Exploit-DB
010e679abe
DB: 2023-08-05
...
25 changes to exploits/shellcodes/ghdb
ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)
Shelly PRO 4PM v0.11.0 - Authentication Bypass
Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
Academy LMS 6.0 - Reflected XSS
Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload
JLex GuestBook 1.6.4 - Reflected XSS
Joomla JLex Review 6.0.1 - Reflected XSS
News Portal v4.0 - SQL Injection (Unauthorized)
PHPJabbers Cleaning Business 1.0 - Reflected XSS
PHPJabbers Night Club Booking 1.0 - Reflected XSS
PHPJabbers Rental Property Booking 2.0 - Reflected XSS
PHPJabbers Service Booking Script 1.0 - Reflected XSS
PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
PHPJabbers Taxi Booking 2.0 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webutler v3.2 - Remote Code Execution (RCE)
WordPress adivaha Travel Plugin 2.3 - Reflected XSS
WordPress adivaha Travel Plugin 2.3 - SQL Injection
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS
Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)
2023-08-05 00:16:32 +00:00
Exploit-DB
5eb89a2046
DB: 2023-08-01
...
5 changes to exploits/shellcodes/ghdb
Joomla iProperty Real Estate 4.1.1 - Reflected XSS
Joomla Solidres 2.13.3 - Reflected XSS
RosarioSIS 10.8.4 - CSV Injection
Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
WordPress Plugin AN_Gradebook 5.0.1 - SQLi
General Device Manager 2.5.2.2 - Buffer Overflow (SEH)
2023-08-01 00:16:36 +00:00
Exploit-DB
c18d9953a2
DB: 2023-07-29
...
22 changes to exploits/shellcodes/ghdb
Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping
Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities
Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS)
Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities
Joomla HikaShop 4.7.4 - Reflected XSS
Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS
mooDating 1.2 - Reflected Cross-site scripting (XSS)
October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)
PaulPrinting CMS - (Search Delivery) Cross Site Scripting
Perch v3.2 - Persistent Cross Site Scripting (XSS)
RosarioSIS 10.8.4 - CSV Injection
WordPress Plugin AN_Gradebook 5.0.1 - SQLi
Zomplog 3.9 - Cross-site scripting (XSS)
zomplog 3.9 - Remote Code Execution (RCE)
copyparty 1.8.2 - Directory Traversal
copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)
GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution
mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory
Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
2023-07-29 00:16:43 +00:00
Exploit-DB
98cdb05106
DB: 2023-07-21
...
10 changes to exploits/shellcodes/ghdb
Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.
RWS WorldServer 11.7.3 - Session Token Enumeration
Aures Booking & POS Terminal - Local Privilege Escalation
Boom CMS v8.0.7 - Cross Site Scripting
PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities
pfSense v2.7.0 - OS Command Injection
Webile v1.0.1 - Multiple Cross Site Scripting
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
RaidenFTPD 2.4.4005 - Buffer Overflow (SEH)
2023-07-21 00:16:29 +00:00
Exploit-DB
fd788a92e3
DB: 2023-07-16
...
9 changes to exploits/shellcodes/ghdb
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Admidio v4.2.10 - Remote Code Execution (RCE)
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Icinga Web 2.10 - Authenticated Remote Code Execution
News Portal v4.0 - SQL Injection (Unauthorized)
Pluck v4.7.18 - Remote Code Execution (RCE)
ProjeQtOr Project Management System v10.4.1 - Multiple XSS
WinterCMS < 1.2.3 - Persistent Cross-Site Scripting
XAMPP 8.2.4 - Unquoted Path
2023-07-16 00:16:39 +00:00
Exploit-DB
00f5021452
DB: 2023-07-12
...
10 changes to exploits/shellcodes/ghdb
Ateme TITAN File 3.9 - SSRF File Enumeration
Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Spring Cloud 3.2.2 - Remote Command Execution (RCE)
BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)
AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_
Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
2023-07-12 00:16:54 +00:00
Exploit-DB
743db0e747
DB: 2023-07-08
...
4 changes to exploits/shellcodes/ghdb
Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Faculty Evaluation System v1.0 - SQL Injection
Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
2023-07-08 00:16:23 +00:00
Exploit-DB
7807e6f266
DB: 2023-06-27
...
7 changes to exploits/shellcodes/ghdb
Azure Apache Ambari 2302250400 - Spoofing
Microsoft SharePoint Enterprise Server 2016 - Spoofing
Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection
Xenforo Version 2.2.13 - Authenticated Stored XSS
Windows 11 22h2 - Kernel Privilege Elevation
2023-06-27 00:17:09 +00:00
Exploit-DB
c79c4813de
DB: 2023-06-24
...
4 changes to exploits/shellcodes/ghdb
MCL-Net 4.3.5.8788 - Information Disclosure
Abantecart v1.3.2 - Authenticated Remote Code Execution
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
NCH Express Invoice - Clear Text Password Storage and Account Takeover
2023-06-24 00:16:23 +00:00
Exploit-DB
12f9039552
DB: 2023-06-08
...
2 changes to exploits/shellcodes/ghdb
Apache 2.4.x - Buffer Overflow
Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)
USB Flash Drives Control 4.1.0.0 - Unquoted Service Path
2023-06-08 00:16:21 +00:00
Exploit-DB
ccfd0c515d
DB: 2023-06-07
...
3 changes to exploits/shellcodes/ghdb
Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)
Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)
GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)
Macro Expert 4.9 - Unquoted Service Path
2023-06-07 00:16:24 +00:00
Exploit-DB
9be142a874
DB: 2023-05-26
...
7 changes to exploits/shellcodes/ghdb
Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)
SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
Ulicms 2023.1 - create admin user via mass assignment
WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)
Zenphoto 1.6 - Multiple stored XSS
Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
2023-05-26 00:16:47 +00:00
Exploit-DB
0a7adaa3fc
DB: 2023-05-24
...
40 changes to exploits/shellcodes/ghdb
Optoma 1080PSTX Firmware C02 - Authentication Bypass
Screen SFT DAB 600/C - Authentication Bypass Account Creation
Screen SFT DAB 600/C - Authentication Bypass Admin Password Change
Screen SFT DAB 600/C - Authentication Bypass Erase Account
Screen SFT DAB 600/C - Authentication Bypass Password Change
Screen SFT DAB 600/C - Authentication Bypass Reset Board Config
Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)
PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Apache Superset 2.0.0 - Authentication Bypass
FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)
PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
Affiliate Me Version 5.0.1 - SQL Injection
Best POS Management System v1.0 - Unauthenticated Remote Code Execution
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
e107 v2.3.2 - Reflected XSS
File Thingie 2.5.7 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
LeadPro CRM v1.0 - SQL Injection
PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)
Prestashop 8.0.4 - CSV injection
Quicklancer v1.0 - SQL Injection
SitemagicCMS 4.4.3 - Remote Code Execution (RCE)
Smart School v1.0 - SQL Injection
Stackposts Social Marketing Tool v1.0 - SQL Injection
thrsrossi Millhouse-Project 1.414 - Remote Code Execution
TinyWebGallery v2.5 - Remote Code Execution (RCE)
WBiz Desk 1.2 - SQL Injection
Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup
Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title
Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking
MobileTrans 4.0.11 - Weak Service Privilege Escalation
Trend Micro OfficeScan Client 10.0 - ACL Service LPE
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
2023-05-24 00:16:34 +00:00
Exploit-DB
668314bbda
DB: 2023-05-03
...
19 changes to exploits/shellcodes/ghdb
FS-S3900-24T4S - Privilege Escalation
Virtual Reception v1.0 - Web Server Directory Traversal
admidio v4.2.5 - CSV Injection
Companymaps v8.0 - Stored Cross Site Scripting (XSS)
GLPI 9.5.7 - Username Enumeration
OpenEMR v7.0.1 - Authentication credentials brute force
PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting
PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)
PHPJabbers Simple CMS 5.0 - SQL Injection
PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)
phpMyFAQ v3.1.12 - CSV Injection
projectSend r1605 - Private file download
revive-adserver v5.4.1 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - File Inclusion RCE
SoftExpert (SE) Suite v2.1.3 - Local File Inclusion
Advanced Host Monitor v12.56 - Unquoted Service Path
MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
2023-05-03 00:16:23 +00:00
Exploit-DB
7e3a257da8
DB: 2023-04-26
...
11 changes to exploits/shellcodes/ghdb
PaperCut NG/MG 22.0.4 - Authentication Bypass
KodExplorer 4.49 - CSRF to Arbitrary File Upload
Mars Stealer 8.3 - Admin Account Takeover
Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution
Sophos Web Appliance 4.3.10.4 - Pre-auth command injection
Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path
OCS Inventory NG 2.3.0.0 - Unquoted Service Path
Wondershare Filmora 12.2.9.2233 - Unquoted Service Path
Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
2023-04-26 00:16:27 +00:00
Exploit-DB
bd09027499
DB: 2023-04-21
...
18 changes to exploits/shellcodes/ghdb
Franklin Fueling Systems TS-550 - Default Password
Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
Linux Kernel 6.2 - Userspace Processes To Enable Mitigation
Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
Chitor-CMS v1.1.2 - Pre-Auth SQL Injection
GDidees CMS 3.9.1 - Local File Disclosure
Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)
Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)
ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE)
Serendipity 2.4.0 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated)
FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE)
AspEmail v5.6.0.2 - Local Privilege Escalation
File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
2023-04-21 00:16:25 +00:00
Exploit-DB
2f07358143
DB: 2023-04-15
...
16 changes to exploits/shellcodes/ghdb
InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal
Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation
Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking
Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery
Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password
Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP
Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit
Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset
Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation
Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure
Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
Bludit 4.0.0-rc-2 - Account takeover
Microsoft Windows 11 - 'cmd.exe' Denial of Service
2023-04-15 00:16:19 +00:00
Exploit-DB
85954a8fad
DB: 2023-04-09
...
34 changes to exploits/shellcodes/ghdb
ENTAB ERP 1.0 - Username PII leak
ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)
ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)
FortiRecorder 6.4.3 - Denial of Service
Schneider Electric v1.0 - Directory traversal & Broken Authentication
Altenergy Power Control Software C1.2.5 - OS command injection
Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)
Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)
Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)
Lucee Scheduled Job v1.0 - Command Execution
Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)
Adobe Connect 11.4.5 - Local File Disclosure
Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)
Suprema BioStar 2 v2.8.16 - SQL Injection
Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)
dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)
GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure
Icinga Web 2.10 - Arbitrary File Disclosure
Joomla! v4.2.8 - Unauthenticated information disclosure
Medicine Tracker System v1.0 - Sql Injection
Online Appointment System V1.0 - Cross-Site Scripting (XSS)
Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)
pfsenseCE v2.6.0 - Anti-brute force protection bypass
Restaurant Management System 1.0 - SQL Injection
WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)
X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
Microsoft Windows 11 - 'cmd.exe' Denial of Service
ActFax 10.10 - Unquoted Path Services
ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path
RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution
Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
2023-04-09 00:16:30 +00:00
Exploit-DB
99cef8d064
DB: 2023-04-08
...
11 changes to exploits/shellcodes/ghdb
Snitz Forum v1.0 - Blind SQL Injection
Franklin Fueling Systems TS-550 - Exploit and Default Password
Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing
MAC 1200R - Directory Traversal
Docker based datastores for IBM Instana 241-2 243-0 - No Authentication
IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)
ChurchCRM 4.5.1 - Authenticated SQL Injection
NotrinosERP 0.7 - Authenticated Blind SQL Injection
Rukovoditel 3.3.1 - Remote Code Execution (RCE)
Wondershare Dr Fone 12.9.6 - Privilege Escalation
2023-04-08 00:16:27 +00:00
Exploit-DB
d7c9ba572a
DB: 2023-04-07
...
50 changes to exploits/shellcodes/ghdb
Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI
ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access
Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)
Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection
Osprey Pump Controller 1.0.1 - (pseudonym) Semi-blind Command Injection
Osprey Pump Controller 1.0.1 - (userName) Blind Command Injection
Osprey Pump Controller 1.0.1 - Administrator Backdoor Access
Osprey Pump Controller 1.0.1 - Authentication Bypass Credentials Modification
Osprey Pump Controller 1.0.1 - Cross-Site Request Forgery
Osprey Pump Controller 1.0.1 - Predictable Session Token / Session Hijack
Osprey Pump Controller 1.0.1 - Unauthenticated File Disclosure
Osprey Pump Controller 1.0.1 - Unauthenticated Remote Code Execution Exploit
Osprey Pump Controller v1.0.1 - Unauthenticated Reflected XSS
WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE
HospitalRun 1.0.0-beta - Local Root Exploit for macOS
Adobe Connect 10 - Username Disclosure
craftercms 4.x.x - CORS
EasyNas 1.1.0 - OS Command Injection
Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution (RCE)
Art Gallery Management System Project in PHP v 1.0 - SQL injection
atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE
Auto Dealer Management System 1.0 - Broken Access Control Exploit
Auto Dealer Management System v1.0 - SQL Injection
Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php
Auto Dealer Management System v1.0 - SQL Injection on manage_user.php
Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload
Best pos Management System v1.0 - SQL Injection
ChurchCRM v4.5.3-121fcc1 - SQL Injection
Dompdf 1.2.1 - Remote Code Execution (RCE)
Employee Task Management System v1.0 - Broken Authentication
Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)
Employee Task Management System v1.0 - SQL Injection on edit-task.php
flatnux 2021-03.25 - Remote Code Execution (Authenticated)
Intern Record System v1.0 - SQL Injection (Unauthenticated)
Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking
LDAP Tool Box Self Service Password v1.5.2 - Account takeover
Music Gallery Site v1.0 - Broken Access Control
Music Gallery Site v1.0 - SQL Injection on music_list.php
Music Gallery Site v1.0 - SQL Injection on page Master.php
Music Gallery Site v1.0 - SQL Injection on page view_music_details.php
POLR URL 2.3.0 - Shortener Admin Takeover
Purchase Order Management-1.0 - Local File Inclusion
Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)
Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)
modoboa 2.0.4 - Admin TakeOver
pdfkit v0.8.7.2 - Command Injection
FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking
Windows 11 10.0.22000 - Backup service Privilege Escalation
TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)
Unified Remote 3.13.0 - Remote Code Execution (RCE)
2023-04-07 00:16:28 +00:00
Exploit-DB
d46ab98863
DB: 2023-04-06
...
32 changes to exploits/shellcodes/ghdb
Answerdev 1.0.3 - Account Takeover
D-Link DIR-846 - Remote Command Execution (RCE) vulnerability
Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure
SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow
ERPNext 12.29 - Cross-Site Scripting (XSS)
Liferay Portal 6.2.5 - Insecure Permissions
GNU screen v4.9.0 - Privilege Escalation
Apache Tomcat 10.1 - Denial Of Service
PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)
BTCPay Server v1.7.4 - HTML Injection.
Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE)
Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)
ImageMagick 7.1.0-49 - DoS
bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS)
Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)
CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)
Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)
Froxlor 2.0.3 Stable - Remote Code Execution (RCE)
ImageMagick 7.1.0-49 - Arbitrary File Read
itech TrainSmart r1044 - SQL injection
Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated)
PhotoShow 3.0 - Remote Code Execution
projectSend r1605 - Remote Code Exectution RCE
Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
zstore 6.6.0 - Cross-Site Scripting (XSS)
Binwalk v2.3.2 - Remote Command Execution (RCE)
XWorm Trojan 2.1 - Null Pointer Derefernce DoS
Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution)
Linux/x86_64 - bash Shellcode with xor encoding
2023-04-06 00:16:31 +00:00
Exploit-DB
d4e68dbb7e
DB: 2023-04-04
...
39 changes to exploits/shellcodes/ghdb
ProLink PRS1841 PLDT Home fiber - Default Password
Nacos 2.0.3 - Access Control vulnerability
sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
sleuthkit 4.11.1 - Command Injection
Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS)
ManageEngin AMP 4.3.0 - File-path-traversal
SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS)
AmazCart CMS 3.4 - Cross-Site-Scripting (XSS)
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated
Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated
ChiKoi v1.0 - SQL Injection
ERPGo SaaS 3.9 - CSV Injection
GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion
GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure
GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration)
Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)
Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection
pimCore v5.4.18-skeleton - Sensitive Cookie with Improper SameSite Attribute
Prizm Content Connect v10.5.1030.8315 - XXE
SLIMSV 9.5.2 - Cross-Site Scripting (XSS)
WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE
Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)
Roxy WI v6.1.0.0 - Improper Authentication Control
Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
Solaris 10 libXm - Buffer overflow Local privilege escalation
Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path
Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow
HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path
Microsoft Exchange Active Directory Topology 15.02.1118.007 - 'Service MSExchangeADTopology' Unquoted Service Path
Windows 11 10.0.22000 - Backup service Privilege Escalation
Windows/x86 - Create Administrator User / Dynamic PEB & EDT method null-free Shellcode (373 bytes)
2023-04-04 00:16:32 +00:00
Exploit-DB
3de26153c8
DB: 2023-04-02
...
23 changes to exploits/shellcodes/ghdb
ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)
Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion
Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)
TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated)
GeoVision Camera GV-ADR2701 - Authentication Bypass
AD Manager Plus 7122 - Remote Code Execution (RCE)
Enlightenment v0.25.3 - Privilege escalation
Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)
Apache 2.4.x - Buffer Overflow
perfSONAR v4.4.5 - Partial Blind CSRF
SugarCRM 12.2.0 - Remote Code Execution (RCE)
XCMS v1.83 - Remote Command Execution (RCE)
Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)
GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)
AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS)
NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit
Splashtop 8.71.12001.0 - Unquoted Service Path
Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)
FlipRotation v1.0 decoder - Shellcode (146 bytes)
Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes)
macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
2023-04-02 00:16:21 +00:00
Exploit-DB
9b56e8731e
DB: 2023-04-01
...
25 changes to exploits/shellcodes/ghdb
EQ Enterprise management system v2.2.0 - SQL Injection
qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS)
ASKEY RTF3505VW-N1 - Privilege Escalation
Bangresto 1.0 - SQL Injection
Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated)
Cacti v1.2.22 - Remote Command Execution (RCE)
Judging Management System v1.0 - Authentication Bypass
Judging Management System v1.0 - Remote Code Execution (RCE)
rconfig 3.9.7 - Sql Injection (Authenticated)
Senayan Library Management System v9.0.0 - SQL Injection
Spitfire CMS 1.0.475 - PHP Object Injection
Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated)
WooCommerce v7.1.0 - Remote Code Execution(RCE)
CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS)
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR)
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE)
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset
SOUND4 Server Service 4.1.102 - Local Privilege Escalation
macOS/x64 - Execve Null-Free Shellcode
2023-04-01 00:16:31 +00:00
Exploit-DB
42ade901fe
DB: 2023-03-31
...
22 changes to exploits/shellcodes/ghdb
LISTSERV 17 - Insecure Direct Object Reference (IDOR)
LISTSERV 17 - Reflected Cross Site Scripting (XSS)
Router ZTE-H108NS - Stack Buffer Overflow (DoS)
Router ZTE-H108NS - Authentication Bypass
Boa Web Server v0.94.14 - Authentication Bypass
Covenant v0.5 - Remote Code Execution (RCE)
Dreamer CMS v4.0.0 - SQL Injection
Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)
Virtual Reception v1.0 - Web Server Directory Traversal
4images 1.9 - Remote Command Execution (RCE)
ClicShopping v3.402 - Cross-Site Scripting (XSS)
Concrete5 CME v9.1.3 - Xpath injection
Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
Ecommerse v1.0 - Cross-Site Scripting (XSS)
Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS)
myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
WPForms 1.7.8 - Cross-Site Scripting (XSS)
CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token
Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path
Zillya Total Security 3.0.2367.0 - Local Privilege Escalation
2023-03-31 00:16:26 +00:00
Exploit-DB
564d2ddf47
DB: 2023-03-30
...
13 changes to exploits/shellcodes/ghdb
DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure
Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS)
Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)
Helmet Store Showroom v1.0 - SQL Injection
Human Resource Management System 1.0 - SQL Injection (unauthenticated)
Revenue Collection System v1.0 - Remote Code Execution (RCE)
WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)
Outline V1.6.0 - Unquoted Service Path
Inbit Messenger v4.9.0 - Unauthenticated Remote Command Execution (RCE)
Inbit Messenger v4.9.0 - Unauthenticated Remote SEH Overflow
Internet Download Manager v6.41 Build 3 - Remote Code Execution (RCE)
2023-03-30 00:16:31 +00:00
Exploit-DB
6bc7a6f9b0
DB: 2023-03-29
...
25 changes to exploits/shellcodes/ghdb
ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)
Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access
ZKTeco ZEM/ZMM 8.88 - Missing Authentication
Hashicorp Consul v1.0 - Remote Command Execution (RCE)
X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
OPSWAT Metadefender Core - Privilege Escalation
Pega Platform 8.1.0 - Remote Code Execution (RCE)
Beauty-salon v1.0 - Remote Code Execution (RCE)
BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
iBooking v1.0.8 - Arbitrary File Upload
Jetpack 11.4 - Cross Site Scripting (XSS)
Moodle LMS 4.0 - Cross-Site Scripting (XSS)
Online shopping system advanced 1.0 - Multiple Vulnerabilities
rukovoditel 3.2.1 - Cross-Site Scripting (XSS)
Senayan Library Management System v9.5.0 - SQL Injection
Social-Share-Buttons v2.2.3 - SQL Injection
Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)
YouPHPTube<= 7.8 - Multiple Vulnerabilities
Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)
SuperMailer v11.20 - Buffer overflow DoS
Tunnel Interface Driver - Denial of Service
VMware Workstation 15 Pro - Denial of Service
HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path
SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
2023-03-29 00:16:31 +00:00
Exploit-DB
b137003172
DB: 2023-03-28
...
36 changes to exploits/shellcodes/ghdb
MiniDVBLinux 5.4 - Change Root Password
MiniDVBLinux 5.4 - Remote Root Command Injection
MiniDVBLinux 5.4 - Arbitrary File Read
MiniDVBLinux 5.4 - Unauthenticated Stream Disclosure
MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP - Remote Code Execution (RCE)
MiniDVBLinux <=5.4 - Config Download Exploit
Desktop Central 9.1.0 - Multiple Vulnerabilities
FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass
Aero CMS v0.0.1 - PHP Code Injection (auth)
Aero CMS v0.0.1 - SQL Injection (no auth)
Atom CMS v2.0 - SQL Injection (no auth)
Canteen-Management v1.0 - SQL Injection
Canteen-Management v1.0 - XSS-Reflected
Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)
eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)
FlatCore CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)
WebTareas 2.4 - RCE (Authorized)
WebTareas 2.4 - Reflected XSS (Unauthorised)
WebTareas 2.4 - SQL Injection (Unauthorised)
WPN-XM Serverstack for Windows 0.8.6 - Multiple Vulnerabilities
Zentao Project Management System 17.0 - Authenticated Remote Code Execution (RCE)
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
Grafana <=6.2.4 - HTML Injection
Hex Workshop v6.7 - Buffer overflow DoS
Scdbg 1.0 - Buffer overflow DoS
Sysax Multi Server 6.95 - 'Password' Denial of Service (PoC)
AVS Audio Converter 10.3 - Stack Overflow (SEH)
Explorer32++ v1.3.5.531 - Buffer overflow
Frhed (Free hex editor) v1.6.0 - Buffer overflow
Gestionale Open 12.00.00 - 'DB_GO_80' Unquoted Service Path
Mediconta 3.7.27 - 'servermedicontservice' Unquoted Service Path
Resource Hacker v3.6.0.92 - Buffer overflow
Tftpd32_SE 4.60 - 'Tftpd32_svc' Unquoted Service Path
WiFi Mouse 1.8.3.2 - Remote Code Execution (RCE)
2023-03-28 00:16:27 +00:00
Exploit-DB
79023d1f9c
DB: 2023-03-26
...
22 changes to exploits/shellcodes/ghdb
Password Manager for IIS v2.0 - XSS
DLink DIR 819 A1 - Denial of Service
D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution
Abantecart v1.3.2 - Authenticated Remote Code Execution
Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution
Employee Performance Evaluation System v1.0 - File Inclusion and RCE
GuppY CMS v6.00.10 - Remote Code Execution
Human Resources Management System v1.0 - Multiple SQLi
ImpressCMS v1.4.3 - Authenticated SQL Injection
Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal
MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated)
PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS
SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection
Yoga Class Registration System v1.0 - Multiple SQLi
NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle
_camp_ Raspberry Pi camera server 1.0 - Authentication Bypass
System Mechanic v15.5.0.61 - Arbitrary Read/Write
2023-03-26 00:16:30 +00:00
Offensive Security
ec8ac60c13
DB: 2022-11-22
...
93 changes to exploits/shellcodes/ghdb
2022-11-22 11:08:59 +00:00
Offensive Security
c9e53fa57b
DB: 2022-11-12
...
7 changes to exploits/shellcodes/ghdb
AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal
MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)
SmartRG Router SR510n 2.6.13 - RCE (Remote Code Execution)
Open Web Analytics 1.7.3 - Remote Code Execution (RCE)
CVAT 2.0 - SSRF (Server Side Request Forgery)
IOTransfer V4 - Unquoted Service Path
NetTransport 2.96L - Remote Buffer Overflow (DEP Bypass)
Linux/MIPS (Little Endian) - system(telnetd -l /bin/sh) Shellcode (80 bytes)
Linux/MIPS - reboot() Shellcode (32 bytes)
Linux/x86 - execve(/bin/sh) + Socket Re-Use Shellcode (50 bytes)
Linux/x86 - setuid(0) + setgid(0) + execve(/bin/sh_ [/bin/sh_ NULL]) Shellcode (37 bytes)
Windows/x86 - Write-to-file ('pwned' ./f.txt) + Null-Free Shellcode (278 bytes)
2022-11-12 09:02:02 +00:00
Offensive Security
b6e780c138
DB: 2022-11-10
...
20 changes to exploits/shellcodes/ghdb
0 new exploits/shellcodes
Too many to list!
2022-11-10 23:30:40 +00:00
Offensive Security
8bf3aee631
DB: 2022-11-10
...
2 changes to exploits/shellcodes/ghdb
2022-11-10 17:10:37 +00:00
Offensive Security
d63de06c7a
DB: 2022-11-10
...
2776 changes to exploits/shellcodes/ghdb
2022-11-10 16:39:50 +00:00
Offensive Security
3d2fa2f00a
DB: 2022-09-22
...
2 changes to exploits/shellcodes
Wifi HD Wireless Disk Drive 11 - Local File Inclusion
WiFiMouse 1.8.3.4 - Remote Code Execution (RCE)
2022-09-22 05:01:51 +00:00
Offensive Security
7cbe771564
DB: 2022-09-21
...
5 changes to exploits/shellcodes
Blink1Control2 2.2.7 - Weak Password Encryption
Mobile Mouse 3.6.0.4 - Remote Code Execution (RCE)
Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)
Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
Bookwyrm v0.4.3 - Authentication Bypass
2022-09-21 05:01:54 +00:00
Offensive Security
34afdf0a9d
DB: 2022-08-04
...
1 changes to exploits/shellcodes
2022-08-04 05:01:48 +00:00
Offensive Security
16b24da825
DB: 2022-08-02
...
19 changes to exploits/shellcodes
Omnia MPX 1.5.0+r1 - Path Traversal
Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH)
OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
Wavlink WN533A8 - Cross-Site Scripting (XSS)
Wavlink WN530HG4 - Password Disclosure
Wavlink WN533A8 - Password Disclosure
WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
WordPress Plugin Duplicator 1.4.7 - Information Disclosure
CuteEditor for PHP 6.6 - Directory Traversal
mPDF 7.0 - Local File Inclusion
NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated)
Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
2022-08-02 05:01:49 +00:00
Offensive Security
dfb28913d0
DB: 2022-07-30
...
7 changes to exploits/shellcodes
Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
rpc.py 0.6.0 - Remote Code Execution (RCE)
Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution
Geonetwork 4.2.0 - XML External Entity (XXE)
Dingtian-DT-R002 3.1.276A - Authentication Bypass
Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal
WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
2022-07-30 05:01:47 +00:00
Offensive Security
46346f8944
DB: 2022-07-22
...
6 changes to exploits/shellcodes
Kite 1.2021.610.0 - Unquoted Service Path
Dr. Fone 4.0.8 - 'net_updater32.exe' Unquoted Service Path
IOTransfer 4.0 - Remote Code Execution (RCE)
Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
CodoForum v5.1 - Remote Code Execution (RCE)
OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
2022-07-22 05:01:50 +00:00
Offensive Security
3bd99ff836
DB: 2022-07-02
...
1 changes to exploits/shellcodes
WiFi Mouse 1.7.8.5 - Remote Code Execution(v2)
2022-07-02 05:01:54 +00:00
Offensive Security
29e275db94
DB: 2022-06-15
...
16 changes to exploits/shellcodes
Real Player v.20.0.8.310 G2 Control - 'DoGoToURL()' Remote Code Execution (RCE)
Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)
HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path
Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)
Virtua Software Cobranca 12S - SQLi
Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF)
Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)
Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)
ChurchCRM 4.4.5 - SQLi
Old Age Home Management System 1.0 - SQLi Authentication Bypass
SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)
SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
2022-06-15 05:01:57 +00:00
Offensive Security
6b9b8c5434
DB: 2022-05-13
...
7 changes to exploits/shellcodes
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService)
Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
College Management System 1.0 - 'course_code' SQL Injection (Authenticated)
Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
TLR-2005KSH - Arbitrary File Delete
2022-05-13 05:01:39 +00:00
Offensive Security
be24992411
DB: 2022-05-12
...
42 changes to exploits/shellcodes
UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path
TCQ - ITeCProteccioAppServer.exe - Unquoted Service Path
Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
ExifTool 12.23 - Arbitrary Code Execution
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService)
Prime95 Version 30.7 build 9 - Remote Code Execution (RCE)
Akka HTTP 10.1.14 - Denial of Service
USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 - Remote Root Backdoor
Bookeen Notea - Directory Traversal
SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
DLINK DIR850 - Insecure Access Control
DLINK DIR850 - Open Redirect
Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
Tenda HG6 v3.3.0 - Remote Command Injection
Google Chrome 78.0.3904.70 - Remote Code Execution
PyScript - Read Remote Python Source Code
DLINK DAP-1620 A1 v1.01 - Directory Traversal
Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
ImpressCMS v1.4.4 - Unrestricted File Upload
Microfinance Management System 1.0 - 'customer_number' SQLi
WebTareas 2.4 - Blind SQLi (Authenticated)
WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
Magento eCommerce CE v2.3.5-p2 - Blind SQLi
Bitrix24 - Remote Code Execution (RCE) (Authenticated)
CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)
Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)
e107 CMS v3.2.1 - Multiple Vulnerabilities
Anuko Time Tracker - SQLi (Authenticated)
TLR-2005KSH - Arbitrary File Upload
Explore CMS 1.0 - SQL Injection
Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)
PHProjekt PhpSimplyGest v1.3. - Stored Cross-Site Scripting (XSS)
Beehive Forum - Account Takeover
MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Joomla Plugin SexyPolling 2.1.7 - SQLi
WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)
2022-05-12 05:01:39 +00:00
Offensive Security
004fdfd467
DB: 2022-04-27
...
4 changes to exploits/shellcodes
7-zip - Code Execution / Local Privilege Escalation
Gitlab 14.9 - Authentication Bypass
GitLab 14.9 - Stored Cross-Site Scripting (XSS)
2022-04-27 05:01:59 +00:00
Offensive Security
093714dc70
DB: 2022-04-20
...
21 changes to exploits/shellcodes
Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path
Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path
7-zip - Code Execution / Local Privilege Escalation
PTPublisher v2.3.4 - Unquoted Service Path
EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path
Zyxel NWA-1100-NH - Command Injection
ManageEngine ADSelfService Plus 6.1 - User Enumeration
Verizon 4G LTE Network Extender - Weak Credentials Algorithm
Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)
Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)
Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure
Scriptcase 9.7 - Remote Code Execution (RCE)
WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
Easy Appointments 1.4.2 - Information Disclosure
WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS)
WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)
REDCap 11.3.9 - Stored Cross Site Scripting
PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated)
Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)
2022-04-20 05:01:45 +00:00
Offensive Security
6457d1796d
DB: 2022-04-12
...
7 changes to exploits/shellcodes
MiniTool Partition Wizard - Unquoted Service Path
Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
Telesquare TLR-2855KS6 - Arbitrary File Creation
Telesquare TLR-2855KS6 - Arbitrary File Deletion
Razer Sila - Local File Inclusion (LFI)
Razer Sila - Command Injection
2022-04-12 05:01:35 +00:00
Offensive Security
50cc2edafe
DB: 2022-04-08
...
9 changes to exploits/shellcodes
Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
binutils 2.37 - Objdump Segmentation Fault
Kramer VIAware - Remote Code Execution (RCE) (Root)
Opmon 9.11 - Cross-site Scripting
Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)
KLiK Social Media Website 1.0 - 'Multiple' SQLi
minewebcms 1.15.2 - Cross-site Scripting (XSS)
qdPM 9.2 - Cross-site Request Forgery (CSRF)
ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
2022-04-08 05:01:37 +00:00
Offensive Security
498e749e36
DB: 2022-03-24
...
3 changes to exploits/shellcodes
ProtonVPN 1.26.0 - Unquoted Service Path
WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
2022-03-24 05:01:37 +00:00
Offensive Security
e55394b7d4
DB: 2022-03-23
...
6 changes to exploits/shellcodes
Sysax FTP Automation 6.9.0 - Privilege Escalation
iRZ Mobile Router - CSRF to RCE
Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS)
ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure
ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
2022-03-23 05:01:38 +00:00
