Exploit-DB
d69eaacef8
DB: 2025-05-26
...
8 changes to exploits/shellcodes/ghdb
Java-springboot-codebase 1.1 - Arbitrary File Read
ABB Cylon Aspect Studio 3.08.03 - Binary Planting
ABB Cylon Aspect 3.08.03 - Guest2Root Privilege Escalation
Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow
WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass
Microsoft Windows Server 2016 - Win32k Elevation of Privilege
Windows 2024.15 - Unauthenticated Desktop Screenshot Capture
2025-05-26 00:16:29 +00:00
Exploit-DB
6d030b37a6
DB: 2025-05-22
...
6 changes to exploits/shellcodes/ghdb
Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)
Linux/x86 - Reverse TCP Shellcode (95 bytes)
Linux/x86-64 - execve(_/bin/sh_) Shellcode (36 bytes)
Windows 11 x64 - Reverse TCP Shellcode (564 bytes)
2025-05-22 00:16:30 +00:00
Exploit-DB
9044a602bb
DB: 2025-05-10
...
6 changes to exploits/shellcodes/ghdb
Apache ActiveMQ 6.1.6 - Denial of Service (DOS)
SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation
WordPress Depicter Plugin 3.6.1 - SQL Injection
Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation
VirtualBox 7.0.16 - Privilege Escalation
2025-05-10 00:16:28 +00:00
Exploit-DB
5544e2e039
DB: 2025-05-02
...
5 changes to exploits/shellcodes/ghdb
Daikin Security Gateway 14 - Remote Password Reset
ZTE ZXV10 H201L - RCE via authentication bypass
Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
Microsoft Windows - XRM-MS File NTLM Information Disclosure Spoofing
2025-05-02 00:16:30 +00:00
Exploit-DB
6cef641858
DB: 2025-04-23
...
9 changes to exploits/shellcodes/ghdb
tar-fs 3.0.0 - Arbitrary File Write/Overwrite
OpenSSH server (sshd) 9.8p1 - Race Condition
Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution
code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)
WonderCMS 3.4.2 - Remote Code Execution (RCE)
WordPress Core 6.2 - Directory Traversal
Microsoft Windows 11 - Kernel Privilege Escalation
Microsoft Windows 11 23h2 - CLFS.sys Elevation of Privilege
2025-04-23 00:16:28 +00:00
Exploit-DB
9ddf81331a
DB: 2025-04-18
...
10 changes to exploits/shellcodes/ghdb
TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
compop.ca 3.5.3 - Arbitrary code Execution
Usermin 2.100 - Username Enumeration
ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution
ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal
AnyDesk 9.0.1 - Unquoted Service Path
2025-04-18 00:16:31 +00:00
Exploit-DB
7ebfc36557
DB: 2025-04-17
...
24 changes to exploits/shellcodes/ghdb
ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE)
Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account
Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE)
FLIR AX8 1.46.16 - Remote Command Injection
ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)
Ethercreative Logs 3.0.3 - Path Traversal
Garage Management System 1.0 (categoriesName) - Stored XSS
Nagios Log Server 2024R1.3.1 - Stored XSS
ProConf 6.0 - Insecure Direct Object Reference (IDOR)
Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection
ABB Cylon Aspect 3.08.03 (webServerDeviceLabelUpdate.php) - File Write DoS
ABB Cylon Aspect 4.00.00 (factorySaved.php) - Unauthenticated XSS
ABB Cylon Aspect 4.00.00 (factorySetSerialNum.php) - Remote Code Execution
Car Rental Project 1.0 - Remote Code Execution
KodExplorer 4.52 - Open Redirect
NagVis 1.9.33 - Arbitrary File Read
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
Smart Manager 8.27.0 - Post-Authenticated SQL Injection
Zabbix 7.0.0 - SQL Injection
Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE)
Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass
WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
2025-04-17 00:16:29 +00:00
Exploit-DB
60175c9963
DB: 2025-04-14
...
52 changes to exploits/shellcodes/ghdb
Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection
Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)
Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection
Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection
Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)
Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
DataEase 2.4.0 - Database Configuration Information Exposure
Cosy+ firmware 21.2s7 - Command Injection
Angular-Base64-Upload Library 0.1.20 - Remote Code Execution (RCE)
K7 Ultimate Security K7RKScan.sys 17.0.2019 - Denial Of Service (DoS)
ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated)
ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
ABB Cylon Aspect 3.07.02 - File Disclosure
ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover
CyberPanel 2.3.6 - Remote Code Execution (RCE)
IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow
Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)
MagnusSolution magnusbilling 7.3.0 - Command Injection
Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
Sonatype Nexus Repository 3.53.0-01 - Path Traversal
Watcharr 1.43.0 - Remote Code Execution (RCE)
Webmin Usermin 2.100 - Username Enumeration
ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials
ABB Cylon Aspect 3.08.01 - Arbitrary File Delete
ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials
ABB Cylon Aspect 3.08.01 - Arbitrary File Delete
AquilaCMS 1.409.20 - Remote Command Execution (RCE)
Artica Proxy 4.50 - Remote Code Execution (RCE)
Centron 19.04 - Remote Code Execution (RCE)
ChurchCRM 5.9.1 - SQL Injection
CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS)
CodeCanyon RISE CRM 3.7.0 - SQL Injection
Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
Feng Office 3.11.1.2 - SQL Injection
flatCore 1.5 - Cross Site Request Forgery (CSRF)
flatCore 1.5.5 - Arbitrary File Upload
flatCore 1.5 - Cross Site Request Forgery (CSRF)
flatCore 1.5.5 - Arbitrary File Upload
GetSimpleCMS 3.3.16 - Remote Code Execution (RCE)
Gnuboard5 5.3.2.8 - SQL Injection
LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection
Litespeed Cache 6.5.0.1 - Authentication Bypass
MiniCMS 1.1 - Cross Site Scripting (XSS)
MoziloCMS 3.0 - Remote Code Execution (RCE)
NEWS-BUZZ News Management System 1.0 - SQL Injection
PandoraFMS 7.0NG.772 - SQL Injection
phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)
PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF)
ResidenceCMS 2.10.1 - Stored Cross-Site Scripting (XSS)
RosarioSIS 7.6 - SQL Injection
Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
Typecho 1.3.0 - Race Condition
Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
Typecho 1.3.0 - Race Condition
Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)
Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure
2025-04-14 00:16:26 +00:00
Exploit-DB
989122095f
DB: 2025-04-04
...
11 changes to exploits/shellcodes/ghdb
AppSmith 1.47 - Remote Code Execution (RCE)
ollama 0.6.4 - Server Side Request Forgery (SSRF)
Vite 6.2.2 - Arbitrary File Read
ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated)
Nagios Log Server 2024R1.3.1 - Stored XSS
Webmin Usermin 2.100 - Username Enumeration
ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials
openSIS 9.1 - SQLi (Authenticated)
Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure
ProSSHD 1.2 - Denial of Service (DOS)
2025-04-04 00:16:25 +00:00
Exploit-DB
c773b14d1c
DB: 2025-04-03
...
6 changes to exploits/shellcodes/ghdb
Mitel mitel-cs018 - Call Data Information Disclosure
SAP NetWeaver - 7.53 - HTTP Request Smuggling
ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
ABB Cylon Aspect 3.08.01 - Arbitrary File Delete
Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
ProSSHD 1.2 - Denial of Service (DOS)
2025-04-03 00:16:28 +00:00
Exploit-DB
6805102b8a
DB: 2025-03-30
...
3 changes to exploits/shellcodes/ghdb
XWiki Standard 14.10 - Remote Code Execution (RCE)
Solstice Pod 6.2 - API Session Key Extraction via API Endpoint
2025-03-30 00:16:28 +00:00
Exploit-DB
51ef1693d4
DB: 2025-03-23
...
4 changes to exploits/shellcodes/ghdb
Aztech DSL5005EN Router - 'sysAccess.asp' Admin Password Change (Unauthenticated)
TeamPass 3.0.0.21 - SQL Injection
Microsoft Windows - NTLM Hash Leak Malicious Windows Theme
2025-03-23 00:16:32 +00:00
Exploit-DB
04fa5ba95d
DB: 2025-03-20
...
6 changes to exploits/shellcodes/ghdb
Gitea 1.24.0 - HTML Injection
Extensive VC Addons for WPBakery page builder 1.9.0 - Remote Code Execution (RCE)
Loaded Commerce 6.6 - Client-Side Template Injection(CSTI)
TranzAxis 3.2.41.10.26 - Stored Cross-Site Scripting (XSS) (Authenticated)
VeeVPN 1.6.1 - Unquoted Service Path
2025-03-20 00:16:32 +00:00
Exploit-DB
32e0cc5e7f
DB: 2024-08-29
...
5 changes to exploits/shellcodes/ghdb
Gitea 1.22.0 - Stored XSS
NoteMark < 0.13.0 - Stored XSS
Invesalius3 - Remote Code Execution
Windows TCP/IP - RCE Checker and Denial of Service
2024-08-29 00:16:41 +00:00
Exploit-DB
507bd26e3e
DB: 2024-08-05
...
6 changes to exploits/shellcodes/ghdb
Ivanti vADC 9.9 - Authentication Bypass
Devika v1 - Path Traversal via 'snapshot_path'
Genexus Protection Server 9.7.2.10 - 'protsrvservice' Unquoted Service Path
Oracle Database 12c Release 1 - Unquoted Service Path
SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path
2024-08-05 00:16:24 +00:00
Exploit-DB
c27f5a1741
DB: 2024-07-17
...
2 changes to exploits/shellcodes/ghdb
Bonjour Service 'mDNSResponder.exe' - Unquoted Service Path Privilege Escalation
2024-07-17 00:16:34 +00:00
Exploit-DB
859e322e5c
DB: 2024-07-03
...
13 changes to exploits/shellcodes/ghdb
ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) & SSH Access
Zyxel IKE Packet Decoder - Unauthenticated Remote Code Execution (Metasploit)
Rebar3 3.13.2 - Command Injection
Craft CMS Logs Plugin 3.0.3 - Path Traversal (Authenticated)
ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure
2024-07-03 00:16:27 +00:00
Exploit-DB
ea4df5672e
DB: 2024-06-02
...
6 changes to exploits/shellcodes/ghdb
ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) & SSH Access
Akaunting 3.1.8 - Server-Side Template Injection (SSTI)
Craft CMS Logs Plugin 3.0.3 - Path Traversal (Authenticated)
FreePBX 16 - Remote Code Execution (RCE) (Authenticated)
Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure
2024-06-02 00:16:32 +00:00
Exploit-DB
9d17a3d6ca
DB: 2024-05-14
...
10 changes to exploits/shellcodes/ghdb
CrushFTP < 11.1.0 - Directory Traversal
Apache mod_proxy_cluster - Stored XSS
CE Phoenix Version 1.0.8.20 - Stored XSS
Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
Prison Management System - SQL Injection Authentication Bypass
PyroCMS v3.0.1 - Stored XSS
Plantronics Hub 3.25.1 - Arbitrary File Read
2024-05-14 00:16:26 +00:00
Exploit-DB
034fafa3fd
DB: 2024-04-09
...
8 changes to exploits/shellcodes/ghdb
Positron Broadcast Signal Processor TRA7005 v1.20 - Authentication Bypass
Best Student Result Management System v1.0 - Multiple SQLi
Daily Expense Manager 1.0 - 'term' SQLi
Human Resource Management System v1.0 - Multiple SQLi
Open Source Medicine Ordering System v1.0 - SQLi
Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
AnyDesk 7.0.15 - Unquoted Service Path
2024-04-09 00:16:23 +00:00
Exploit-DB
a06b0db78d
DB: 2024-04-04
...
6 changes to exploits/shellcodes/ghdb
Computer Laboratory Management System v1.0 - Multiple-SQLi
Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
Quick CMS v6.7 en 2023 - 'password' SQLi
Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting (XSS)
ESET NOD32 Antivirus 17.0.16.0 - Unquoted Service Path
2024-04-04 00:16:33 +00:00
Exploit-DB
a44e138f78
DB: 2024-04-03
...
28 changes to exploits/shellcodes/ghdb
Casdoor < v1.331.0 - '/api/set-password' CSRF
GL-iNet MT6000 4.5.5 - Arbitrary File Download
Axigen < 10.5.7 - Persistent Cross-Site Scripting
Blood Bank v1.0 - Stored Cross Site Scripting (XSS)
CE Phoenix v1.0.8.20 - Remote Code Execution
Daily Habit Tracker 1.0 - Broken Access Control
Daily Habit Tracker 1.0 - SQL Injection
Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)
Elementor Website Builder < 3.12.2 - Admin+ SQLi
Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection
Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login)
FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
Gibbon LMS v26.0.00 - SSTI vulnerability
Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)
Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated)
OpenCart Core 4.0.2.3 - 'search' SQLi
Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal
Smart School 6.4.1 - SQL Injection
Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
ASUS Control Center Express 01.06.15 - Unquoted Service Path
Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G
Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
2024-04-03 00:16:27 +00:00
Exploit-DB
e791587e41
DB: 2024-03-29
...
10 changes to exploits/shellcodes/ghdb
RouterOS 6.40.5 - 6.44 and 6.48.1 - 6.49.10 - Denial of Service
Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure
Dell Security Management Server <1.9.0 - Local Privilege Escalation
Asterisk AMI - Partial File Content & Path Disclosure (Authenticated)
Broken Access Control - on NodeBB v3.6.7
liveSite Version 2019.1 - Remote Code Execution
Purei CMS 1.0 - SQL Injection
Workout Journal App 1.0 - Stored XSS
WinRAR version 6.22 - Remote Code Execution via ZIP archive
2024-03-29 00:16:30 +00:00
Exploit-DB
26a991fc28
DB: 2024-03-23
...
2 changes to exploits/shellcodes/ghdb
minaliC 2.0.0 - Denied of Service
2024-03-23 00:16:33 +00:00
Exploit-DB
8c78d80c78
DB: 2024-03-17
...
7 changes to exploits/shellcodes/ghdb
Karaf v4.4.3 Console - RCE
Nokia BMC Log Scanner - Remote Code Execution
vm2 - sandbox escape
UPS Network Management Card 4 - Path Traversal
Winter CMS 1.2.3 - Server-Side Template Injection (SSTI) (Authenticated)
LaborOfficeFree 19.10 - MySQL Root Password Calculator
2024-03-17 00:16:40 +00:00
Exploit-DB
2af1700331
DB: 2024-03-15
...
10 changes to exploits/shellcodes/ghdb
Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)
SolarView Compact 6.00 - Command Injection
Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE)
GitLab CE/EE < 16.7.2 - Password Reset
JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)
KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow
KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow
KiTTY 0.76.1.13 - Command Injection
2024-03-15 00:16:19 +00:00
Exploit-DB
ce58678266
DB: 2024-03-12
...
7 changes to exploits/shellcodes/ghdb
Sitecore - Remote Code Execution v8.2
Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore < 14.8.7825.01 - IDOR
Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read
WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover
Microsoft Windows Defender / Trojan.Win32/Powessere.G - Detection Mitigation Bypass
2024-03-12 00:16:25 +00:00
Exploit-DB
ba28fce174
DB: 2024-02-20
...
9 changes to exploits/shellcodes/ghdb
SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration
Wondercms 4.3.2 - XSS to RCE
Employee Management System v1 - 'email' SQL Injection
JFrog Artifactory < 7.25.4 - Blind SQL Injection
phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit
XAMPP - Buffer Overflow POC
Microsoft Windows Defender - VBScript Detection Bypass
Microsoft Windows Defender Bypass - Detection Mitigation Bypass
2024-02-20 00:16:25 +00:00
Exploit-DB
5c0c152cec
DB: 2024-02-14
...
6 changes to exploits/shellcodes/ghdb
VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) - Remote Denial Of Service
Splunk 9.0.4 - Information Disclosure
Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over
ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure
2024-02-14 00:16:18 +00:00
Exploit-DB
81ae91fdae
DB: 2024-02-03
...
14 changes to exploits/shellcodes/ghdb
Electrolink FM/DAB/TV Transmitter - Unauthenticated Remote DoS
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
Electrolink FM/DAB/TV Transmitter (Login Cookie) - Authentication Bypass
Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) - Credentials Disclosure
Electrolink FM/DAB/TV Transmitter - Pre-Auth MPFS Image Remote Code Execution
Electrolink FM/DAB/TV Transmitter - Remote Authentication Removal
TP-LINK TL-WR740N - Multiple HTML Injection
TP-Link TL-WR740N - UnAuthenticated Directory Transversal
Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC)
mooSocial 3.1.8 - Cross-Site Scripting (XSS) on User Login Page
PCMan FTP Server 2.0 - 'pwd' Remote Buffer Overflow
WebCatalog 48.4 - Arbitrary Protocol Execution
2024-02-03 00:16:34 +00:00
Exploit-DB
a5920da7af
DB: 2024-01-30
...
10 changes to exploits/shellcodes/ghdb
Ricoh Printer - Directory and File Exposure
Blood Bank & Donor Management System using v2.2 - Stored XSS
Equipment Rental Script-1.0 - SQLi
Bank Locker Management System - SQL Injection
Fundraising Script 1.0 - SQLi
PHP Shopping Cart 4.2 - Multiple-SQLi
7 Sticky Notes v1.9 - OS Command Injection
Typora v1.7.4 - OS Command Injection
2024-01-30 00:16:26 +00:00
Exploit-DB
f3649a641f
DB: 2023-10-10
...
24 changes to exploits/shellcodes/ghdb
Minio 2022-07-29T19-40-48Z - Path traversal
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service
Atcom 2.7.x.x - Authenticated Command Injection
Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE)
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction
OpenPLC WebServer 3 - Denial of Service
Splunk 9.0.5 - admin account take over
BoidCMS v2.0.0 - authenticated file upload vulnerability
Cacti 1.2.24 - Authenticated command injection when using SNMP options
Chitor-CMS v1.1.2 - Pre-Auth SQL Injection
Clcknshop 1.0.0 - SQL Injection
Coppermine Gallery 1.6.25 - RCE
Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
GLPI GZIP(Py3) 9.4.5 - RCE
Limo Booking Software v1.0 - CORS
Media Library Assistant Wordpress Plugin - RCE and LFI
Online ID Generator 1.0 - Remote Code Execution (RCE)
Shuttle-Booking-Software v1.0 - Multiple-SQLi
Webedition CMS v2.9.8.8 - Blind SSRF
WEBIGniter v28.7.23 File Upload - Remote Code Execution
Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation
Wordpress Sonaar Music Plugin 4.7 - Stored XSS
Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
2023-10-10 00:16:32 +00:00
Exploit-DB
cbe784b087
DB: 2023-09-09
...
16 changes to exploits/shellcodes/ghdb
Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS
Drupal 10.1.2 - web-cache-poisoning-External-service-interaction
Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure
soosyze 2.0.0 - File Upload
SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection
Wordpress Plugin Elementor 3.5.5 - Iframe Injection
Wp2Fac - OS Command Injection
Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
SyncBreeze 15.2.24 - 'login' Denial of Service
GOM Player 2.3.90.5360 - Buffer Overflow (PoC)
GOM Player 2.3.90.5360 - Remote Code Execution (RCE)
Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes)
2023-09-09 00:16:33 +00:00
Exploit-DB
4e246a01fb
DB: 2023-09-05
...
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
2023-09-05 00:16:27 +00:00
Exploit-DB
e07f33f24d
DB: 2023-08-22
...
17 changes to exploits/shellcodes/ghdb
EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)
EuroTel ETL3100 - Transmitter Default Credentials
EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download
Color Prediction Game v1.0 - SQL Injection
Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
Dolibarr Version 17.0.1 - Stored XSS
Global - Multi School Management System Express v1.0- SQL Injection
OVOO Movie Portal CMS v3.3.3 - SQL Injection
PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities
Taskhub CRM Tool 2.8.6 - SQL Injection
Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
TSplus 16.0.0.0 - Remote Work Insecure Files and Folders
TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions
Linux/x64 - memfd_create ELF loader Shellcode (170 bytes)
2023-08-22 00:16:22 +00:00
Exploit-DB
f55092b332
DB: 2023-08-11
...
6 changes to exploits/shellcodes/ghdb
TP-Link Archer AX21 - Unauthenticated Command Injection
systemd 246 - Local Privilege Escalation
Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)
Request-Baskets v1.2.1 - Server-side request forgery (SSRF)
OutSystems Service Studio 11.53.30 - DLL Hijacking
2023-08-11 00:16:25 +00:00
Exploit-DB
010e679abe
DB: 2023-08-05
...
25 changes to exploits/shellcodes/ghdb
ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)
Shelly PRO 4PM v0.11.0 - Authentication Bypass
Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
Academy LMS 6.0 - Reflected XSS
Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload
JLex GuestBook 1.6.4 - Reflected XSS
Joomla JLex Review 6.0.1 - Reflected XSS
News Portal v4.0 - SQL Injection (Unauthorized)
PHPJabbers Cleaning Business 1.0 - Reflected XSS
PHPJabbers Night Club Booking 1.0 - Reflected XSS
PHPJabbers Rental Property Booking 2.0 - Reflected XSS
PHPJabbers Service Booking Script 1.0 - Reflected XSS
PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
PHPJabbers Taxi Booking 2.0 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webutler v3.2 - Remote Code Execution (RCE)
WordPress adivaha Travel Plugin 2.3 - Reflected XSS
WordPress adivaha Travel Plugin 2.3 - SQL Injection
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS
Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)
2023-08-05 00:16:32 +00:00
Exploit-DB
5eb89a2046
DB: 2023-08-01
...
5 changes to exploits/shellcodes/ghdb
Joomla iProperty Real Estate 4.1.1 - Reflected XSS
Joomla Solidres 2.13.3 - Reflected XSS
RosarioSIS 10.8.4 - CSV Injection
Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
WordPress Plugin AN_Gradebook 5.0.1 - SQLi
General Device Manager 2.5.2.2 - Buffer Overflow (SEH)
2023-08-01 00:16:36 +00:00
Exploit-DB
c18d9953a2
DB: 2023-07-29
...
22 changes to exploits/shellcodes/ghdb
Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping
Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities
Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS)
Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities
Joomla HikaShop 4.7.4 - Reflected XSS
Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS
mooDating 1.2 - Reflected Cross-site scripting (XSS)
October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)
PaulPrinting CMS - (Search Delivery) Cross Site Scripting
Perch v3.2 - Persistent Cross Site Scripting (XSS)
RosarioSIS 10.8.4 - CSV Injection
WordPress Plugin AN_Gradebook 5.0.1 - SQLi
Zomplog 3.9 - Cross-site scripting (XSS)
zomplog 3.9 - Remote Code Execution (RCE)
copyparty 1.8.2 - Directory Traversal
copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)
GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution
mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory
Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
2023-07-29 00:16:43 +00:00
Exploit-DB
98cdb05106
DB: 2023-07-21
...
10 changes to exploits/shellcodes/ghdb
Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.
RWS WorldServer 11.7.3 - Session Token Enumeration
Aures Booking & POS Terminal - Local Privilege Escalation
Boom CMS v8.0.7 - Cross Site Scripting
PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities
pfSense v2.7.0 - OS Command Injection
Webile v1.0.1 - Multiple Cross Site Scripting
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
RaidenFTPD 2.4.4005 - Buffer Overflow (SEH)
2023-07-21 00:16:29 +00:00
Exploit-DB
fd788a92e3
DB: 2023-07-16
...
9 changes to exploits/shellcodes/ghdb
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Admidio v4.2.10 - Remote Code Execution (RCE)
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
Bus Pass Management System 1.0 - 'viewid' SQL Injection
Icinga Web 2.10 - Authenticated Remote Code Execution
News Portal v4.0 - SQL Injection (Unauthorized)
Pluck v4.7.18 - Remote Code Execution (RCE)
ProjeQtOr Project Management System v10.4.1 - Multiple XSS
WinterCMS < 1.2.3 - Persistent Cross-Site Scripting
XAMPP 8.2.4 - Unquoted Path
2023-07-16 00:16:39 +00:00
Exploit-DB
00f5021452
DB: 2023-07-12
...
10 changes to exploits/shellcodes/ghdb
Ateme TITAN File 3.9 - SSRF File Enumeration
Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Spring Cloud 3.2.2 - Remote Command Execution (RCE)
BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)
AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_
Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_
MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
2023-07-12 00:16:54 +00:00
Exploit-DB
743db0e747
DB: 2023-07-08
...
4 changes to exploits/shellcodes/ghdb
Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 - 'Search' SQL injection
Faculty Evaluation System v1.0 - SQL Injection
Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
2023-07-08 00:16:23 +00:00
Exploit-DB
7807e6f266
DB: 2023-06-27
...
7 changes to exploits/shellcodes/ghdb
Azure Apache Ambari 2302250400 - Spoofing
Microsoft SharePoint Enterprise Server 2016 - Spoofing
Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection
Xenforo Version 2.2.13 - Authenticated Stored XSS
Windows 11 22h2 - Kernel Privilege Elevation
2023-06-27 00:17:09 +00:00
Exploit-DB
c79c4813de
DB: 2023-06-24
...
4 changes to exploits/shellcodes/ghdb
MCL-Net 4.3.5.8788 - Information Disclosure
Abantecart v1.3.2 - Authenticated Remote Code Execution
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
NCH Express Invoice - Clear Text Password Storage and Account Takeover
2023-06-24 00:16:23 +00:00
Exploit-DB
12f9039552
DB: 2023-06-08
...
2 changes to exploits/shellcodes/ghdb
Apache 2.4.x - Buffer Overflow
Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)
USB Flash Drives Control 4.1.0.0 - Unquoted Service Path
2023-06-08 00:16:21 +00:00
Exploit-DB
ccfd0c515d
DB: 2023-06-07
...
3 changes to exploits/shellcodes/ghdb
Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)
Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)
GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)
Macro Expert 4.9 - Unquoted Service Path
2023-06-07 00:16:24 +00:00
Exploit-DB
9be142a874
DB: 2023-05-26
...
7 changes to exploits/shellcodes/ghdb
Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)
SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
Ulicms 2023.1 - create admin user via mass assignment
WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)
Zenphoto 1.6 - Multiple stored XSS
Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
2023-05-26 00:16:47 +00:00
Exploit-DB
0a7adaa3fc
DB: 2023-05-24
...
40 changes to exploits/shellcodes/ghdb
Optoma 1080PSTX Firmware C02 - Authentication Bypass
Screen SFT DAB 600/C - Authentication Bypass Account Creation
Screen SFT DAB 600/C - Authentication Bypass Admin Password Change
Screen SFT DAB 600/C - Authentication Bypass Erase Account
Screen SFT DAB 600/C - Authentication Bypass Password Change
Screen SFT DAB 600/C - Authentication Bypass Reset Board Config
Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)
PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Apache Superset 2.0.0 - Authentication Bypass
FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)
PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
Affiliate Me Version 5.0.1 - SQL Injection
Best POS Management System v1.0 - Unauthenticated Remote Code Execution
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
e107 v2.3.2 - Reflected XSS
File Thingie 2.5.7 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
LeadPro CRM v1.0 - SQL Injection
PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)
Prestashop 8.0.4 - CSV injection
Quicklancer v1.0 - SQL Injection
SitemagicCMS 4.4.3 - Remote Code Execution (RCE)
Smart School v1.0 - SQL Injection
Stackposts Social Marketing Tool v1.0 - SQL Injection
thrsrossi Millhouse-Project 1.414 - Remote Code Execution
TinyWebGallery v2.5 - Remote Code Execution (RCE)
WBiz Desk 1.2 - SQL Injection
Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup
Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title
Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking
MobileTrans 4.0.11 - Weak Service Privilege Escalation
Trend Micro OfficeScan Client 10.0 - ACL Service LPE
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
2023-05-24 00:16:34 +00:00
Exploit-DB
668314bbda
DB: 2023-05-03
...
19 changes to exploits/shellcodes/ghdb
FS-S3900-24T4S - Privilege Escalation
Virtual Reception v1.0 - Web Server Directory Traversal
admidio v4.2.5 - CSV Injection
Companymaps v8.0 - Stored Cross Site Scripting (XSS)
GLPI 9.5.7 - Username Enumeration
OpenEMR v7.0.1 - Authentication credentials brute force
PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting
PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)
PHPJabbers Simple CMS 5.0 - SQL Injection
PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)
phpMyFAQ v3.1.12 - CSV Injection
projectSend r1605 - Private file download
revive-adserver v5.4.1 - Cross-Site Scripting (XSS)
Serendipity 2.4.0 - File Inclusion RCE
SoftExpert (SE) Suite v2.1.3 - Local File Inclusion
Advanced Host Monitor v12.56 - Unquoted Service Path
MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
2023-05-03 00:16:23 +00:00
