bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2695 commits 1 branch 0 tags 258 MiB
Commit graph

1153 commits

Author SHA1 Message Date
Exploit-DB
033e7ba3e0 DB: 2023-07-22 
3 changes to exploits/shellcodes/ghdb

Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
Perch v3.2 - Remote Code Execution (RCE)
Perch v3.2 - Stored XSS

Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi
 2023-07-22 00:16:25 +00:00
Exploit-DB
98cdb05106 DB: 2023-07-21 
10 changes to exploits/shellcodes/ghdb

Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.

RWS WorldServer 11.7.3 - Session Token Enumeration

Aures Booking & POS Terminal - Local Privilege Escalation

Boom CMS v8.0.7 - Cross Site Scripting

PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities

pfSense v2.7.0 - OS Command Injection

Webile v1.0.1 - Multiple Cross Site Scripting

Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection

RaidenFTPD 2.4.4005 - Buffer Overflow (SEH)
 2023-07-21 00:16:29 +00:00
Exploit-DB
3a3c03321c DB: 2023-07-20 
18 changes to exploits/shellcodes/ghdb

Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution

ABB FlowX v4.00 - Exposure of Sensitive Information

TP-Link TL-WR740N - Authenticated Directory Transversal

Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure

Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS)
Blackcat Cms v1.4 - Remote Code Execution (RCE)
Blackcat Cms v1.4 - Stored XSS
CmsMadeSimple v2.2.17 - Remote Code Execution (RCE)
CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI)
CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)

Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration)

Online Piggery Management System v1.0 - unauthenticated file upload vulnerability

phpfm v1.7.9 - Authentication type juggling

PimpMyLog v1.7.14 - Improper access control

PMB 7.4.6 - SQL Injection

Statamic 4.7.0 - File-Inclusion

Vaidya-Mitra 1.0 - Multiple SQLi
 2023-07-20 00:16:46 +00:00
Exploit-DB
fd788a92e3 DB: 2023-07-16 
9 changes to exploits/shellcodes/ghdb

Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass

Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)

Admidio v4.2.10 - Remote Code Execution (RCE)
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection

Icinga Web 2.10 - Authenticated Remote Code Execution

News Portal v4.0 - SQL Injection (Unauthorized)

Pluck v4.7.18 - Remote Code Execution (RCE)

ProjeQtOr Project Management System v10.4.1 - Multiple XSS

WinterCMS < 1.2.3 - Persistent Cross-Site Scripting

XAMPP 8.2.4 - Unquoted Path
 2023-07-16 00:16:39 +00:00
Exploit-DB
00f5021452 DB: 2023-07-12 
10 changes to exploits/shellcodes/ghdb

Ateme TITAN File 3.9 - SSRF File Enumeration

Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)

Spring Cloud 3.2.2 - Remote Command Execution (RCE)

BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)

Park Ticketing Management System 1.0  - 'viewid' SQL Injection

Park Ticketing Management System 1.0 - 'viewid' SQL Injection

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)

AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_

Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
 2023-07-12 00:16:54 +00:00
Exploit-DB
743db0e747 DB: 2023-07-08 
4 changes to exploits/shellcodes/ghdb

Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection

Faculty Evaluation System v1.0 - SQL Injection

Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
 2023-07-08 00:16:23 +00:00
Exploit-DB
e2ea5c0412 DB: 2023-07-07 
4 changes to exploits/shellcodes/ghdb

Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated)

Lost and Found Information System v1.0 - SQL Injection

Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)
 2023-07-07 00:16:26 +00:00
Exploit-DB
9461677d02 DB: 2023-07-05 
4 changes to exploits/shellcodes/ghdb

Beauty Salon Management System v1.0 - SQLi

Bus Pass Management System 1.0  - Stored Cross-Site Scripting (XSS)

Car Rental Script 1.8 - Stored Cross-site scripting (XSS)

NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
 2023-07-05 00:16:21 +00:00
Exploit-DB
ef9b4e5962 DB: 2023-07-04 
20 changes to exploits/shellcodes/ghdb

TP-Link TL-WR940N V4 - Buffer OverFlow

D-Link DAP-1325 - Broken Access Control

Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE)

FuguHub 8.1 - Remote Code Execution

GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)

PodcastGenerator 3.2.9 - Blind SSRF via XML Injection

POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)

Prestashop 8.0.4 - Cross-Site Scripting (XSS)

Rukovoditel 3.4.1 - Multiple Stored XSS

Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)

spip v4.1.10 - Spoofing Admin account

Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS)

Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)

WBCE CMS 1.6.1 - Open Redirect & CSRF
WebsiteBaker v2.13.3 - Directory Traversal
WebsiteBaker v2.13.3 - Stored XSS

WP AutoComplete 1.0.4 - Unauthenticated SQLi
 2023-07-04 00:16:26 +00:00
Exploit-DB
7807e6f266 DB: 2023-06-27 
7 changes to exploits/shellcodes/ghdb

Azure Apache Ambari 2302250400 - Spoofing

Microsoft SharePoint Enterprise Server 2016 - Spoofing

Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)

NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi

PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory

Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection

Xenforo Version 2.2.13 - Authenticated Stored XSS

Windows 11 22h2 - Kernel Privilege Elevation
 2023-06-27 00:17:09 +00:00
Exploit-DB
c79c4813de DB: 2023-06-24 
4 changes to exploits/shellcodes/ghdb

MCL-Net 4.3.5.8788 - Information Disclosure

Abantecart v1.3.2 - Authenticated Remote Code Execution

Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)

SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution

NCH Express Invoice - Clear Text Password Storage and Account Takeover
 2023-06-24 00:16:23 +00:00
Exploit-DB
ea194c414f DB: 2023-06-23 
3 changes to exploits/shellcodes/ghdb

Smart Office Web 20.28 - Remote Information Disclosure (Unauthenticated)

Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing

MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution

Super Socializer 7.13.52 - Reflected XSS
 2023-06-23 00:16:26 +00:00
Exploit-DB
00f6b3e7ed DB: 2023-06-22 
2 changes to exploits/shellcodes/ghdb

HiSecOS 04.0.01 - Privilege Escalation

SPIP v4.2.1 - Remote Code Execution (Unauthenticated)
SPIP v4.2.0 - Remote Code Execution (Unauthenticated)
 2023-06-22 00:16:26 +00:00
Exploit-DB
cc495bca11 DB: 2023-06-21 
8 changes to exploits/shellcodes/ghdb

Nokia ASIKA 7.13.52 - Hard-coded private key disclosure

SPIP v4.2.1 - Remote Code Execution (Unauthenticated)

Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)

Super Socializer 7.13.52 - Reflected XSS

WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
 2023-06-21 00:16:34 +00:00
Exploit-DB
147824bdba DB: 2023-06-20 
8 changes to exploits/shellcodes/ghdb

Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)

BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)

Diafan CMS 6.0 - Reflected Cross-Site Scripting (XSS)

Groomify v1.0 - SQL Injection

Jobpilot v2.61 - SQL Injection

Sales Tracker Management System v1.0 - Multiple Vulnerabilities

Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)

The Shop v2.5 - SQL Injection

WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password

Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
 2023-06-20 00:16:29 +00:00
Exploit-DB
1e4f82620a DB: 2023-06-16 
2 changes to exploits/shellcodes/ghdb

Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)
 2023-06-16 00:16:25 +00:00
Exploit-DB
158fcdfd5c DB: 2023-06-15 
11 changes to exploits/shellcodes/ghdb

Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak
Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution
Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution

Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)

Online Thesis Archiving System v1.0 - Multiple-SQLi

projectSend r1605 - CSV injection

projectSend r1605 - Stored XSS

Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)

Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
 2023-06-15 00:16:23 +00:00
Exploit-DB
ea8922f91d DB: 2023-06-14 
4 changes to exploits/shellcodes/ghdb

Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution

Online Examination System Project 1.0 - Cross-site request forgery (CSRF)

Sales Tracker Management System v1.0 - Multiple Vulnerabilities

Teachers Record Management System 1.0 - File Upload Type Validation
 2023-06-14 00:16:24 +00:00
Exploit-DB
38cd2cd776 DB: 2023-06-10 
4 changes to exploits/shellcodes/ghdb

BTCPay Server v1.7.4 - HTML Injection.
BTCPay Server v1.7.4 - HTML Injection

Thruk Monitoring Web Interface 3.06 - Path Traversal

WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)

Grafana <=6.2.4 - HTML Injection
 2023-06-10 00:16:34 +00:00
Exploit-DB
12f9039552 DB: 2023-06-08 
2 changes to exploits/shellcodes/ghdb

Apache 2.4.x - Buffer Overflow

Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)

USB Flash Drives Control 4.1.0.0 - Unquoted Service Path
 2023-06-08 00:16:21 +00:00
Exploit-DB
ccfd0c515d DB: 2023-06-07 
3 changes to exploits/shellcodes/ghdb

Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)

Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)

GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)

Macro Expert 4.9 - Unquoted Service Path
 2023-06-07 00:16:24 +00:00
Exploit-DB
25f2c0adca DB: 2023-06-05 
8 changes to exploits/shellcodes/ghdb

STARFACE 7.3.0.10 - Authentication with Password Hash Possible

Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

Best POS Management System v1.0 - Unauthenticated Remote Code Execution

Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)

Faculty Evaluation System 1.0 - Unauthenticated File Upload

File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

MotoCMS Version 3.4.3 - SQL Injection

Online Security Guards Hiring System 1.0 - Reflected XSS

Total CMS 1.7.4 - Remote Code Execution (RCE)

Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
 2023-06-05 00:16:22 +00:00
Exploit-DB
cb5c64da21 DB: 2023-06-01 
13 changes to exploits/shellcodes/ghdb

Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download
Pydio Cells 4.1.2 - Server-Side Request Forgery
Pydio Cells 4.1.2 - Unauthorised Role Assignments

Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)

MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)

Faculty Evaluation System 1.0 - Unauthenticated File Upload

Online Security Guards Hiring System 1.0 - Reflected XSS

Online shopping system advanced 1.0 - Multiple Vulnerabilities

Rukovoditel 3.3.1 - CSV injection

SCRMS 2023-05-27 1.0 - Multiple SQL Injection

Service Provider Management System v1.0 - SQL Injection

Ulicms-2023.1-sniffing-vicuna - Privilege escalation

unilogies/bumsys v1.0.3 beta - Unrestricted File Upload
 2023-06-01 00:16:25 +00:00
Exploit-DB
9e36596021 DB: 2023-05-27 
3 changes to exploits/shellcodes/ghdb

Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)

GetSimple CMS v3.3.16 - Remote Code Execution (RCE)

SitemagicCMS 4.4.3 - Remote Code Execution (RCE)

Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)
 2023-05-27 00:16:29 +00:00
Exploit-DB
9be142a874 DB: 2023-05-26 
7 changes to exploits/shellcodes/ghdb

Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)

SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)

Ulicms 2023.1 - create admin user via mass assignment

WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)

Zenphoto 1.6 - Multiple stored XSS

Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
 2023-05-26 00:16:47 +00:00
Exploit-DB
2b62bd319d DB: 2023-05-25 
3 changes to exploits/shellcodes/ghdb

Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE) via subprocess_execute

Service Provider Management System v1.0 - SQL Injection

WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE

Roxy WI v6.1.0.0 - Improper Authentication Control
 2023-05-25 00:16:26 +00:00
Exploit-DB
0a7adaa3fc DB: 2023-05-24 
40 changes to exploits/shellcodes/ghdb

Optoma 1080PSTX Firmware C02 - Authentication Bypass
Screen SFT DAB 600/C - Authentication Bypass Account Creation
Screen SFT DAB 600/C - Authentication Bypass Admin Password Change
Screen SFT DAB 600/C - Authentication Bypass Erase Account
Screen SFT DAB 600/C - Authentication Bypass Password Change
Screen SFT DAB 600/C - Authentication Bypass Reset Board Config
Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)

PnPSCADA v2.x - Unauthenticated PostgreSQL Injection

Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution

Yank Note v3.52.1 (Electron) - Arbitrary Code Execution

Apache Superset 2.0.0 - Authentication Bypass

FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)

PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)

Affiliate Me Version 5.0.1 - SQL Injection

Best POS Management System v1.0 - Unauthenticated Remote Code Execution

Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)

ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)

CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)

e107 v2.3.2 - Reflected XSS

File Thingie 2.5.7 - Remote Code Execution (RCE)

GetSimple CMS v3.3.16 - Remote Code Execution (RCE)

LeadPro CRM v1.0 - SQL Injection

PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)

Prestashop 8.0.4 - CSV injection

Quicklancer v1.0 - SQL Injection

SitemagicCMS 4.4.3 - Remote Code Execution (RCE)

Smart School v1.0 - SQL Injection

Stackposts Social Marketing Tool v1.0 - SQL Injection

thrsrossi Millhouse-Project 1.414 - Remote Code Execution

TinyWebGallery v2.5 - Remote Code Execution (RCE)

WBiz Desk 1.2 - SQL Injection

Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)

WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup

Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title

Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking

MobileTrans  4.0.11 - Weak Service Privilege Escalation

Trend Micro OfficeScan Client 10.0 - ACL Service LPE
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
 2023-05-24 00:16:34 +00:00
Exploit-DB
bfc4baf25a DB: 2023-05-14 
7 changes to exploits/shellcodes/ghdb

FLEX 1080 < 1085 Web 1.6.0 - Denial of Service

Epson Stylus SX510W Printer Remote Power Off - Denial of Service

Job Portal 1.0 - File Upload Restriction Bypass

Online Clinic Management System 2.2 - Multiple Stored Cross-Site Scripting (XSS)

RockMongo 1.1.7 - Stored Cross-Site Scripting (XSS)

TinyWebGallery v2.5 - Stored Cross-Site Scripting (XSS)
 2023-05-14 00:16:46 +00:00
Exploit-DB
59207f4242 DB: 2023-05-10 
2 changes to exploits/shellcodes/ghdb

Cmaps v8.0 - SQL injection

Online Pizza Ordering System v1.0 - Unauthenticated File Upload

Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)
 2023-05-10 00:16:24 +00:00
Exploit-DB
aada2be87a DB: 2023-05-08 
2 changes to exploits/shellcodes/ghdb

ChurchCRM v4.5.1 - Authenticated SQL Injection
ChurchCRM v4.5.3 - Authenticated SQL Injection
 2023-05-08 00:16:23 +00:00
Exploit-DB
8945b320b5 DB: 2023-05-06 
20 changes to exploits/shellcodes/ghdb

Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution

Cmaps v8.0 - SQL injection

EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal)

File Thingie 2.5.7 - Remote Code Execution (RCE)

Intern Record System v1.0 - SQL Injection (Unauthenticated)
Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls
Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path
Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts
Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
Jedox 2022.4.2 - Code Execution via RPC Interfaces
Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks
Jedox 2022.4.2 - Remote Code Execution via Directory Traversal

KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)

Online Pizza Ordering System v1.0 - Unauthenticated File Upload

pluck v4.7.18 - Stored Cross-Site Scripting (XSS)

Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)
Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE)
Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)

Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
 2023-05-06 00:16:26 +00:00
Exploit-DB
668314bbda DB: 2023-05-03 
19 changes to exploits/shellcodes/ghdb

FS-S3900-24T4S - Privilege Escalation

Virtual Reception v1.0 - Web Server Directory Traversal

admidio v4.2.5 - CSV Injection

Companymaps v8.0 - Stored Cross Site Scripting (XSS)

GLPI 9.5.7 - Username Enumeration

OpenEMR v7.0.1 - Authentication credentials brute force

PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting

PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)
PHPJabbers Simple CMS 5.0 - SQL Injection
PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)

phpMyFAQ v3.1.12 - CSV Injection

projectSend r1605 - Private file download

revive-adserver v5.4.1 - Cross-Site Scripting (XSS)

Serendipity 2.4.0 - File Inclusion RCE

SoftExpert (SE) Suite v2.1.3 - Local File Inclusion

Advanced Host Monitor v12.56 - Unquoted Service Path

MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
 2023-05-03 00:16:23 +00:00
Exploit-DB
91a0e53b65 DB: 2023-04-29 
9 changes to exploits/shellcodes/ghdb

pfsenseCE v2.6.0 - Anti-brute force protection bypass
Art Gallery Management System Project in PHP v 1.0 - SQL injection
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated
Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated
Art Gallery Management System Project in PHP v 1.0 - SQL injection
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated
Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)

pfsenseCE v2.6.0 - Anti-brute force protection bypass
 2023-04-29 00:16:28 +00:00
Exploit-DB
1015b02d68 DB: 2023-04-28 
2 changes to exploits/shellcodes/ghdb

Answerdev 1.0.3 - Account Takeover

ChurchCRM v4.5.1 - Authenticated SQL Injection
 2023-04-28 00:16:25 +00:00
Exploit-DB
7e3a257da8 DB: 2023-04-26 
11 changes to exploits/shellcodes/ghdb

PaperCut NG/MG 22.0.4 - Authentication Bypass

KodExplorer 4.49 - CSRF to Arbitrary File Upload

Mars Stealer 8.3 - Admin Account Takeover

Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution

Sophos Web Appliance 4.3.10.4 - Pre-auth command injection

Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path

OCS Inventory NG 2.3.0.0 - Unquoted Service Path

Wondershare Filmora 12.2.9.2233 - Unquoted Service Path

Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
 2023-04-26 00:16:27 +00:00
Exploit-DB
673c08ece5 DB: 2023-04-25 
4 changes to exploits/shellcodes/ghdb

ImageMagick 7.1.0-49 - Arbitrary File Read

ImageMagick 7.1.0-49 - Arbitrary File Read

Paid Memberships Pro  v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection

pdfkit v0.8.7.2 - Command Injection
 2023-04-25 00:16:26 +00:00
Exploit-DB
79466d14c8 DB: 2023-04-24 
4 changes to exploits/shellcodes/ghdb

EasyNas 1.1.0 - OS Command Injection

EasyNas 1.1.0 - OS Command Injection
 2023-04-24 00:16:20 +00:00
Exploit-DB
bd09027499 DB: 2023-04-21 
18 changes to exploits/shellcodes/ghdb

Franklin Fueling Systems TS-550 - Default Password

Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information

Linux Kernel 6.2 -  Userspace Processes To Enable Mitigation

Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)

Chitor-CMS v1.1.2 - Pre-Auth SQL Injection

GDidees CMS 3.9.1 - Local File Disclosure

Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)

Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)

ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE)
Serendipity 2.4.0 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated)

FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE)

AspEmail v5.6.0.2 - Local Privilege Escalation

File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
 2023-04-21 00:16:25 +00:00
Exploit-DB
2f07358143 DB: 2023-04-15 
16 changes to exploits/shellcodes/ghdb

InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal

Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation
Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking
Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery
Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password
Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP
Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit
Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset
Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation
Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure

Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)

Bludit 4.0.0-rc-2 - Account takeover

Microsoft Windows 11 - 'cmd.exe' Denial of Service
 2023-04-15 00:16:19 +00:00
Exploit-DB
0cb2c9699d DB: 2023-04-11 
8 changes to exploits/shellcodes/ghdb

Roxy Fileman 1.4.5 -  Arbitrary File Upload

Paradox Security Systems IPR512 - Denial Of Service

WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE

Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

BrainyCP V1.0 - Remote Code Execution

Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

ever gauzy v0.281.9 - JWT weak HMAC secret
 2023-04-11 00:16:33 +00:00
Exploit-DB
85954a8fad DB: 2023-04-09 
34 changes to exploits/shellcodes/ghdb

ENTAB ERP 1.0 - Username PII leak

ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)

ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

FortiRecorder 6.4.3 - Denial of Service

Schneider Electric v1.0 - Directory traversal & Broken Authentication

Altenergy Power Control Software C1.2.5 - OS command injection

Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

Google Chrome  109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

Lucee Scheduled Job v1.0 -  Command Execution

Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

Adobe Connect 11.4.5 - Local File Disclosure

Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

Suprema BioStar 2 v2.8.16 - SQL Injection

Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure

Icinga Web 2.10 - Arbitrary File Disclosure

Joomla! v4.2.8 - Unauthenticated information disclosure

Medicine Tracker System v1.0 - Sql Injection

Online Appointment System V1.0 - Cross-Site Scripting (XSS)

Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

pfsenseCE v2.6.0 - Anti-brute force protection bypass

Restaurant Management System 1.0  - SQL Injection

WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)
X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

Microsoft Windows 11 - 'cmd.exe' Denial of Service

ActFax 10.10 - Unquoted Path Services

ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
 2023-04-09 00:16:30 +00:00
Exploit-DB
99cef8d064 DB: 2023-04-08 
11 changes to exploits/shellcodes/ghdb

Snitz Forum v1.0 - Blind SQL Injection

Franklin Fueling Systems  TS-550 - Exploit and Default Password

Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing

MAC 1200R - Directory Traversal

Docker based datastores for IBM Instana 241-2 243-0 - No Authentication

IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)

ChurchCRM 4.5.1 - Authenticated SQL Injection

NotrinosERP 0.7 - Authenticated Blind SQL Injection

Rukovoditel 3.3.1 - Remote Code Execution (RCE)

Wondershare Dr Fone 12.9.6 - Privilege Escalation
 2023-04-08 00:16:27 +00:00
Exploit-DB
d7c9ba572a DB: 2023-04-07 
50 changes to exploits/shellcodes/ghdb

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI

ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access

Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)
Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection
Osprey Pump Controller 1.0.1 - (pseudonym) Semi-blind Command Injection
Osprey Pump Controller 1.0.1 - (userName) Blind Command Injection
Osprey Pump Controller 1.0.1 - Administrator Backdoor Access
Osprey Pump Controller 1.0.1 - Authentication Bypass Credentials Modification
Osprey Pump Controller 1.0.1 - Cross-Site Request Forgery
Osprey Pump Controller 1.0.1 - Predictable Session Token / Session Hijack
Osprey Pump Controller 1.0.1 - Unauthenticated File Disclosure
Osprey Pump Controller 1.0.1 - Unauthenticated Remote Code Execution Exploit
Osprey Pump Controller v1.0.1 - Unauthenticated Reflected XSS

WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE

HospitalRun  1.0.0-beta - Local Root Exploit for macOS

Adobe Connect 10 - Username Disclosure

craftercms 4.x.x - CORS

EasyNas 1.1.0 - OS Command Injection

Agilebio Lab Collector Electronic Lab Notebook  v4.234 - Remote Code Execution (RCE)

Art Gallery Management System Project in PHP v 1.0 - SQL injection

atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE
Auto Dealer Management System 1.0 - Broken Access Control Exploit
Auto Dealer Management System v1.0 - SQL Injection
Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php
Auto Dealer Management System v1.0 - SQL Injection on manage_user.php
Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload
Best pos Management System v1.0 - SQL Injection

ChurchCRM v4.5.3-121fcc1 - SQL Injection

Dompdf 1.2.1 - Remote Code Execution (RCE)
Employee Task Management System v1.0 - Broken Authentication
Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)
Employee Task Management System v1.0 - SQL Injection on edit-task.php

flatnux 2021-03.25 - Remote Code Execution (Authenticated)

Intern Record System v1.0 - SQL Injection (Unauthenticated)

Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking

LDAP Tool Box Self Service Password v1.5.2 -  Account takeover
Music Gallery Site v1.0 - Broken Access Control
Music Gallery Site v1.0 - SQL Injection on  music_list.php
Music Gallery Site v1.0 - SQL Injection on page Master.php
Music Gallery Site v1.0 - SQL Injection on page view_music_details.php

POLR URL 2.3.0 - Shortener Admin Takeover

Purchase Order Management-1.0 - Local File Inclusion

Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)

Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)

modoboa  2.0.4 - Admin TakeOver

pdfkit v0.8.7.2 - Command Injection

FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking

Windows 11 10.0.22000 -  Backup service Privilege Escalation

TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)

Unified Remote 3.13.0 - Remote Code Execution (RCE)
 2023-04-07 00:16:28 +00:00
Exploit-DB
d46ab98863 DB: 2023-04-06 
32 changes to exploits/shellcodes/ghdb

Answerdev 1.0.3 - Account Takeover

D-Link DIR-846 - Remote Command Execution (RCE) vulnerability

Dell EMC Networking PC5500 firmware versions 4.1.0.22 and  Cisco Sx / SMB - Information Disclosure

SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow

ERPNext 12.29 - Cross-Site Scripting (XSS)

Liferay Portal 6.2.5 - Insecure Permissions

GNU screen v4.9.0 - Privilege Escalation

Apache Tomcat 10.1 - Denial Of Service

PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)

BTCPay Server v1.7.4 - HTML Injection.

Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE)

Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)

ImageMagick 7.1.0-49 - DoS

bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS)

Bus Pass Management System 1.0  - Stored Cross-Site Scripting (XSS)

Calendar Event Multi View  1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)

CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)

Control Web Panel 7 (CWP7) v0.9.8.1147 -  Remote Code Execution (RCE)

Froxlor 2.0.3 Stable - Remote Code Execution (RCE)

ImageMagick 7.1.0-49 - Arbitrary File Read

itech TrainSmart r1044 - SQL injection

Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated)

PhotoShow 3.0 - Remote Code Execution

projectSend r1605 - Remote Code Exectution RCE

Responsive FileManager 9.9.5 - Remote Code Execution (RCE)

zstore 6.6.0 - Cross-Site Scripting (XSS)

Binwalk v2.3.2 - Remote Command Execution (RCE)

XWorm Trojan 2.1 - Null Pointer Derefernce DoS

Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution)

Linux/x86_64 - bash Shellcode with xor encoding
 2023-04-06 00:16:31 +00:00
Exploit-DB
d4e68dbb7e DB: 2023-04-04 
39 changes to exploits/shellcodes/ghdb

ProLink PRS1841 PLDT Home fiber - Default Password

Nacos 2.0.3 - Access Control vulnerability

sudo 1.8.0 to 1.9.12p1 - Privilege Escalation

sleuthkit 4.11.1 - Command Injection

Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS)

ManageEngin AMP 4.3.0 - File-path-traversal

SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS)

AmazCart CMS 3.4 - Cross-Site-Scripting (XSS)
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated
Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated

ChiKoi v1.0 - SQL Injection

ERPGo SaaS 3.9 - CSV Injection

GLPI  Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)

GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
GLPI Activity  v3.1.0 - Authenticated Local File Inclusion on Activity plugin
GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion
GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure
GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration)

Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)

MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)

Paid Memberships Pro  v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection

pimCore v5.4.18-skeleton  - Sensitive Cookie with Improper SameSite Attribute

Prizm Content Connect v10.5.1030.8315 - XXE

SLIMSV 9.5.2 - Cross-Site Scripting (XSS)

WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE

Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)
Roxy WI v6.1.0.0 - Improper Authentication Control
Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload

Solaris 10 libXm - Buffer overflow Local privilege escalation

Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path

Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow

HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path

Microsoft Exchange Active Directory Topology 15.02.1118.007 - 'Service MSExchangeADTopology' Unquoted Service Path

Windows 11 10.0.22000 -  Backup service Privilege Escalation

Windows/x86 - Create Administrator User / Dynamic PEB & EDT method null-free Shellcode (373 bytes)
 2023-04-04 00:16:32 +00:00
Exploit-DB
3de26153c8 DB: 2023-04-02 
23 changes to exploits/shellcodes/ghdb

ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)

Hughes Satellite Router HX200 v8.3.1.14 -  Remote File Inclusion

Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)

TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated)

GeoVision Camera GV-ADR2701 - Authentication Bypass

AD Manager Plus 7122 - Remote Code Execution (RCE)

Enlightenment v0.25.3 - Privilege escalation

Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)

Apache 2.4.x - Buffer Overflow

perfSONAR v4.4.5 - Partial Blind CSRF

SugarCRM 12.2.0 - Remote Code Execution (RCE)

XCMS v1.83 - Remote Command Execution (RCE)

Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)

GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)

AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS)

NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit

Splashtop 8.71.12001.0 - Unquoted Service Path

Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)

FlipRotation v1.0 decoder - Shellcode (146 bytes)

Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes)

macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
 2023-04-02 00:16:21 +00:00
Exploit-DB
9b56e8731e DB: 2023-04-01 
25 changes to exploits/shellcodes/ghdb

EQ Enterprise management system v2.2.0 - SQL Injection

qubes-mirage-firewall  v0.8.3 - Denial Of Service (DoS)

ASKEY RTF3505VW-N1 - Privilege Escalation

Bangresto 1.0 - SQL Injection

Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated)

Cacti v1.2.22 - Remote Command Execution (RCE)
Judging Management System v1.0 - Authentication Bypass
Judging Management System v1.0 - Remote Code Execution (RCE)

rconfig 3.9.7 - Sql Injection (Authenticated)

Senayan Library Management System v9.0.0 - SQL Injection

Spitfire CMS 1.0.475 - PHP Object Injection

Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated)

WooCommerce v7.1.0 - Remote Code Execution(RCE)

CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x  -  Denial Of Service (DoS)
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x  - Authorization Bypass (IDOR)
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE)
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset
SOUND4 Server Service 4.1.102 - Local Privilege Escalation

macOS/x64 - Execve Null-Free Shellcode
 2023-04-01 00:16:31 +00:00
Exploit-DB
42ade901fe DB: 2023-03-31 
22 changes to exploits/shellcodes/ghdb

LISTSERV 17 - Insecure Direct Object Reference (IDOR)
LISTSERV 17 - Reflected Cross Site Scripting (XSS)

Router ZTE-H108NS - Stack Buffer Overflow (DoS)

Router ZTE-H108NS - Authentication Bypass

Boa Web Server v0.94.14 - Authentication Bypass

Covenant v0.5 - Remote Code Execution (RCE)

Dreamer CMS v4.0.0 - SQL Injection

Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)

Virtual Reception v1.0 - Web Server Directory Traversal

4images 1.9 - Remote Command Execution (RCE)

ClicShopping v3.402 - Cross-Site Scripting (XSS)

Concrete5 CME v9.1.3 - Xpath injection

Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)

Ecommerse v1.0 - Cross-Site Scripting (XSS)

Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS)

myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)

WPForms 1.7.8 - Cross-Site Scripting (XSS)

CrowdStrike Falcon AGENT  6.44.15806  - Uninstall without Installation Token

Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path

Zillya Total Security 3.0.2367.0  - Local Privilege Escalation
 2023-03-31 00:16:26 +00:00
Exploit-DB
564d2ddf47 DB: 2023-03-30 
13 changes to exploits/shellcodes/ghdb

DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure

Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS)

Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)

Helmet Store Showroom v1.0 - SQL Injection

Human Resource Management System 1.0 - SQL Injection (unauthenticated)

Revenue Collection System v1.0 - Remote Code Execution (RCE)

WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)

Outline V1.6.0 - Unquoted Service Path
Inbit Messenger v4.9.0 - Unauthenticated Remote Command Execution (RCE)
Inbit Messenger v4.9.0 - Unauthenticated Remote SEH Overflow

Internet Download Manager v6.41 Build 3 - Remote Code Execution (RCE)
 2023-03-30 00:16:31 +00:00
Exploit-DB
6bc7a6f9b0 DB: 2023-03-29 
25 changes to exploits/shellcodes/ghdb

ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)

Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access

ZKTeco ZEM/ZMM 8.88 - Missing Authentication

Hashicorp Consul v1.0 - Remote Command Execution (RCE)

X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)

OPSWAT Metadefender Core - Privilege Escalation

Pega Platform 8.1.0 - Remote Code Execution (RCE)

Beauty-salon v1.0 - Remote Code Execution (RCE)

BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)

iBooking v1.0.8 - Arbitrary File Upload

Jetpack 11.4 - Cross Site Scripting (XSS)

Moodle LMS 4.0 - Cross-Site Scripting (XSS)

Online shopping system advanced 1.0 - Multiple Vulnerabilities

rukovoditel 3.2.1 - Cross-Site Scripting (XSS)

Senayan Library Management System v9.5.0 - SQL Injection

Social-Share-Buttons v2.2.3 - SQL Injection

Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)

YouPHPTube<= 7.8 - Multiple Vulnerabilities

Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)

SuperMailer v11.20 - Buffer overflow DoS

Tunnel Interface Driver - Denial of Service

VMware Workstation 15 Pro - Denial of Service

HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path

SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
 2023-03-29 00:16:31 +00:00