bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2803 commits 1 branch 0 tags 348 MiB
Commit graph

480 commits

Author SHA1 Message Date
Exploit-DB
42ade901fe DB: 2023-03-31 
22 changes to exploits/shellcodes/ghdb

LISTSERV 17 - Insecure Direct Object Reference (IDOR)
LISTSERV 17 - Reflected Cross Site Scripting (XSS)

Router ZTE-H108NS - Stack Buffer Overflow (DoS)

Router ZTE-H108NS - Authentication Bypass

Boa Web Server v0.94.14 - Authentication Bypass

Covenant v0.5 - Remote Code Execution (RCE)

Dreamer CMS v4.0.0 - SQL Injection

Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)

Virtual Reception v1.0 - Web Server Directory Traversal

4images 1.9 - Remote Command Execution (RCE)

ClicShopping v3.402 - Cross-Site Scripting (XSS)

Concrete5 CME v9.1.3 - Xpath injection

Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)

Ecommerse v1.0 - Cross-Site Scripting (XSS)

Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS)

myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)

WPForms 1.7.8 - Cross-Site Scripting (XSS)

CrowdStrike Falcon AGENT  6.44.15806  - Uninstall without Installation Token

Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path

Zillya Total Security 3.0.2367.0  - Local Privilege Escalation
 2023-03-31 00:16:26 +00:00
Exploit-DB
6bc7a6f9b0 DB: 2023-03-29 
25 changes to exploits/shellcodes/ghdb

ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)

Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access

ZKTeco ZEM/ZMM 8.88 - Missing Authentication

Hashicorp Consul v1.0 - Remote Command Execution (RCE)

X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)

OPSWAT Metadefender Core - Privilege Escalation

Pega Platform 8.1.0 - Remote Code Execution (RCE)

Beauty-salon v1.0 - Remote Code Execution (RCE)

BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)

iBooking v1.0.8 - Arbitrary File Upload

Jetpack 11.4 - Cross Site Scripting (XSS)

Moodle LMS 4.0 - Cross-Site Scripting (XSS)

Online shopping system advanced 1.0 - Multiple Vulnerabilities

rukovoditel 3.2.1 - Cross-Site Scripting (XSS)

Senayan Library Management System v9.5.0 - SQL Injection

Social-Share-Buttons v2.2.3 - SQL Injection

Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)

YouPHPTube<= 7.8 - Multiple Vulnerabilities

Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)

SuperMailer v11.20 - Buffer overflow DoS

Tunnel Interface Driver - Denial of Service

VMware Workstation 15 Pro - Denial of Service

HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path

SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
 2023-03-29 00:16:31 +00:00
Exploit-DB
b137003172 DB: 2023-03-28 
36 changes to exploits/shellcodes/ghdb

MiniDVBLinux 5.4  - Change Root Password
MiniDVBLinux 5.4  - Remote Root Command Injection
MiniDVBLinux 5.4 - Arbitrary File Read
MiniDVBLinux 5.4 - Unauthenticated Stream Disclosure
MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP - Remote Code Execution (RCE)
MiniDVBLinux <=5.4  - Config Download Exploit

Desktop Central 9.1.0 - Multiple Vulnerabilities

FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass
Aero CMS v0.0.1 - PHP Code Injection (auth)
Aero CMS v0.0.1 - SQL Injection (no auth)

Atom CMS v2.0 - SQL Injection (no auth)
Canteen-Management v1.0 - SQL Injection
Canteen-Management v1.0 - XSS-Reflected

Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)

eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)

FlatCore CMS 2.1.1 - Stored Cross-Site Scripting (XSS)

Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)
WebTareas 2.4 - RCE (Authorized)
WebTareas 2.4 - Reflected XSS (Unauthorised)
WebTareas 2.4 - SQL Injection (Unauthorised)

WPN-XM Serverstack for Windows 0.8.6 - Multiple Vulnerabilities

Zentao Project Management System 17.0 - Authenticated Remote Code Execution (RCE)

Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass

Grafana <=6.2.4 - HTML Injection

Hex Workshop v6.7 - Buffer overflow DoS

Scdbg 1.0 - Buffer overflow DoS

Sysax Multi Server 6.95 - 'Password' Denial of Service (PoC)

AVS Audio Converter 10.3 - Stack Overflow (SEH)

Explorer32++ v1.3.5.531 - Buffer overflow

Frhed (Free hex editor) v1.6.0 - Buffer overflow

Gestionale Open 12.00.00 - 'DB_GO_80' Unquoted Service Path

Mediconta 3.7.27 - 'servermedicontservice' Unquoted Service Path

Resource Hacker v3.6.0.92 - Buffer overflow

Tftpd32_SE 4.60 - 'Tftpd32_svc' Unquoted Service Path

WiFi Mouse 1.8.3.2 - Remote Code Execution (RCE)
 2023-03-28 00:16:27 +00:00
Offensive Security
ec8ac60c13 DB: 2022-11-22 
93 changes to exploits/shellcodes/ghdb
 2022-11-22 11:08:59 +00:00
Offensive Security
b6e780c138 DB: 2022-11-10 
20 changes to exploits/shellcodes/ghdb

0 new exploits/shellcodes

Too many to list!
 2022-11-10 23:30:40 +00:00
Offensive Security
d63de06c7a DB: 2022-11-10 
2776 changes to exploits/shellcodes/ghdb
 2022-11-10 16:39:50 +00:00
Offensive Security
c5397147d9 DB: 2022-09-24 
7 changes to exploits/shellcodes

Teleport v10.1.1 - Remote Code Execution (RCE)
TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)
Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)
Aero CMS v0.0.1 - SQLi
Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
 2022-09-24 05:01:44 +00:00
Offensive Security
7cbe771564 DB: 2022-09-21 
5 changes to exploits/shellcodes

Blink1Control2 2.2.7 - Weak Password Encryption
Mobile Mouse 3.6.0.4 - Remote Code Execution (RCE)
Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)
Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
Bookwyrm v0.4.3 - Authentication Bypass
 2022-09-21 05:01:54 +00:00
Offensive Security
187c559c55 DB: 2022-09-16 
1 changes to exploits/shellcodes

Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)
 2022-09-16 05:01:58 +00:00
Offensive Security
a8cb58b3e5 DB: 2022-08-10 
5 changes to exploits/shellcodes

PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)
Prestashop blockwishlist module 2.1.0 - SQLi
Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)
 2022-08-10 05:01:48 +00:00
Offensive Security
dfb28913d0 DB: 2022-07-30 
7 changes to exploits/shellcodes

Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
rpc.py 0.6.0 - Remote Code Execution (RCE)
Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution
Geonetwork 4.2.0 - XML External Entity (XXE)
Dingtian-DT-R002 3.1.276A - Authentication Bypass
Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal
WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
 2022-07-30 05:01:47 +00:00
Offensive Security
46346f8944 DB: 2022-07-22 
6 changes to exploits/shellcodes

Kite 1.2021.610.0 - Unquoted Service Path
Dr. Fone 4.0.8 - 'net_updater32.exe' Unquoted Service Path

IOTransfer 4.0 - Remote Code Execution (RCE)
Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
CodoForum v5.1 - Remote Code Execution (RCE)
OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
 2022-07-22 05:01:50 +00:00
Offensive Security
d84f857e94 DB: 2022-07-12 
1 changes to exploits/shellcodes

Nginx 1.20.0 - Denial of Service (DOS)
 2022-07-12 05:01:53 +00:00
Offensive Security
32b480d8b7 DB: 2022-06-28 
3 changes to exploits/shellcodes

WordPress Plugin Weblizar 8.9 - Backdoor
WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)
 2022-06-28 05:01:52 +00:00
Offensive Security
29e275db94 DB: 2022-06-15 
16 changes to exploits/shellcodes

Real Player v.20.0.8.310 G2 Control - 'DoGoToURL()' Remote Code Execution (RCE)
Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)
HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path
Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)
Virtua Software Cobranca 12S - SQLi
Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF)
Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)
Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)
ChurchCRM 4.4.5 - SQLi
Old Age Home Management System 1.0 - SQLi Authentication Bypass
SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)
SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
 2022-06-15 05:01:57 +00:00
Offensive Security
3daddca955 DB: 2022-06-04 
7 changes to exploits/shellcodes

Zyxel USG FLEX 5.21 - OS Command Injection
Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 - Remote Code Execution (RCE)
SolarView Compact 6.00 - Directory Traversal
Contao 4.13.2 - Cross-Site Scripting (XSS)
Microweber CMS 1.2.15 - Account Takeover
 2022-06-04 05:01:36 +00:00
Offensive Security
cbee98ca48 DB: 2022-05-18 
6 changes to exploits/shellcodes

SDT-CW3B1 1.1.0 - OS Command Injection
SolarView Compact 6.0 - OS Command Injection
Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
T-Soft E-Commerce 4 - SQLi (Authenticated)
Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
 2022-05-18 05:01:36 +00:00
Offensive Security
6b9b8c5434 DB: 2022-05-13 
7 changes to exploits/shellcodes

Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService)
Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
College Management System 1.0 - 'course_code' SQL Injection (Authenticated)
Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
TLR-2005KSH - Arbitrary File Delete
 2022-05-13 05:01:39 +00:00
Offensive Security
be24992411 DB: 2022-05-12 
42 changes to exploits/shellcodes

UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path
TCQ - ITeCProteccioAppServer.exe - Unquoted Service Path
Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
ExifTool 12.23 - Arbitrary Code Execution
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService)
Prime95 Version 30.7 build 9 - Remote Code Execution (RCE)
Akka HTTP 10.1.14 - Denial of Service
USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 - Remote Root Backdoor
Bookeen Notea - Directory Traversal
SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
DLINK DIR850 - Insecure Access Control
DLINK DIR850 - Open Redirect
Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
Tenda HG6 v3.3.0 - Remote Command Injection
Google Chrome 78.0.3904.70 - Remote Code Execution
PyScript - Read Remote Python Source Code
DLINK DAP-1620 A1 v1.01 - Directory Traversal
Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
ImpressCMS v1.4.4 - Unrestricted File Upload
Microfinance Management System 1.0 - 'customer_number' SQLi
WebTareas 2.4 - Blind SQLi (Authenticated)
WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
Magento eCommerce CE v2.3.5-p2 - Blind SQLi
Bitrix24 - Remote Code Execution (RCE) (Authenticated)
CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)
Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)
e107 CMS v3.2.1 - Multiple Vulnerabilities
Anuko Time Tracker - SQLi (Authenticated)
TLR-2005KSH - Arbitrary File Upload
Explore CMS 1.0 - SQL Injection
Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)
PHProjekt PhpSimplyGest v1.3. - Stored Cross-Site Scripting (XSS)
Beehive Forum - Account Takeover
MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Joomla Plugin SexyPolling 2.1.7 - SQLi
WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)
 2022-05-12 05:01:39 +00:00
Offensive Security
6350525c20 DB: 2022-04-23 
2 changes to exploits/shellcodes
 2022-04-23 05:01:59 +00:00
Offensive Security
093714dc70 DB: 2022-04-20 
21 changes to exploits/shellcodes

Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path
Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path
7-zip - Code Execution / Local Privilege Escalation
PTPublisher v2.3.4 - Unquoted Service Path
EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path
Zyxel NWA-1100-NH - Command Injection
ManageEngine ADSelfService Plus 6.1 - User Enumeration
Verizon 4G LTE Network Extender - Weak Credentials Algorithm
Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)
Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)
Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure

Scriptcase 9.7 - Remote Code Execution (RCE)
WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
Easy Appointments 1.4.2 - Information Disclosure
WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS)
WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)
REDCap 11.3.9 - Stored Cross Site Scripting
PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated)
Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)
 2022-04-20 05:01:45 +00:00
Offensive Security
50cc2edafe DB: 2022-04-08 
9 changes to exploits/shellcodes

Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
binutils 2.37 - Objdump Segmentation Fault
Kramer VIAware - Remote Code Execution (RCE) (Root)
Opmon 9.11 - Cross-site Scripting
Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)
KLiK Social Media Website 1.0 - 'Multiple' SQLi
minewebcms 1.15.2 - Cross-site Scripting (XSS)
qdPM 9.2 - Cross-site Request Forgery (CSRF)
ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
 2022-04-08 05:01:37 +00:00
Offensive Security
54b7907ae6 DB: 2022-03-31 
11 changes to exploits/shellcodes

PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated)
Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE)
ImpressCMS 1.4.2 - Remote Code Execution (RCE)
Atom CMS 2.0 - Remote Code Execution (RCE)
Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)
WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)
WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion
WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion
WordPress Plugin admin-word-count-column 2.2 - Local File Read
CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
 2022-03-31 05:01:38 +00:00
Offensive Security
498e749e36 DB: 2022-03-24 
3 changes to exploits/shellcodes

ProtonVPN 1.26.0 - Unquoted Service Path

WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
 2022-03-24 05:01:37 +00:00
Offensive Security
e55394b7d4 DB: 2022-03-23 
6 changes to exploits/shellcodes

Sysax FTP Automation 6.9.0 - Privilege Escalation
iRZ Mobile Router - CSRF to RCE
Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS)
ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure

ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
 2022-03-23 05:01:38 +00:00
Offensive Security
12a90d7198 DB: 2022-03-17 
5 changes to exploits/shellcodes

Hikvision IP Camera - Backdoor
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
Moodle 3.11.5 - SQLi (Authenticated)
Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)
Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
 2022-03-17 05:01:38 +00:00
Offensive Security
2ad6c86451 DB: 2022-03-15 
4 changes to exploits/shellcodes

VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path

Siemens S7-1200 - Unauthenticated Start/Stop Command

Baixar GLPI Project 9.4.6 - SQLi
 2022-03-15 05:01:36 +00:00
Offensive Security
653f886e0b DB: 2022-03-12 
2 changes to exploits/shellcodes

Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)
Tdarr 2.00.15 - Command Injection
 2022-03-12 05:01:35 +00:00
Offensive Security
e8863e001f DB: 2022-03-08 
9 changes to exploits/shellcodes

Private Internet Access 3.3 - 'pia-service' Unquoted Service Path
Cloudflare WARP 1.4 - Unquoted Service Path
Malwarebytes 4.5 - Unquoted Service Path
Foxit PDF Reader 11.0 - Unquoted Service Path
Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)
part-db 0.5.11 - Remote Code Execution (RCE)
Attendance and Payroll System v1.0 - Remote Code Execution (RCE)
Attendance and Payroll System v1.0 - SQLi Authentication Bypass
Hasura GraphQL 2.2.0 - Information Disclosure
 2022-03-08 05:01:37 +00:00
Offensive Security
00bdb64074 DB: 2022-03-03 
5 changes to exploits/shellcodes

Prowise Reflect v1.0.9 - Remote Keystroke Injection
Printix Client 1.3.1106.0 - Remote Code Execution (RCE)
Xerte 3.10.3 - Directory Traversal (Authenticated)
Xerte 3.9 - Remote Code Execution (RCE) (Authenticated)
Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
 2022-03-03 05:01:37 +00:00
Offensive Security
bba496461e DB: 2022-03-01 
6 changes to exploits/shellcodes

Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC)
Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC)
Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path

WAGO 750-8212 PFC200 G2 2ETH RS - Privilege Escalation
Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)
Casdoor 1.13.0 - SQL Injection (Unauthenticated)
 2022-03-01 05:01:37 +00:00
Offensive Security
7ebb89ceab DB: 2022-02-23 
1 changes to exploits/shellcodes

Adobe Flash Player - Integer Overflow
 2022-02-23 05:01:36 +00:00
Offensive Security
8691f166f7 DB: 2022-02-22 
12 changes to exploits/shellcodes

HMA VPN 5.3 - Unquoted Service Path
Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation
Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path
WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)
Cab Management System 1.0 - 'id' SQLi (Authenticated)
Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection
Thinfinity VirtualUI 2.5.26.2 - Information Disclosure
WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
Dbltek GoIP - Local File Inclusion
 2022-02-22 05:01:37 +00:00
Offensive Security
f2d7e05ad0 DB: 2022-02-19 
17 changes to exploits/shellcodes

Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path
Wondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path
Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path
Wondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service Path
TOSHIBA DVD PLAYER Navi Support Service - 'TNaviSrv' Unquoted Service Path
Bluetooth Application 5.4.277 - 'BlueSoleilCS' Unquoted Service Path
Intel(R) Management Engine Components 6.0.0.1189 - 'LMS' Unquoted Service Path
File Sanitizer for HP ProtectTools 5.0.1.3 - 'HPFSService' Unquoted Service Path
Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path
WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation
WordPress Plugin dzs-zoomsounds 6.60 - Remote Code Execution (RCE) (Unauthenticated)
Hotel Druid 3.0.3 - Remote Code Execution (RCE)
Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)

Solaris/SPARC - setuid(0) + chmod (/bin/ksh) + exit(0) Shellcode
Solaris/SPARC - chmod(./me) Shellcode
Solaris/SPARC - setuid(0) + execve (/bin/ksh) Shellcode
Linux/MIPS - N32 MSB Reverse Shell Shellcode
 2022-02-19 05:01:36 +00:00
Offensive Security
a300bd948f DB: 2022-02-17 
8 changes to exploits/shellcodes

TeamSpeak 3.5.6 - Insecure File Permissions
Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path

H3C SSL VPN - Username Enumeration
Multi-Vendor Online Groceries Management System 1.0 - 'id' Blind SQL Injection
Simple Student Quarterly Result/Grade System 1.0 - SQLi Authentication Bypass
ServiceNow - Username Enumeration
Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
 2022-02-17 05:01:36 +00:00
Offensive Security
41553c4004 DB: 2022-02-09 
11 changes to exploits/shellcodes

Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated)
Hotel Reservation System 1.0 - SQLi (Unauthenticated)
Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)
FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)
Hospital Management System 4.0 - 'multiple' SQL Injection
WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS)
Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion
WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS)

Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
 2022-02-09 05:02:00 +00:00
Offensive Security
30be173453 DB: 2022-02-05 
8 changes to exploits/shellcodes

FLAME II MODEM USB - Unquoted Service Path
WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting (XSS) (Authenticated)
Servisnet Tessa - Privilege Escalation (Metasploit)
Servisnet Tessa - MQTT Credentials Dump (Unauthenticated) (Metasploit)
Servisnet Tessa - Add sysAdmin User (Unauthenticated) (Metasploit)

Windows/x86 - Download File and Execute / Dynamic PEB & EDT method Shellcode (458 bytes)
Windows/x86 - Locate kernel32 base address / Memory Sieve method Shellcode (133 bytes)
 2022-02-05 05:01:59 +00:00
Offensive Security
1472d8e723 DB: 2022-01-06 
32 changes to exploits/shellcodes

Siemens S7 Layer 2 - Denial of Service (DoS)
TRIGONE Remote System Monitor 3.61 - Unquoted Service Path
Automox Agent 32 - Local Privilege Escalation
ConnectWise Control 19.2.24707 - Username Enumeration
Accu-Time Systems MAXIMUS 1.0 - Telnet Remote Buffer Overflow (DoS)
AWebServer GhostBuilding 18 - Denial of Service (DoS)
TermTalk Server 3.24.0.2 - Arbitrary File Read (Unauthenticated)
Dixell XWEB 500 - Arbitrary File Write
Gerapy 0.9.7 - Remote Code Execution (RCE) (Authenticated)
CMSimple 5.4 - Cross Site Scripting (XSS)
RiteCMS 3.1.0 - Arbitrary File Overwrite (Authenticated)
RiteCMS 3.1.0 - Arbitrary File Deletion (Authenticated)
RiteCMS 3.1.0 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting (XSS) (Unauthenticated)
WordPress Plugin WP Visitor Statistics 4.7 - SQL Injection
Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)
Movie Rating System 1.0 - SQLi to RCE (Unauthenticated)
Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)
Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)
SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
Nettmp NNT 5.1 - SQLi Authentication Bypass
Hostel Management System 2.1 - Cross Site Scripting (XSS)
Hospitals Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)
BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
Hospitals Patient Records Management System 1.0 - Account TakeOver
Virtual Airlines Manager 2.6.2 - 'multiple' SQL Injection
Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated)
Vodafone H-500-s 3.5.10 - WiFi Password Disclosure
openSIS Student Information System 8.0 - 'multiple' SQL Injection
Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS)
WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)
 2022-01-06 05:01:54 +00:00
Offensive Security
929e254945 DB: 2021-12-17 
4 changes to exploits/shellcodes

Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
Croogo 3.0.2 - Unrestricted File Upload
Croogo 3.0.2 - 'Multiple' Stored Cross-Site Scripting (XSS)
Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
 2021-12-17 05:01:54 +00:00
Offensive Security
c906261f2c DB: 2021-12-10 
11 changes to exploits/shellcodes

MTPutty 1.0.1.21 - SSH Password Disclosure

Raspberry Pi 5.10 - Default Credentials
Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)
Chikitsa Patient Management System 2.0.2 - 'backup' Remote Code Execution (RCE) (Authenticated)
LimeSurvey 5.2.4 - Remote Code Execution (RCE) (Authenticated)
TestLink 1.19 - Arbitrary File Download (Unauthenticated)
Student Management System 1.0 - SQLi Authentication Bypass
Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution (RCE) (Authenticated)
Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
Employees Daily Task Management System 1.0 - 'username' SQLi Authentication Bypass
Employees Daily Task Management System 1.0 - 'multiple' Cross Site Scripting (XSS)
 2021-12-10 05:02:03 +00:00
Offensive Security
897c47e020 DB: 2021-11-30 
7 changes to exploits/shellcodes

Joomla! 3.9.13 - 'Host' Header Injection
orangescrum 1.8.0 - Privilege escalation (Authenticated)
orangescrum 1.8.0 - 'Multiple' SQL Injection (Authenticated)
orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting (XSS) (Authenticated)
opencart 3.0.3.8 - Sessjion Injection
 2021-11-30 05:02:04 +00:00
Offensive Security
c60e7e2012 DB: 2021-11-27 
1 changes to exploits/shellcodes

Bagisto 1.3.3 - Client-Side Template Injection
 2021-11-27 05:02:13 +00:00
Offensive Security
e774c1d169 DB: 2021-11-24 
6 changes to exploits/shellcodes

Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)

GNU gdbserver 9.2 - Remote Command Execution (RCE)
Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure
Webrun 3.6.0.42 - 'P_0' SQL Injection
Bus Pass Management System 1.0 - 'Search' SQL injection
FLEX 1085 Web 1.6.0 - HTML Injection
 2021-11-24 05:02:19 +00:00
Offensive Security
11900b8459 DB: 2021-11-17 
2 changes to exploits/shellcodes

Online Learning System 2.0 - Remote Code Execution (RCE)
CMDBuild 3.3.2 - 'Multiple' Cross Site Scripting (XSS)
 2021-11-17 05:02:13 +00:00
Offensive Security
412b034ee9 DB: 2021-11-16 
6 changes to exploits/shellcodes

WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)
KONGA 0.14.9 - Privilege Escalation
Simple Subscription Website 1.0 - SQLi Authentication Bypass
Fuel CMS 1.4.13 - 'col' Blind SQL Injection (Authenticated)
WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated)
PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
 2021-11-16 05:02:13 +00:00
Offensive Security
a7e24bac97 DB: 2021-11-13 
5 changes to exploits/shellcodes

Xlight FTP 3.9.3.1 - Buffer Overflow (PoC)

Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnschade Local Privilege Escalation
WordPress Plugin WP Symposium Pro 2021.10 - 'wps_admin_forum_add_name' Stored Cross-Site Scripting (XSS)
WordPress Plugin AccessPress Social Icons 1.8.2 - 'icon title' Stored Cross-Site Scripting (XSS)
Mumara Classic 2.93 - 'license' SQL Injection (Unauthenticated)
 2021-11-13 05:02:11 +00:00
Offensive Security
5310d503ac DB: 2021-11-12 
5 changes to exploits/shellcodes

AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)
AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)
YeaLink SIP-TXXXP 53.84.0.15 - 'cmd' Command Injection (Authenticated)
Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
FormaLMS 2.4.4 - Authentication Bypass
 2021-11-12 05:02:08 +00:00
Offensive Security
d8eefee2c7 DB: 2021-11-09 
8 changes to exploits/shellcodes

zlog 1.2.15 - Buffer Overflow
Simple Client Management System 1.0 - SQLi (Authentication Bypass)
Simple Client Management System 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)
Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)
Money Transfer Management System 1.0 - Authentication Bypass
Froxlor 0.10.29.1 - SQL Injection (Authenticated)
WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion
FusionPBX 4.5.29 - Remote Code Execution (RCE) (Authenticated)
 2021-11-09 05:02:09 +00:00
Offensive Security
3e60115da8 DB: 2021-11-06 
3 changes to exploits/shellcodes

10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service Path
Payment Terminal 3.1 - 'Multiple' Cross-Site Scripting (XSS)
ImportExportTools NG 10.0.4 - HTML Injection
 2021-11-06 05:02:14 +00:00
Offensive Security
6829e7f3b7 DB: 2021-11-04 
17 changes to exploits/shellcodes

RDP Manager 4.9.9.3 - Denial-of-Service (PoC)
PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS)
WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS)
Fuel CMS 1.4.1 - Remote Code Execution (3)
Eclipse Jetty 11.0.5 - Sensitive File Disclosure
WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS)
OpenAM 13.0 - LDAP Injection
Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection
Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS)
PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS)
PHP Melody 3.0 - 'vid' SQL Injection
Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection
PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS)
Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)
Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS)
Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
 2021-11-04 05:02:12 +00:00