apache Ambari 2302250400 - Spoofing
Microsoft SharePoint Enterprise Server 2016 - Spoofing
Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection
Xenforo Version 2.2.13 - Authenticated Stored XSS
Windows 11 22h2 - Kernel Privilege Elevation
2023-06-27 00:17:09 +00:00
Exploit-DB
ea194c414f
DB: 2023-06-23
...
3 changes to exploits/shellcodes/ghdb
Smart Office Web 20.28 - Remote Information Disclosure (Unauthenticated)
Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing
MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
Super Socializer 7.13.52 - Reflected XSS
2023-06-23 00:16:26 +00:00
Exploit-DB
cb5c64da21
DB: 2023-06-01
...
13 changes to exploits/shellcodes/ghdb
Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download
Pydio Cells 4.1.2 - Server-Side Request Forgery
Pydio Cells 4.1.2 - Unauthorised Role Assignments
Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)
MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)
Faculty Evaluation System 1.0 - Unauthenticated File Upload
Online Security Guards Hiring System 1.0 - Reflected XSS
Online shopping system advanced 1.0 - Multiple Vulnerabilities
Rukovoditel 3.3.1 - CSV injection
SCRMS 2023-05-27 1.0 - Multiple SQL Injection
Service Provider Management System v1.0 - SQL Injection
Ulicms-2023.1-sniffing-vicuna - Privilege escalation
unilogies/bumsys v1.0.3 beta - Unrestricted File Upload
2023-06-01 00:16:25 +00:00
Exploit-DB
9be142a874
DB: 2023-05-26
...
7 changes to exploits/shellcodes/ghdb
Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)
SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
Ulicms 2023.1 - create admin user via mass assignment
WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)
Zenphoto 1.6 - Multiple stored XSS
Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
2023-05-26 00:16:47 +00:00
Exploit-DB
0a7adaa3fc
DB: 2023-05-24
...
40 changes to exploits/shellcodes/ghdb
Optoma 1080PSTX Firmware C02 - Authentication Bypass
Screen SFT DAB 600/C - Authentication Bypass Account Creation
Screen SFT DAB 600/C - Authentication Bypass Admin Password Change
Screen SFT DAB 600/C - Authentication Bypass Erase Account
Screen SFT DAB 600/C - Authentication Bypass Password Change
Screen SFT DAB 600/C - Authentication Bypass Reset Board Config
Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)
PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Apache Superset 2.0.0 - Authentication Bypass
FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)
PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
Affiliate Me Version 5.0.1 - SQL Injection
Best POS Management System v1.0 - Unauthenticated Remote Code Execution
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
e107 v2.3.2 - Reflected XSS
File Thingie 2.5.7 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
LeadPro CRM v1.0 - SQL Injection
PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)
Prestashop 8.0.4 - CSV injection
Quicklancer v1.0 - SQL Injection
SitemagicCMS 4.4.3 - Remote Code Execution (RCE)
Smart School v1.0 - SQL Injection
Stackposts Social Marketing Tool v1.0 - SQL Injection
thrsrossi Millhouse-Project 1.414 - Remote Code Execution
TinyWebGallery v2.5 - Remote Code Execution (RCE)
WBiz Desk 1.2 - SQL Injection
Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup
Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title
Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking
MobileTrans 4.0.11 - Weak Service Privilege Escalation
Trend Micro OfficeScan Client 10.0 - ACL Service LPE
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
2023-05-24 00:16:34 +00:00
Exploit-DB
8945b320b5
DB: 2023-05-06
...
20 changes to exploits/shellcodes/ghdb
Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution
Cmaps v8.0 - SQL injection
EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal)
File Thingie 2.5.7 - Remote Code Execution (RCE)
Intern Record System v1.0 - SQL Injection (Unauthenticated)
Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls
Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path
Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts
Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
Jedox 2022.4.2 - Code Execution via RPC Interfaces
Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks
Jedox 2022.4.2 - Remote Code Execution via Directory Traversal
KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)
Online Pizza Ordering System v1.0 - Unauthenticated File Upload
pluck v4.7.18 - Stored Cross-Site Scripting (XSS)
Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)
Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE)
Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)
Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
2023-05-06 00:16:26 +00:00
Exploit-DB
668314bbda
DB: 2023-05-03
...
19 changes to exploits/shellcodes/ghdb
FS-S3900-24T4S - Privilege Escalation
Virtual Reception v1.0 - Web Server Directory Traversal
admidio v4.2.5 - CSV Injection
Companymaps v8.0 - Stored Cross Site Scripting (XSS)
GLPI 9.5.7 - Username Enumeration
OpenEMR v7.0.1 - Authentication credentials brute force
PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting
PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)
PHPJabbers Simple CMS 5.0 - SQL Injection
PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)
phpMyFAQ v3.1.12 - CSV Injection
projectSend r1605 - Private file download
revive-adserver v5.4.1 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - File Inclusion RCE
SoftExpert (SE) Suite v2.1.3 - Local File Inclusion
Advanced Host Monitor v12.56 - Unquoted Service Path
MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
2023-05-03 00:16:23 +00:00
Exploit-DB
7e3a257da8
DB: 2023-04-26
...
11 changes to exploits/shellcodes/ghdb
PaperCut NG/MG 22.0.4 - Authentication Bypass
KodExplorer 4.49 - CSRF to Arbitrary File Upload
Mars Stealer 8.3 - Admin Account Takeover
Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution
Sophos Web Appliance 4.3.10.4 - Pre-auth command injection
Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path
OCS Inventory NG 2.3.0.0 - Unquoted Service Path
Wondershare Filmora 12.2.9.2233 - Unquoted Service Path
Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
2023-04-26 00:16:27 +00:00
