bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2774 commits 1 branch 0 tags 292 MiB
Commit graph

697 commits

Author SHA1 Message Date
Offensive Security
216721f32c DB: 2020-12-01 
4 changes to exploits/shellcodes

YATinyWinFTP - Denial of Service (PoC)
ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure
Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)
Intelbras Router RF 301K 1.1.2 - Authentication Bypass
 2020-12-01 05:01:56 +00:00
Offensive Security
673a45a464 DB: 2020-11-28 
13 changes to exploits/shellcodes

libupnp 1.6.18 - Stack-based buffer overflow (DoS)
SAP Lumira 1.31 - Stored Cross-Site Scripting
Foxit Reader 9.0.1.1049 - Arbitrary Code Execution
Wordpress Theme Wibar 1.1.8 - 'Brand Component' Stored Cross Site Scripting
WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting
Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution
Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF
Moodle 3.8 - Unrestricted File Upload
Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated)
House Rental 1.0 - 'keywords' SQL Injection
ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting
Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
 2020-11-28 05:01:59 +00:00
Offensive Security
1306b3ff5f DB: 2020-11-27 
2 changes to exploits/shellcodes

Pure-FTPd 1.0.48 - Remote Denial of Service

Razer Chroma SDK Server 3.16.02 - Race Condition Remote File Execution
 2020-11-27 05:01:55 +00:00
Offensive Security
ce8af77d3e DB: 2020-11-26 
4 changes to exploits/shellcodes

Wondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service Path
WonderCMS 3.1.3 - 'page' Persistent Cross-Site Scripting
osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting
SyncBreeze 10.0.28 - 'password' Remote Buffer Overflow
 2020-11-26 05:01:56 +00:00
Offensive Security
a41b8b4637 DB: 2020-11-25 
7 changes to exploits/shellcodes

docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter)
nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting
Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service
ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)
Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated)
OpenCart 3.0.3.6 - 'Profile Image' Stored Cross-Site Scripting (Authenticated)
OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting
 2020-11-25 05:01:56 +00:00
Offensive Security
35dd7185fd DB: 2020-11-24 
6 changes to exploits/shellcodes

Boxoft Audio Converter 2.3.0 - '.wav' Buffer Overflow (SEH)

MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection

MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass
VTiger v7.0 CRM - 'To' Persistent XSS
LifeRay 7.2.1 GA2 - Stored XSS
 2020-11-24 05:02:01 +00:00
Offensive Security
c14496840d DB: 2020-11-21 
5 changes to exploits/shellcodes

Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH)
IBM Tivoli Storage Manager Command Line Administrative Interface 5.2.0.1 - id' Field Stack Based Buffer Overflow
Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)
Boxoft Convert Master 1.3.0 - 'wav' SEH Local Exploit

WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting
 2020-11-21 05:01:59 +00:00
Offensive Security
21fa83f241 DB: 2020-11-20 
12 changes to exploits/shellcodes

Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)

Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure
Joomla! Component com_memorix - SQL Injection
Joomla! Component com_informations - SQL Injection
Joomla! Component com_memorix - SQL Injection
Joomla! Component com_informations - SQL Injection
PESCMS TEAM 2.3.2 - Multiple Reflected XSS
Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification
xuucms 3 - 'keywords' SQL Injection
Gitlab 12.9.0 - Arbitrary File Read (Authenticated)
TestBox CFML Test Framework 4.1.0 - Arbitrary File Write and Remote Code Execution
TestBox CFML Test Framework 4.1.0 - Directory Traversal
Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection
M/Monit 3.7.4 - Privilege Escalation
M/Monit 3.7.4 - Password Disclosure
Nagios Log Server 2.1.7 - Persistent Cross-Site Scripting
 2020-11-20 05:02:04 +00:00
Offensive Security
e57ba82919 DB: 2020-11-19 
3 changes to exploits/shellcodes

ZeroLogon - Netlogon Elevation of Privilege
Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)
BigBlueButton 2.2.25 - Arbitrary File Disclosure and Server-Side Request Forgery
 2020-11-19 05:02:00 +00:00
Offensive Security
66d1f19fa5 DB: 2020-11-18 
17 changes to exploits/shellcodes

Internet Explorer 11 - Use-After-Free
Microsoft Internet Explorer 11 - Use-After-Free

LCD_Service 1.0.1.0 - 'LCD_Service' Unquote Service Path

Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption
Aerospike Database 5.1.0.3 - OS Command Execution
Apache Struts 2.5.20 - Double OGNL evaluation

Car Rental Management System 1.0 - 'id' SQL Injection (Authenticated)
Online Doctor Appointment Booking System PHP and Mysql 1.0 - 'q' SQL Injection
EgavilanMedia User Registration & Login System with Admin Panel Exploit - SQLi Auth Bypass
SugarCRM 6.5.18 - Persistent Cross-Site Scripting
WordPress Plugin Buddypress 6.2.0 - Persistent Cross-Site Scripting

Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting
 2020-11-18 05:01:57 +00:00
Offensive Security
c7e37046e7 DB: 2020-11-17 
12 changes to exploits/shellcodes

KiteService 1.2020.1113.1 - 'KiteService.exe' Unquoted Service Path
Advanced System Care Service 13 - 'AdvancedSystemCareService13' Unquoted Service Path
Logitech Solar Keyboard Service - 'L4301_Solar' Unquoted Service Path
Atheros Coex Service Application 8.0.0.255 - 'ZAtheros Bt&Wlan Coex Agent' Unquoted Service Path

Cisco 7937G - DoS/Privilege Escalation
Pandora FMS 7.0 NG 749 - 'CG Items' SQL Injection (Authenticated)
Water Billing System 1.0 - 'id' SQL Injection (Authenticated)
Car Rental Management System 1.0 - 'id' SQL Injection (Authenticated)
User Registration & Login and User Management System 2.1 - Login Bypass SQL Injection
PMB 5.6 - 'chemin' Local File Disclosure
Car Rental Management System 1.0 - Remote Code Execution (Authenticated)
Car Rental Management System 1.0 - 'car_id' Sql Injection
 2020-11-17 05:01:57 +00:00
Offensive Security
b33d1ec015 DB: 2020-11-14 
10 changes to exploits/shellcodes

DigitalPersona 5.1.0.656 'DpHostW' - Unquoted Service Path
SAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service Path
IDT PC Audio 1.0.6425.0 - 'STacSV' Unquoted Service Path
Bludit 3.9.2 - Authentication Bruteforce Bypass (Metasploit)
Citrix ADC NetScaler - Local File Inclusion (Metasploit)
Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Metasploit)
Touchbase.io 1.10 - Stored Cross Site Scripting
OpenCart Theme Journal 3.1.0 - Sensitive Data Exposure
October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)

ASUS TM-AC1900 - Arbitrary Command Execution (Metasploit)
 2020-11-14 05:01:59 +00:00
Offensive Security
ccc8fe2331 DB: 2020-11-13 
7 changes to exploits/shellcodes

Nidesoft 3GP Video Converter 2.6.18 - Local Stack Buffer Overflow

WordPress Plugin Simple File List 5.4 - Arbitrary File Upload
WordPress Plugin Simple File List 4.2.2 - Arbitrary File Upload
Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
Wordpress Plugin Good LMS 2.1.4 - 'id' Unauthenticated SQL Injection

WordPress Plugin Simple File List 5.4 - Remote Code Execution

WordPress Plugin Simple File List 4.2.2 - Remote Code Execution
 2020-11-13 05:01:58 +00:00
Offensive Security
3774170267 DB: 2020-11-11 
4 changes to exploits/shellcodes

Car Rental Management System 1.0 - SQL injection + Arbitrary File Upload
ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting
Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
 2020-11-11 05:01:56 +00:00
Offensive Security
e797f5230d DB: 2020-11-10 
24 changes to exploits/shellcodes

HP Display Assistant x64 Edition 3.20 - 'DTSRVC' Unquoted Service Path
KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path
Winstep 18.06.0096 - 'Xtreme Service' Unquoted Service Path
OKI sPSV Port Manager 1.0.41 - 'sPSVOpLclSrv' Unquoted Service Path
IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path
Genexus Protection Server 9.6.4.2 - 'protsrvservice' Unquoted Service Path
DigitalPersona 4.5.0.2213 - 'DpHostW' Unquoted Service Path
Syncplify.me Server! 5.0.37 - 'SMWebRestServicev5' Unquoted Service Path
HP WMI Service 1.4.8.0 - 'HPWMISVC.exe' Unquoted Service Path
Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path
Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path
Motorola Device Manager 2.5.4 - 'ForwardDaemon.exe ' Unquoted Service Path
Realtek Andrea RT Filters 1.0.64.10 - 'AERTSr64.EXE' Unquoted Service Path
MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path
Magic Mouse 2 utilities  2.20 - 'magicmouse2service' Unquoted Service Path
iDeskService 3.0.2.1 - 'iDeskService' Unquoted Service Path
Canon Inkjet Extended Survey Program 5.1.0.8 - 'IJPLMSVC.EXE'  - Unquoted Service Path
Deep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service Path
RealTimes Desktop Service 18.1.4 - 'rpdsvc.exe' Unquoted Service Path
DiskBoss v11.7.28 - Multiple Services Unquoted Service Path
Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path
Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF
SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)
Joplin 1.2.6 - 'link' Cross Site Scripting
 2020-11-10 05:02:05 +00:00
Offensive Security
6eb03eae23 DB: 2020-11-06 
5 changes to exploits/shellcodes

Amarok 2.8.0 - Denial-of-Service

TP-Link WDR4300 - Remote Code Execution (Authenticated)
iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)
iDS6 DSSPro Digital Signage System 6.2 - CAPTCHA Security Bypass
iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation
 2020-11-06 05:01:58 +00:00
Offensive Security
543f8dc781 DB: 2020-11-05 
5 changes to exploits/shellcodes

Processwire CMS 2.4.0 - 'download' Local File Inclusion
PDW File Browser 1.3 - Remote Code Execution
School Log Management System 1.0 - 'username' SQL Injection / Remote Code Execution
Student Attendance Management System 1.0 - 'username' SQL Injection / Remote Code Execution
 2020-11-05 05:01:59 +00:00
Offensive Security
3cad5bf9ad DB: 2020-11-03 
6 changes to exploits/shellcodes

Foxit Reader 9.7.1 - Remote Command Execution (Javascript API)
Quick N Easy FTP Service 3.2 - Unquoted Service Path
Apache Flink 1.9.x - File Upload RCE (Unauthenticated)
WordPress Plugin Simple File List 5.4 - Arbitrary File Upload
Monitorr 1.7.6m - Remote Code Execution (Unauthenticated)
Monitorr 1.7.6m - Authorization Bypass
 2020-11-03 05:02:04 +00:00
Offensive Security
e178c80d85 DB: 2020-10-29 
10 changes to exploits/shellcodes

PackageKit < 1.1.13 - File Existence Disclosure
aptdaemon < 1.1.1 - File Existence Disclosure
Blueman < 2.1.4 - Local Privilege Escalation
Exploit - EPSON 1.124 - 'seksmdb.exe' Unquoted Service Path
Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path
Prey 1.9.6 - _CronService_ Unquoted Service Path
IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path
Nagios XI 5.7.3 - 'mibs.php' Remote Command Injection (Authenticated)
CSE Bookstore 1.0 - Authentication Bypass
Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion
 2020-10-29 05:02:08 +00:00
Offensive Security
17bbfdaf38 DB: 2020-10-28 
6 changes to exploits/shellcodes

TDM Digital Signage PC Player 4.1 - Insecure File Permissions
Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root
GoAhead Web Server 5.1.1 - Digest Authentication Capture Replay Nonce Reuse

InoERP 0.7.2 - Remote Code Execution (Unauthenticated)
Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)
Client Management System 1.0 - 'searchdata' SQL injection
Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)
 2020-10-28 05:02:08 +00:00
Offensive Security
a3aad6c41a DB: 2020-10-15 
3 changes to exploits/shellcodes

Guild Wars 2 - Insecure Folder Permissions

TimeClock Software 0.995 - Multiple SQL Injections
TimeClock Software 0.995 - (Authenticated ) Multiple SQL Injections
TimeClock Software 1.01 0 - (Authenticated) Time-Based SQL Injection
NodeBB Forum 1.12.2-1.14.2 - Account Takeover
 2020-10-15 05:02:06 +00:00
Offensive Security
973a669c08 DB: 2020-10-14 
2 changes to exploits/shellcodes

Battle.Net 1.27.1.12428 - Insecure File Permissions

berliCRM 1.0.24 - 'src_record' SQL Injection
 2020-10-14 05:02:04 +00:00
Offensive Security
1fbf4d267e DB: 2020-10-08 
2 changes to exploits/shellcodes

BACnet Test Server 1.01 - Remote Denial of Service (PoC)

Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting
 2020-10-08 05:02:12 +00:00
Offensive Security
fdab02c0ff DB: 2020-09-30 
3 changes to exploits/shellcodes

BearShare Lite 5.2.5 - 'Advanced Search'Buffer Overflow in (PoC)
CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASLR)

WebsiteBaker 2.12.2 - Remote Code Execution
 2020-09-30 05:02:05 +00:00
Offensive Security
345eb88be8 DB: 2020-09-29 
3 changes to exploits/shellcodes

MSI Ambient Link Driver 1.0.0.8 - Local Privilege Escalation
Mida eFramework 2.8.9 - Remote Code Execution
Joplin 1.0.245 - Arbitrary Code Execution (PoC)
 2020-09-29 05:02:03 +00:00
Offensive Security
00b27610c8 DB: 2020-09-24 
2 changes to exploits/shellcodes

Online Food Ordering System 1.0 - Remote Code Execution
 2020-09-24 05:02:05 +00:00
Offensive Security
87f49d4427 DB: 2020-09-22 
6 changes to exploits/shellcodes

ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path
Online Shop Project 1.0 - 'p' SQL Injection
BlackCat CMS 1.3.6 - Cross-Site Request Forgery
Seat Reservation System 1.0 - 'id' SQL Injection
Mida eFramework 2.9.0 - Back Door Access
B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution
 2020-09-22 05:02:05 +00:00
Offensive Security
133dc9fc81 DB: 2020-09-18 
1 changes to exploits/shellcodes

Microsoft SQL Server Reporting Services 2016 - Remote Code Execution
 2020-09-18 05:02:05 +00:00
Offensive Security
3080c3ca18 DB: 2020-09-17 
2 changes to exploits/shellcodes

Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software

Piwigo 2.10.1 - Cross Site Scripting
 2020-09-17 05:02:05 +00:00
Offensive Security
903280c17b DB: 2020-09-15 
6 changes to exploits/shellcodes

Rapid7 Nexpose Installer 6.6.39 - 'nexposeengine' Unquoted Service Path
Pearson Vue VTS 2.3.1911 Installer - 'VUEApplicationWrapper' Unquoted Service Path
RAD SecFlow-1v SF_0290_2.3.01.26  - Persistent Cross-Site Scripting
RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)
Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)
 2020-09-15 05:02:06 +00:00
Offensive Security
e2117e4eb7 DB: 2020-09-12 
4 changes to exploits/shellcodes

Gnome Fonts Viewer 3.34.0 - Heap Corruption
Internet Explorer 11 - Use-After-Free
VTENEXT 19 CE - Remote Code Execution
Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)
 2020-09-12 05:02:05 +00:00
Offensive Security
73dd822b51 DB: 2020-09-10 
4 changes to exploits/shellcodes

Input Director 1.4.3 - 'Input Director' Unquoted Service Path
Audio Playback Recorder 3.2.2 - Local Buffer Overflow (SEH)
Tailor Management System - 'id' SQL Injection
Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery (change admin password)
 2020-09-10 05:02:04 +00:00
Offensive Security
39b0da41ed DB: 2020-09-09 
1 changes to exploits/shellcodes

ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path
 2020-09-09 05:02:07 +00:00
Offensive Security
e286aad002 DB: 2020-09-05 
1 changes to exploits/shellcodes

Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path
 2020-09-05 05:02:01 +00:00
Offensive Security
0d540768a4 DB: 2020-09-04 
5 changes to exploits/shellcodes

BarracudaDrive v6.5 - Insecure Folder Permissions
Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting
BloodX CMS 1.0 - Authentication Bypass
Daily Tracker System 1.0 - Authentication Bypass
SiteMagic CMS 4.4.2 - Arbitrary File Upload (Authenticated)
 2020-09-04 05:02:06 +00:00
Offensive Security
d6bcc3b093 DB: 2020-09-01 
5 changes to exploits/shellcodes

BlazeDVD 7.0 Professional - '.plf' Local Buffer Overflow (SEH_ASLR_DEP)
Online Book Store 1.0 - 'id' SQL Injection
Mara CMS  7.5 - Reflective Cross-Site Scripting
Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)
CMS Made Simple 2.2.14 - Arbitrary File Upload (Authenticated)
 2020-09-01 05:02:09 +00:00
Offensive Security
2621b3c52e DB: 2020-08-28 
3 changes to exploits/shellcodes

ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow (DEP_ASLR Bypass) (PoC)
Mida eFramework 2.9.0 - Remote Code Execution
Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)
 2020-08-28 05:01:55 +00:00
Offensive Security
ba30f5e257 DB: 2020-08-11 
3 changes to exploits/shellcodes

BarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service Path
Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)
ManageEngine ADSelfService Build prior to 6003 - Remote Code Execution (Unauthenticated)
 2020-08-11 05:01:48 +00:00
Offensive Security
0d0e6419f1 DB: 2020-08-07 
2 changes to exploits/shellcodes

CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path

Victor CMS 1.0 - 'Search' SQL Injection
 2020-08-07 05:01:51 +00:00
Offensive Security
b4336a2935 DB: 2020-08-06 
3 changes to exploits/shellcodes

ACTi NVR3 Standard or Professional Server 3.0.12.42 - Denial of Service (PoC)
QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)

Stock Management System 1.0 - Authentication Bypass
 2020-08-06 05:01:49 +00:00
Offensive Security
9384c59418 DB: 2020-08-05 
4 changes to exploits/shellcodes

Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (PoC)
RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)
Pi-hole 4.3.2 - Remote Code Execution (Authenticated)
Daily Expenses Management System 1.0 - 'username' SQL Injection
 2020-08-05 05:01:47 +00:00
Offensive Security
720fabd066 DB: 2020-07-28 
114 changes to exploits/shellcodes

Notepad++ < 7.7 (x64)  - Denial of Service

winrar 5.80 64bit - Denial of Service
WinRAR 5.80 (x64) - Denial of Service

Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter target_offset Out-of-Bounds Privilege Escalation
Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter 'target_offset' Out-of-Bounds Privilege Escalation

TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change

Microsoft Windows 7 SP1 x86 - GDI Palette Objects Local Privilege Escalation (MS17-017)
Microsoft Windows 7 SP1 (x86) - GDI Palette Objects Local Privilege Escalation (MS17-017)

Microsoft Word 2007 (x86) - Information Disclosure

IKARUS anti.virus 2.16.7 - 'ntguard_x64' Local Privilege Escalation

ASX to MP3 Converter 1.82.50 (Windows 2003 x86) - '.asx' Local Stack Overflow
Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation
Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation

Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution
Microsoft Internet Explorer 11 (Windows 7 x86/x64) - vbscript Code Execution

Linux Kernel 2.6.x / 3.10.x / 4.14.x (RedHat / Debian / CentOS) (x64) - 'Mutagen Astronomy' Local Privilege Escalation

R 3.4.4 (Windows 10 x64) - Buffer Overflow (DEP/ASLR Bypass)

MySQL User-Defined (Linux) (x32/x86_64) - 'sys_exec' Local Privilege Escalation
MySQL User-Defined (Linux) (x86) - 'sys_exec' Local Privilege Escalation

Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)

Microsoft Windows (x84/x64) - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation
Microsoft Windows (x86/x64) - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation

Microsoft Windows (x86) - Task Scheduler' .job' Import Arbitrary Discretionary Access Control List Write / Local Privilege Escalation

R 3.4.4 (Windows 10 x64) - Buffer Overflow SEH (DEP/ASLR Bypass)

Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation

Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation

Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)

Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path

DEWESoft X3 SP1 (64-bit) - Remote Command Execution
DEWESoft X3 SP1 (x64) - Remote Command Execution

CompleteFTP Professional 12.1.3 - Remote Code Execution

TeamCity Agent XML-RPC 10.0 - Remote Code Execution

eGroupWare 1.14 - 'spellchecker.php' Remote Command Execution

FreeBSD x86 / x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)
FreeBSD x86/x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)

Linux/x86 - /usr/bin/head -n99 cat etc/passwd Shellcode (61 Bytes)

Linux/x86 - Kill All Processes Shellcode (14 bytes)
Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
Windows/x86 - Dynamic Bind Shell + Null-Free Shellcode (571 Bytes)
Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
Windows/x86 - Dynamic Bind Shell + Null-Free Shellcode (571 Bytes)
Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux/x86 - 'reboot' polymorphic Shellcode (26 bytes)
Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
 2020-07-28 05:01:59 +00:00
Offensive Security
e46d9f65ff DB: 2020-07-27 
32 changes to exploits/shellcodes

Calavera UpLoader 3.5 - 'FTP Logi' Denial of Service (PoC + SEH Overwrite)
Nidesoft DVD Ripper 5.2.18 - Local Buffer Overflow (SEH)
Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter)
DiskBoss 7.7.14 - 'Reports and Data Directory' Buffer Overflow (SEH Egghunter)
Socusoft Photo to Video Converter Professional 8.07 - 'Output Folder' Buffer Overflow (SEH Egghunter)
Port Forwarding Wizard 4.8.0 - Buffer Overflow (SEH)
Free MP3 CD Ripper 2.8 - Stack Buffer Overflow (SEH + Egghunter)
docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter)
GOautodial 4.0 - Persistent Cross-Site Scripting (Authenticated)
ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection
INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution
UBICOD Medivision Digital Signage 1.5.1 - Cross-Site Request Forgery (Add Admin)
WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
WordPress Plugin Email Subscribers & Newsletters 4.2.2 - 'hash' SQL Injection (Unauthenticated)
Bludit 3.9.2 - Directory Traversal
LibreHealth 2.0.0 - Authenticated Remote Code Execution
Online Course Registration 1.0 - Unauthenticated Remote Code Execution
elaniin CMS - Authentication Bypass
Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)
PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting
Bio Star 2.8.2 - Local File Inclusion
Webtareas 2.1p - Arbitrary File Upload (Authenticated)
F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion
Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)
Socket.io-file 2.0.31 - Arbitrary File Upload
pfSense 2.4.4-p3 - Cross-Site Request Forgery
Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting
Rails 5.0.1 - Remote Code Execution

Linux/x86 - ASLR deactivation polymorphic Shellcode (124 bytes)
Linux/x86 - Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode (35 bytes)
Windows/x86 - Download using mshta.exe Shellcode (100 bytes)
 2020-07-27 05:02:04 +00:00
Offensive Security
dc7e147e70 DB: 2020-07-24 
3 changes to exploits/shellcodes

FTPDummy 4.80 - Local Buffer Overflow (SEH)
Snes9K 0.09z - 'Port Number' Buffer Overflow (SEH)

UBICOD Medivision Digital Signage 1.5.1 - Authorization Bypass
 2020-07-24 05:02:04 +00:00
Offensive Security
67c1f99f41 DB: 2020-07-23 
4 changes to exploits/shellcodes

NetPCLinker 1.0.0.0 - Buffer Overflow (SEH Egghunter)
Docsify.js 4.11.4 - Reflective Cross-Site Scripting
WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection
Sophos VPN Web Panel 2020 - Denial of Service (Poc)
 2020-07-23 05:02:04 +00:00
Offensive Security
bd3d5964fc DB: 2020-07-18 
5 changes to exploits/shellcodes

Sonar Qube 8.3.1 - 'SonarQube Service' Unquoted Service Path
Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC)

RiteCMS 2.2.1 - Remote Code Execution

CMSUno 1.6 - Cross-Site Request Forgery (Change Admin Password)
 2020-07-18 05:02:04 +00:00
Offensive Security
c0e7247938 DB: 2020-07-11 
5 changes to exploits/shellcodes

FrootVPN 4.8 - 'frootvpn' Unquoted Service Path

Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution

HelloWeb 2.0 - Arbitrary File Download

Barangay Management System 1.0 - Authentication Bypass
 2020-07-11 05:02:09 +00:00
Offensive Security
3847f7e468 DB: 2020-07-10 
4 changes to exploits/shellcodes

FrootVPN 4.8 - 'frootvpn' Unquoted Service Path
PHP 7.4 FFI - 'disable_functions' Bypass
Wordpress Plugin Powie's WHOIS Domain Check 0.9.31 - Persistent Cross-Site Scripting
Savsoft Quiz 5 - Persistent Cross-Site Scripting
 2020-07-10 05:02:06 +00:00
Offensive Security
1bc852d2af DB: 2020-07-07 
7 changes to exploits/shellcodes

Frigate 2.02 - Denial Of Service (PoC)
Fire Web Server 0.1 - Remote Denial of Service (PoC)
Grafana 7.0.1 - Denial of Service (PoC)
File Management System 1.1 - Persistent Cross-Site Scripting
RiteCMS 2.2.1 - Authenticated Remote Code Execution
RSA IG&L Aveksa 7.1.1 - Remote Code Execution
Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution
 2020-07-07 05:01:57 +00:00
Offensive Security
1e83e1b032 DB: 2020-07-02 
4 changes to exploits/shellcodes

RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)
e-learning Php Script 0.1.0 - 'search' SQL Injection
PHP-Fusion 9.03.60 - PHP Object Injection
Online Shopping Portal 3.1 - Authentication Bypass
 2020-07-02 05:01:52 +00:00