Exploit-DB
034fafa3fd
DB: 2024-04-09
...
8 changes to exploits/shellcodes/ghdb
Positron Broadcast Signal Processor TRA7005 v1.20 - Authentication Bypass
Best Student Result Management System v1.0 - Multiple SQLi
Daily Expense Manager 1.0 - 'term' SQLi
Human Resource Management System v1.0 - Multiple SQLi
Open Source Medicine Ordering System v1.0 - SQLi
Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
AnyDesk 7.0.15 - Unquoted Service Path
2024-04-09 00:16:23 +00:00
Exploit-DB
a44e138f78
DB: 2024-04-03
...
28 changes to exploits/shellcodes/ghdb
Casdoor < v1.331.0 - '/api/set-password' CSRF
GL-iNet MT6000 4.5.5 - Arbitrary File Download
Axigen < 10.5.7 - Persistent Cross-Site Scripting
Blood Bank v1.0 - Stored Cross Site Scripting (XSS)
CE Phoenix v1.0.8.20 - Remote Code Execution
Daily Habit Tracker 1.0 - Broken Access Control
Daily Habit Tracker 1.0 - SQL Injection
Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)
Elementor Website Builder < 3.12.2 - Admin+ SQLi
Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection
Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login)
FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
Gibbon LMS v26.0.00 - SSTI vulnerability
Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)
Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated)
OpenCart Core 4.0.2.3 - 'search' SQLi
Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal
Smart School 6.4.1 - SQL Injection
Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
ASUS Control Center Express 01.06.15 - Unquoted Service Path
Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G
Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
2024-04-03 00:16:27 +00:00
Exploit-DB
e791587e41
DB: 2024-03-29
...
10 changes to exploits/shellcodes/ghdb
RouterOS 6.40.5 - 6.44 and 6.48.1 - 6.49.10 - Denial of Service
Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure
Dell Security Management Server <1.9.0 - Local Privilege Escalation
Asterisk AMI - Partial File Content & Path Disclosure (Authenticated)
Broken Access Control - on NodeBB v3.6.7
liveSite Version 2019.1 - Remote Code Execution
Purei CMS 1.0 - SQL Injection
Workout Journal App 1.0 - Stored XSS
WinRAR version 6.22 - Remote Code Execution via ZIP archive
2024-03-29 00:16:30 +00:00
Exploit-DB
a24ba3c94b
DB: 2024-03-21
...
7 changes to exploits/shellcodes/ghdb
HNAS SMU 14.8.7825 - Information Disclosure
Blood Bank 1.0 - 'bid' SQLi
CSZCMS v1.3.0 - SQL Injection (Authenticated)
Employee Management System 1.0 - 'admin_id' SQLi
Simple Task List 1.0 - 'status' SQLi
Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
2024-03-21 00:16:27 +00:00
Exploit-DB
bbffa273d4
DB: 2024-03-19
...
13 changes to exploits/shellcodes/ghdb
TELSAT marKoni FM Transmitter 1.9.5 - Backdoor Account Information Disclosure
TELSAT marKoni FM Transmitter 1.9.5 - Insecure Access Control Change Password
TELSAT marKoni FM Transmitter 1.9.5 - Root Command Injection
Atlassian Confluence < 8.5.3 - Remote Code Execution
Backdrop CMS 1.23.0 - Stored XSS
Gibbon LMS < v26.0.00 - Authenticated RCE
Quick.CMS 6.7 - SQL Injection Login Bypass
TYPO3 11.5.24 - Path Traversal (Authenticated)
WEBIGniter v28.7.23 - Stored XSS
WordPress File Upload Plugin < 4.23.3 - Stored XSS
xbtitFM 4.1.18 - Multiple Vulnerabilities
ZoneMinder Snapshots < 1.37.33 - Unauthenticated RCE
2024-03-19 00:16:26 +00:00
Exploit-DB
2af1700331
DB: 2024-03-15
...
10 changes to exploits/shellcodes/ghdb
Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)
SolarView Compact 6.00 - Command Injection
Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE)
GitLab CE/EE < 16.7.2 - Password Reset
JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)
KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow
KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow
KiTTY 0.76.1.13 - Command Injection
2024-03-15 00:16:19 +00:00
Exploit-DB
98f7ce18e2
DB: 2024-03-13
...
8 changes to exploits/shellcodes/ghdb
Cisco Firepower Management Center < 6.6.7.1 - Authenticated RCE
VMware Cloud Director 10.5 - Bypass identity verification
OSGi v3.7.2 (and below) Console - RCE
OSGi v3.8-3.18 Console - RCE
SnipeIT 6.2.1 - Stored Cross Site Scripting
Client Details System 1.0 - SQL Injection
Human Resource Management System 1.0 - 'employeeid' SQL Injection
2024-03-13 00:16:28 +00:00
Exploit-DB
ce58678266
DB: 2024-03-12
...
7 changes to exploits/shellcodes/ghdb
Sitecore - Remote Code Execution v8.2
Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore < 14.8.7825.01 - IDOR
Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read
WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover
Microsoft Windows Defender / Trojan.Win32/Powessere.G - Detection Mitigation Bypass
2024-03-12 00:16:25 +00:00
Exploit-DB
60a90afc8d
DB: 2024-03-11
...
7 changes to exploits/shellcodes/ghdb
Ladder v0.0.21 - Server-side request forgery (SSRF)
TP-Link TL-WR740N - Buffer Overflow 'DOS'
Numbas < v7.3 - Remote Code Execution
Akaunting < 3.1.3 - RCE
DataCube3 v1.0 - Unrestricted file upload 'RCE'
Hide My WP < 6.2.9 - Unauthenticated SQLi
2024-03-11 00:16:24 +00:00
Exploit-DB
7528fc1c5b
DB: 2024-03-07
...
8 changes to exploits/shellcodes/ghdb
GLiNet - Router Authentication Bypass
CSZ CMS Version 1.3.0 - Authenticated Remote Command Execution
CVE-2023-50071 - Multiple SQL Injection
elFinder Web file manager Version - 2.1.53 Remote Command Execution
Lot Reservation Management System - Unauthenticated File Disclosure
Lot Reservation Management System - Unauthenticated File Upload and Remote Code Execution
2024-03-07 00:16:27 +00:00
Exploit-DB
42e75482b6
DB: 2024-03-06
...
4 changes to exploits/shellcodes/ghdb
Solar-Log 200 PM+ 3.6.0 Build 99 - 15.10.2019 - Stored XSS
kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
Neontext Wordpress Plugin - Stored XSS
2024-03-06 00:16:30 +00:00
Exploit-DB
7ef8e488d8
DB: 2024-03-04
...
22 changes to exploits/shellcodes/ghdb
GL.iNet AR300M v3.216 Remote Code Execution - CVE-2023-46456 Exploit
GL.iNet AR300M v4.3.7 Arbitrary File Read - CVE-2023-46455 Exploit
GL.iNet AR300M v4.3.7 Remote Code Execution - CVE-2023-46454 Exploit
Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated)
R Radio Network FM Transmitter 1.07 system.cgi - Password Disclosure
TitanNit Web Control 2.01 / Atemio 7600 - Root Remote Code Execution
TPC-110W - Missing Authentication for Critical Function
A-PDF All to MP3 Converter 2.0.0 - DEP Bypass via HeapCreate + HeapAlloc
Easywall 0.3.1 - Authenticated Remote Command Execution
Magento ver. 2.4.6 - XSLT Server Side Injection
AC Repair and Services System v1.0 - Multiple SQL Injection
Enrollment System v1.0 - SQL Injection
Petrol Pump Management Software v.1.0 - SQL Injection
Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file
Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting
Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload
Real Estate Management System v1.0 - Remote Code Execution via File Upload
Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection
Simple Student Attendance System v1.0 - Time Based Blind SQL Injection
Boss Mini 1.4.0 - local file inclusion
Windows PowerShell - Event Log Bypass Single Quote Code Execution
2024-03-04 00:16:34 +00:00
Exploit-DB
59f10b7f45
DB: 2024-02-29
...
13 changes to exploits/shellcodes/ghdb
Saflok - Key Derication Function Exploit
(shellcode) Linux-x64 - create a shell with execve() sending argument using XOR (/bin//sh) [55 bytes]
Academy LMS 6.2 - Reflected XSS
Blood Bank v1.0 - Multiple SQL Injection
Moodle 4.3 - Reflected XSS
TASKHUB-2.8.8 - XSS-Reflected
WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 - _Dashboard Redirect_ field Stored Cross-Site Scripting (XSS)
WP Fastest Cache 1.2.2 - Unauthenticated SQL Injection
WP Rocket < 2.10.3 - Local File Inclusion (LFI)
2024-02-29 00:16:26 +00:00
Exploit-DB
c1bcfc6347
DB: 2024-02-28
...
13 changes to exploits/shellcodes/ghdb
TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution
TEM Opera Plus FM Family Transmitter 35.45 - XSRF
Executables Created with perl2exe < V30.10C - Arbitrary Code Execution
Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit)
Automatic-Systems SOC FL9600 FastLine - Directory Transversal
Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin
dawa-pharma 1.0-2022 - Multiple-SQLi
Moodle 4.3 - Insecure Direct Object Reference
Moodle 4.3 - Reflected XSS
SuperStoreFinder - Multiple Vulnerabilities
Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)
Zoo Management System 1.0 - Unauthenticated RCE
2024-02-28 00:16:32 +00:00
Exploit-DB
bdcc81a451
DB: 2024-02-16
...
4 changes to exploits/shellcodes/ghdb
DS Wireless Communication - Remote Code Execution
Metabase 0.46.6 - Pre-Auth Remote Code Execution
SISQUALWFM 7.1.319.103 - Host Header Injection
2024-02-16 00:16:25 +00:00
Exploit-DB
5c0c152cec
DB: 2024-02-14
...
6 changes to exploits/shellcodes/ghdb
VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) - Remote Denial Of Service
Splunk 9.0.4 - Information Disclosure
Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over
ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure
2024-02-14 00:16:18 +00:00
Exploit-DB
a846c2fd3a
DB: 2024-02-10
...
8 changes to exploits/shellcodes/ghdb
Zyxel zysh - Format string
Elasticsearch - StackOverflow DoS
Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site Scripting (XSS) (Authenticated)
Online Nurse Hiring System 1.0 - Time-Based SQL Injection
Rail Pass Management System 1.0 - Time-Based SQL Injection
Wordpress Augmented-Reality - Remote Code Execution Unauthenticated
Wordpress Seotheme - Remote Code Execution Unauthenticated
2024-02-10 00:16:32 +00:00
Exploit-DB
0c65b881ba
DB: 2024-02-06
...
10 changes to exploits/shellcodes/ghdb
Milesight Routers UR5X_ UR32L_ UR32_ UR35_ UR41 - Credential Leakage Through Unprotected System Logs and Weak Password Encryption
WhatsUp Gold 2022 (22.1.0 Build 39) - XSS
Clinic's Patient Management System 1.0 - Unauthenticated RCE
Curfew e-Pass Management System 1.0 - FromDate SQL Injection
GYM MS - GYM Management System - Cross Site Scripting (Stored)
MISP 2.4.171 - Stored XSS
TASKHUB-2.8.8 - XSS-Reflected
Wordpress 'simple urls' Plugin < 115 - XSS
2024-02-06 00:16:29 +00:00
Exploit-DB
81ae91fdae
DB: 2024-02-03
...
14 changes to exploits/shellcodes/ghdb
Electrolink FM/DAB/TV Transmitter - Unauthenticated Remote DoS
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
Electrolink FM/DAB/TV Transmitter (Login Cookie) - Authentication Bypass
Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) - Credentials Disclosure
Electrolink FM/DAB/TV Transmitter - Pre-Auth MPFS Image Remote Code Execution
Electrolink FM/DAB/TV Transmitter - Remote Authentication Removal
TP-LINK TL-WR740N - Multiple HTML Injection
TP-Link TL-WR740N - UnAuthenticated Directory Transversal
Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC)
mooSocial 3.1.8 - Cross-Site Scripting (XSS) on User Login Page
PCMan FTP Server 2.0 - 'pwd' Remote Buffer Overflow
WebCatalog 48.4 - Arbitrary Protocol Execution
2024-02-03 00:16:34 +00:00
Exploit-DB
a5920da7af
DB: 2024-01-30
...
10 changes to exploits/shellcodes/ghdb
Ricoh Printer - Directory and File Exposure
Blood Bank & Donor Management System using v2.2 - Stored XSS
Equipment Rental Script-1.0 - SQLi
Bank Locker Management System - SQL Injection
Fundraising Script 1.0 - SQLi
PHP Shopping Cart 4.2 - Multiple-SQLi
7 Sticky Notes v1.9 - OS Command Injection
Typora v1.7.4 - OS Command Injection
2024-01-30 00:16:26 +00:00
Exploit-DB
f3649a641f
DB: 2023-10-10
...
24 changes to exploits/shellcodes/ghdb
Minio 2022-07-29T19-40-48Z - Path traversal
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service
Atcom 2.7.x.x - Authenticated Command Injection
Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE)
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction
OpenPLC WebServer 3 - Denial of Service
Splunk 9.0.5 - admin account take over
BoidCMS v2.0.0 - authenticated file upload vulnerability
Cacti 1.2.24 - Authenticated command injection when using SNMP options
Chitor-CMS v1.1.2 - Pre-Auth SQL Injection
Clcknshop 1.0.0 - SQL Injection
Coppermine Gallery 1.6.25 - RCE
Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
GLPI GZIP(Py3) 9.4.5 - RCE
Limo Booking Software v1.0 - CORS
Media Library Assistant Wordpress Plugin - RCE and LFI
Online ID Generator 1.0 - Remote Code Execution (RCE)
Shuttle-Booking-Software v1.0 - Multiple-SQLi
Webedition CMS v2.9.8.8 - Blind SSRF
WEBIGniter v28.7.23 File Upload - Remote Code Execution
Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation
Wordpress Sonaar Music Plugin 4.7 - Stored XSS
Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
2023-10-10 00:16:32 +00:00
Exploit-DB
cbe784b087
DB: 2023-09-09
...
16 changes to exploits/shellcodes/ghdb
Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS
Drupal 10.1.2 - web-cache-poisoning-External-service-interaction
Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure
soosyze 2.0.0 - File Upload
SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection
Wordpress Plugin Elementor 3.5.5 - Iframe Injection
Wp2Fac - OS Command Injection
Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
SyncBreeze 15.2.24 - 'login' Denial of Service
GOM Player 2.3.90.5360 - Buffer Overflow (PoC)
GOM Player 2.3.90.5360 - Remote Code Execution (RCE)
Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes)
2023-09-09 00:16:33 +00:00
Exploit-DB
4e246a01fb
DB: 2023-09-05
...
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
2023-09-05 00:16:27 +00:00
Exploit-DB
e07f33f24d
DB: 2023-08-22
...
17 changes to exploits/shellcodes/ghdb
EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)
EuroTel ETL3100 - Transmitter Default Credentials
EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download
Color Prediction Game v1.0 - SQL Injection
Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
Dolibarr Version 17.0.1 - Stored XSS
Global - Multi School Management System Express v1.0- SQL Injection
OVOO Movie Portal CMS v3.3.3 - SQL Injection
PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities
Taskhub CRM Tool 2.8.6 - SQL Injection
Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
TSplus 16.0.0.0 - Remote Work Insecure Files and Folders
TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions
Linux/x64 - memfd_create ELF loader Shellcode (170 bytes)
2023-08-22 00:16:22 +00:00
Exploit-DB
f55092b332
DB: 2023-08-11
...
6 changes to exploits/shellcodes/ghdb
TP-Link Archer AX21 - Unauthenticated Command Injection
systemd 246 - Local Privilege Escalation
Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
Request-Baskets v1.2.1 - Server-side request forgery (SSRF)
OutSystems Service Studio 11.53.30 - DLL Hijacking
2023-08-11 00:16:25 +00:00
Exploit-DB
010e679abe
DB: 2023-08-05
...
25 changes to exploits/shellcodes/ghdb
ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)
Shelly PRO 4PM v0.11.0 - Authentication Bypass
Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
Academy LMS 6.0 - Reflected XSS
Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload
JLex GuestBook 1.6.4 - Reflected XSS
Joomla JLex Review 6.0.1 - Reflected XSS
News Portal v4.0 - SQL Injection (Unauthorized)
PHPJabbers Cleaning Business 1.0 - Reflected XSS
PHPJabbers Night Club Booking 1.0 - Reflected XSS
PHPJabbers Rental Property Booking 2.0 - Reflected XSS
PHPJabbers Service Booking Script 1.0 - Reflected XSS
PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
PHPJabbers Taxi Booking 2.0 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webutler v3.2 - Remote Code Execution (RCE)
WordPress adivaha Travel Plugin 2.3 - Reflected XSS
WordPress adivaha Travel Plugin 2.3 - SQL Injection
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS
Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)
2023-08-05 00:16:32 +00:00
Exploit-DB
3a3c03321c
DB: 2023-07-20
...
18 changes to exploits/shellcodes/ghdb
Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution
ABB FlowX v4.00 - Exposure of Sensitive Information
TP-Link TL-WR740N - Authenticated Directory Transversal
Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure
Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS)
Blackcat Cms v1.4 - Remote Code Execution (RCE)
Blackcat Cms v1.4 - Stored XSS
CmsMadeSimple v2.2.17 - Remote Code Execution (RCE)
CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI)
CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)
Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration)
Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
phpfm v1.7.9 - Authentication type juggling
PimpMyLog v1.7.14 - Improper access control
PMB 7.4.6 - SQL Injection
Statamic 4.7.0 - File-Inclusion
Vaidya-Mitra 1.0 - Multiple SQLi
2023-07-20 00:16:46 +00:00
Exploit-DB
fd788a92e3
DB: 2023-07-16
...
9 changes to exploits/shellcodes/ghdb
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Admidio v4.2.10 - Remote Code Execution (RCE)
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Icinga Web 2.10 - Authenticated Remote Code Execution
News Portal v4.0 - SQL Injection (Unauthorized)
Pluck v4.7.18 - Remote Code Execution (RCE)
ProjeQtOr Project Management System v10.4.1 - Multiple XSS
WinterCMS < 1.2.3 - Persistent Cross-Site Scripting
XAMPP 8.2.4 - Unquoted Path
2023-07-16 00:16:39 +00:00
Exploit-DB
00f5021452
DB: 2023-07-12
...
10 changes to exploits/shellcodes/ghdb
Ateme TITAN File 3.9 - SSRF File Enumeration
Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Spring Cloud 3.2.2 - Remote Command Execution (RCE)
BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)
AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_
Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
2023-07-12 00:16:54 +00:00
Exploit-DB
ef9b4e5962
DB: 2023-07-04
...
20 changes to exploits/shellcodes/ghdb
TP-Link TL-WR940N V4 - Buffer OverFlow
D-Link DAP-1325 - Broken Access Control
Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE)
FuguHub 8.1 - Remote Code Execution
GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)
PodcastGenerator 3.2.9 - Blind SSRF via XML Injection
POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)
Prestashop 8.0.4 - Cross-Site Scripting (XSS)
Rukovoditel 3.4.1 - Multiple Stored XSS
Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)
spip v4.1.10 - Spoofing Admin account
Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS)
Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)
WBCE CMS 1.6.1 - Open Redirect & CSRF
WebsiteBaker v2.13.3 - Directory Traversal
WebsiteBaker v2.13.3 - Stored XSS
WP AutoComplete 1.0.4 - Unauthenticated SQLi
2023-07-04 00:16:26 +00:00
Exploit-DB
c79c4813de
DB: 2023-06-24
...
4 changes to exploits/shellcodes/ghdb
MCL-Net 4.3.5.8788 - Information Disclosure
Abantecart v1.3.2 - Authenticated Remote Code Execution
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
NCH Express Invoice - Clear Text Password Storage and Account Takeover
2023-06-24 00:16:23 +00:00
Exploit-DB
00f6b3e7ed
DB: 2023-06-22
...
2 changes to exploits/shellcodes/ghdb
HiSecOS 04.0.01 - Privilege Escalation
SPIP v4.2.1 - Remote Code Execution (Unauthenticated)
SPIP v4.2.0 - Remote Code Execution (Unauthenticated)
2023-06-22 00:16:26 +00:00
Exploit-DB
cc495bca11
DB: 2023-06-21
...
8 changes to exploits/shellcodes/ghdb
Nokia ASIKA 7.13.52 - Hard-coded private key disclosure
SPIP v4.2.1 - Remote Code Execution (Unauthenticated)
Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
Super Socializer 7.13.52 - Reflected XSS
WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
2023-06-21 00:16:34 +00:00
Exploit-DB
147824bdba
DB: 2023-06-20
...
8 changes to exploits/shellcodes/ghdb
Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)
BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
Diafan CMS 6.0 - Reflected Cross-Site Scripting (XSS)
Groomify v1.0 - SQL Injection
Jobpilot v2.61 - SQL Injection
Sales Tracker Management System v1.0 - Multiple Vulnerabilities
Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
The Shop v2.5 - SQL Injection
WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
2023-06-20 00:16:29 +00:00
Exploit-DB
158fcdfd5c
DB: 2023-06-15
...
11 changes to exploits/shellcodes/ghdb
Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak
Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution
Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution
Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)
Online Thesis Archiving System v1.0 - Multiple-SQLi
projectSend r1605 - CSV injection
projectSend r1605 - Stored XSS
Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
2023-06-15 00:16:23 +00:00
Exploit-DB
9be142a874
DB: 2023-05-26
...
7 changes to exploits/shellcodes/ghdb
Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)
SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
Ulicms 2023.1 - create admin user via mass assignment
WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)
Zenphoto 1.6 - Multiple stored XSS
Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
2023-05-26 00:16:47 +00:00
Exploit-DB
0a7adaa3fc
DB: 2023-05-24
...
40 changes to exploits/shellcodes/ghdb
Optoma 1080PSTX Firmware C02 - Authentication Bypass
Screen SFT DAB 600/C - Authentication Bypass Account Creation
Screen SFT DAB 600/C - Authentication Bypass Admin Password Change
Screen SFT DAB 600/C - Authentication Bypass Erase Account
Screen SFT DAB 600/C - Authentication Bypass Password Change
Screen SFT DAB 600/C - Authentication Bypass Reset Board Config
Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)
PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Apache Superset 2.0.0 - Authentication Bypass
FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)
PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
Affiliate Me Version 5.0.1 - SQL Injection
Best POS Management System v1.0 - Unauthenticated Remote Code Execution
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
e107 v2.3.2 - Reflected XSS
File Thingie 2.5.7 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
LeadPro CRM v1.0 - SQL Injection
PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)
Prestashop 8.0.4 - CSV injection
Quicklancer v1.0 - SQL Injection
SitemagicCMS 4.4.3 - Remote Code Execution (RCE)
Smart School v1.0 - SQL Injection
Stackposts Social Marketing Tool v1.0 - SQL Injection
thrsrossi Millhouse-Project 1.414 - Remote Code Execution
TinyWebGallery v2.5 - Remote Code Execution (RCE)
WBiz Desk 1.2 - SQL Injection
Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup
Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title
Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking
MobileTrans 4.0.11 - Weak Service Privilege Escalation
Trend Micro OfficeScan Client 10.0 - ACL Service LPE
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
2023-05-24 00:16:34 +00:00
Exploit-DB
bfc4baf25a
DB: 2023-05-14
...
7 changes to exploits/shellcodes/ghdb
FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
Epson Stylus SX510W Printer Remote Power Off - Denial of Service
Job Portal 1.0 - File Upload Restriction Bypass
Online Clinic Management System 2.2 - Multiple Stored Cross-Site Scripting (XSS)
RockMongo 1.1.7 - Stored Cross-Site Scripting (XSS)
TinyWebGallery v2.5 - Stored Cross-Site Scripting (XSS)
2023-05-14 00:16:46 +00:00
Exploit-DB
668314bbda
DB: 2023-05-03
...
19 changes to exploits/shellcodes/ghdb
FS-S3900-24T4S - Privilege Escalation
Virtual Reception v1.0 - Web Server Directory Traversal
admidio v4.2.5 - CSV Injection
Companymaps v8.0 - Stored Cross Site Scripting (XSS)
GLPI 9.5.7 - Username Enumeration
OpenEMR v7.0.1 - Authentication credentials brute force
PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting
PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)
PHPJabbers Simple CMS 5.0 - SQL Injection
PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)
phpMyFAQ v3.1.12 - CSV Injection
projectSend r1605 - Private file download
revive-adserver v5.4.1 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - File Inclusion RCE
SoftExpert (SE) Suite v2.1.3 - Local File Inclusion
Advanced Host Monitor v12.56 - Unquoted Service Path
MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
2023-05-03 00:16:23 +00:00
Exploit-DB
91a0e53b65
DB: 2023-04-29
...
9 changes to exploits/shellcodes/ghdb
pfsenseCE v2.6.0 - Anti-brute force protection bypass
Art Gallery Management System Project in PHP v 1.0 - SQL injection
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated
Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated
Art Gallery Management System Project in PHP v 1.0 - SQL injection
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated
Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
pfsenseCE v2.6.0 - Anti-brute force protection bypass
2023-04-29 00:16:28 +00:00
Exploit-DB
79466d14c8
DB: 2023-04-24
...
4 changes to exploits/shellcodes/ghdb
EasyNas 1.1.0 - OS Command Injection
EasyNas 1.1.0 - OS Command Injection
2023-04-24 00:16:20 +00:00
Exploit-DB
bd09027499
DB: 2023-04-21
...
18 changes to exploits/shellcodes/ghdb
Franklin Fueling Systems TS-550 - Default Password
Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
Linux Kernel 6.2 - Userspace Processes To Enable Mitigation
Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
Chitor-CMS v1.1.2 - Pre-Auth SQL Injection
GDidees CMS 3.9.1 - Local File Disclosure
Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)
Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)
ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE)
Serendipity 2.4.0 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated)
FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE)
AspEmail v5.6.0.2 - Local Privilege Escalation
File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
2023-04-21 00:16:25 +00:00
Exploit-DB
2f07358143
DB: 2023-04-15
...
16 changes to exploits/shellcodes/ghdb
InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal
Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation
Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking
Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery
Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password
Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP
Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit
Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset
Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation
Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure
Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
Bludit 4.0.0-rc-2 - Account takeover
Microsoft Windows 11 - 'cmd.exe' Denial of Service
2023-04-15 00:16:19 +00:00
Exploit-DB
0cb2c9699d
DB: 2023-04-11
...
8 changes to exploits/shellcodes/ghdb
Roxy Fileman 1.4.5 - Arbitrary File Upload
Paradox Security Systems IPR512 - Denial Of Service
WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE
Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing
BrainyCP V1.0 - Remote Code Execution
Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)
ever gauzy v0.281.9 - JWT weak HMAC secret
2023-04-11 00:16:33 +00:00
Exploit-DB
85954a8fad
DB: 2023-04-09
...
34 changes to exploits/shellcodes/ghdb
ENTAB ERP 1.0 - Username PII leak
ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)
ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)
FortiRecorder 6.4.3 - Denial of Service
Schneider Electric v1.0 - Directory traversal & Broken Authentication
Altenergy Power Control Software C1.2.5 - OS command injection
Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)
Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)
Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)
Lucee Scheduled Job v1.0 - Command Execution
Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)
Adobe Connect 11.4.5 - Local File Disclosure
Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)
Suprema BioStar 2 v2.8.16 - SQL Injection
Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)
dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)
GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure
Icinga Web 2.10 - Arbitrary File Disclosure
Joomla! v4.2.8 - Unauthenticated information disclosure
Medicine Tracker System v1.0 - Sql Injection
Online Appointment System V1.0 - Cross-Site Scripting (XSS)
Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)
pfsenseCE v2.6.0 - Anti-brute force protection bypass
Restaurant Management System 1.0 - SQL Injection
WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)
X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
Microsoft Windows 11 - 'cmd.exe' Denial of Service
ActFax 10.10 - Unquoted Path Services
ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path
RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution
Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
2023-04-09 00:16:30 +00:00
Exploit-DB
99cef8d064
DB: 2023-04-08
...
11 changes to exploits/shellcodes/ghdb
Snitz Forum v1.0 - Blind SQL Injection
Franklin Fueling Systems TS-550 - Exploit and Default Password
Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing
MAC 1200R - Directory Traversal
Docker based datastores for IBM Instana 241-2 243-0 - No Authentication
IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)
ChurchCRM 4.5.1 - Authenticated SQL Injection
NotrinosERP 0.7 - Authenticated Blind SQL Injection
Rukovoditel 3.3.1 - Remote Code Execution (RCE)
Wondershare Dr Fone 12.9.6 - Privilege Escalation
2023-04-08 00:16:27 +00:00
Exploit-DB
d7c9ba572a
DB: 2023-04-07
...
50 changes to exploits/shellcodes/ghdb
Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI
ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access
Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)
Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection
Osprey Pump Controller 1.0.1 - (pseudonym) Semi-blind Command Injection
Osprey Pump Controller 1.0.1 - (userName) Blind Command Injection
Osprey Pump Controller 1.0.1 - Administrator Backdoor Access
Osprey Pump Controller 1.0.1 - Authentication Bypass Credentials Modification
Osprey Pump Controller 1.0.1 - Cross-Site Request Forgery
Osprey Pump Controller 1.0.1 - Predictable Session Token / Session Hijack
Osprey Pump Controller 1.0.1 - Unauthenticated File Disclosure
Osprey Pump Controller 1.0.1 - Unauthenticated Remote Code Execution Exploit
Osprey Pump Controller v1.0.1 - Unauthenticated Reflected XSS
WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE
HospitalRun 1.0.0-beta - Local Root Exploit for macOS
Adobe Connect 10 - Username Disclosure
craftercms 4.x.x - CORS
EasyNas 1.1.0 - OS Command Injection
Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution (RCE)
Art Gallery Management System Project in PHP v 1.0 - SQL injection
atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE
Auto Dealer Management System 1.0 - Broken Access Control Exploit
Auto Dealer Management System v1.0 - SQL Injection
Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php
Auto Dealer Management System v1.0 - SQL Injection on manage_user.php
Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload
Best pos Management System v1.0 - SQL Injection
ChurchCRM v4.5.3-121fcc1 - SQL Injection
Dompdf 1.2.1 - Remote Code Execution (RCE)
Employee Task Management System v1.0 - Broken Authentication
Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)
Employee Task Management System v1.0 - SQL Injection on edit-task.php
flatnux 2021-03.25 - Remote Code Execution (Authenticated)
Intern Record System v1.0 - SQL Injection (Unauthenticated)
Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking
LDAP Tool Box Self Service Password v1.5.2 - Account takeover
Music Gallery Site v1.0 - Broken Access Control
Music Gallery Site v1.0 - SQL Injection on music_list.php
Music Gallery Site v1.0 - SQL Injection on page Master.php
Music Gallery Site v1.0 - SQL Injection on page view_music_details.php
POLR URL 2.3.0 - Shortener Admin Takeover
Purchase Order Management-1.0 - Local File Inclusion
Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)
Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)
modoboa 2.0.4 - Admin TakeOver
pdfkit v0.8.7.2 - Command Injection
FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking
Windows 11 10.0.22000 - Backup service Privilege Escalation
TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)
Unified Remote 3.13.0 - Remote Code Execution (RCE)
2023-04-07 00:16:28 +00:00
Exploit-DB
d46ab98863
DB: 2023-04-06
...
32 changes to exploits/shellcodes/ghdb
Answerdev 1.0.3 - Account Takeover
D-Link DIR-846 - Remote Command Execution (RCE) vulnerability
Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure
SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow
ERPNext 12.29 - Cross-Site Scripting (XSS)
Liferay Portal 6.2.5 - Insecure Permissions
GNU screen v4.9.0 - Privilege Escalation
Apache Tomcat 10.1 - Denial Of Service
PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)
BTCPay Server v1.7.4 - HTML Injection.
Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE)
Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)
ImageMagick 7.1.0-49 - DoS
bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS)
Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)
CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)
Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)
Froxlor 2.0.3 Stable - Remote Code Execution (RCE)
ImageMagick 7.1.0-49 - Arbitrary File Read
itech TrainSmart r1044 - SQL injection
Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated)
PhotoShow 3.0 - Remote Code Execution
projectSend r1605 - Remote Code Exectution RCE
Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
zstore 6.6.0 - Cross-Site Scripting (XSS)
Binwalk v2.3.2 - Remote Command Execution (RCE)
XWorm Trojan 2.1 - Null Pointer Derefernce DoS
Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution)
Linux/x86_64 - bash Shellcode with xor encoding
2023-04-06 00:16:31 +00:00
Exploit-DB
d4e68dbb7e
DB: 2023-04-04
...
39 changes to exploits/shellcodes/ghdb
ProLink PRS1841 PLDT Home fiber - Default Password
Nacos 2.0.3 - Access Control vulnerability
sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
sleuthkit 4.11.1 - Command Injection
Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS)
ManageEngin AMP 4.3.0 - File-path-traversal
SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS)
AmazCart CMS 3.4 - Cross-Site-Scripting (XSS)
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated
Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated
ChiKoi v1.0 - SQL Injection
ERPGo SaaS 3.9 - CSV Injection
GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion
GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure
GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration)
Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)
Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection
pimCore v5.4.18-skeleton - Sensitive Cookie with Improper SameSite Attribute
Prizm Content Connect v10.5.1030.8315 - XXE
SLIMSV 9.5.2 - Cross-Site Scripting (XSS)
WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE
Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)
Roxy WI v6.1.0.0 - Improper Authentication Control
Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
Solaris 10 libXm - Buffer overflow Local privilege escalation
Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path
Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow
HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path
Microsoft Exchange Active Directory Topology 15.02.1118.007 - 'Service MSExchangeADTopology' Unquoted Service Path
Windows 11 10.0.22000 - Backup service Privilege Escalation
Windows/x86 - Create Administrator User / Dynamic PEB & EDT method null-free Shellcode (373 bytes)
2023-04-04 00:16:32 +00:00
Exploit-DB
3de26153c8
DB: 2023-04-02
...
23 changes to exploits/shellcodes/ghdb
ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)
Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion
Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)
TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated)
GeoVision Camera GV-ADR2701 - Authentication Bypass
AD Manager Plus 7122 - Remote Code Execution (RCE)
Enlightenment v0.25.3 - Privilege escalation
Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)
Apache 2.4.x - Buffer Overflow
perfSONAR v4.4.5 - Partial Blind CSRF
SugarCRM 12.2.0 - Remote Code Execution (RCE)
XCMS v1.83 - Remote Command Execution (RCE)
Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)
GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)
AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS)
NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit
Splashtop 8.71.12001.0 - Unquoted Service Path
Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)
FlipRotation v1.0 decoder - Shellcode (146 bytes)
Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes)
macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
2023-04-02 00:16:21 +00:00
