AkkuS

99 exploits Active since Nov 2018
CVE-2022-22833 EXPLOITDB HIGH ruby WORKING POC
Servisnet Tessa 0.0.2 - Info Disclosure
An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.
CVSS 7.5
CVE-2022-22832 EXPLOITDB CRITICAL ruby WORKING POC
Servisnet Tessa - IDOR
An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request.
CVSS 9.8
CVE-2021-3113 EXPLOITDB HIGH ruby WORKING POC
Netsia SEBA+ <0.16.1 build 70-e669dcd7 - Info Disclosure
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and can then use that cookie immediately for admin access,
CVSS 7.5
CVE-2018-19457 EXPLOITDB HIGH text WORKING POC
Logicspice FAQ Script <2.9.7 - Command Injection
Logicspice FAQ Script 2.9.7 allows uploading arbitrary files, which leads to remote command execution via admin/faqs/faqimages with a .php file.
CVSS 7.2
CVE-2018-19798 EXPLOITDB HIGH python WORKING POC
Fleetco FMM <1.2 - RCE
Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_add.php?submit=1 URI, as demonstrated by the value_Images_1 field, which leads to remote command execution on the remote server. Any authenticated user can exploit this.
CVSS 8.8
CVE-2019-9624 METASPLOIT HIGH ruby WORKING POC
Webmin 1.900 - RCE
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.
CVSS 7.8
CVE-2019-11631 METASPLOIT ruby WORKING POC
(pending title)
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE-2019-15107 METASPLOIT CRITICAL ruby WORKING POC
Webmin < 1.920 - OS Command Injection
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
CVSS 9.8
CVE-2019-12840 METASPLOIT HIGH ruby WORKING POC
Webmin < 1.910 - OS Command Injection
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
CVSS 8.8
CVE-2018-19459 EXPLOITDB HIGH text WORKING POC
Adult Filter 1.0 - Buffer Overflow
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
CVSS 7.8
CVE-2019-11448 EXPLOITDB CRITICAL ruby WORKING POC
Zoho ManageEngine Applications Manager <14.0 - Privilege Escalation
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.
CVSS 9.8
EIP-2026-113729 EXPLOITDB text WORKING POC
WordPress Plugin Events Calendar - SQL Injection
EIP-2026-113596 EXPLOITDB text WORKING POC
WordPress Plugin Booking Calendar 3.0.0 - SQL Injection / Cross-Site Scripting
EIP-2026-113387 EXPLOITDB text WORKING POC
Wecodex Hotel CMS 1.0 - 'Admin Login' SQL Injection
EIP-2026-113388 EXPLOITDB text WORKING POC
Wecodex Restaurant CMS 1.0 - 'Login' SQL Injection
EIP-2026-113389 EXPLOITDB text WORKING POC
Wecodex Store Paypal 1.0 - SQL Injection
EIP-2026-113334 EXPLOITDB text WORKING POC
WebOfisi E-Ticaret V4 - 'urun' SQL Injection
CVE-2019-5009 EXPLOITDB HIGH python WORKING POC
Vtiger CRM 7.1.0 - Code Injection
Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. It is related to actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.
CVSS 7.2
EIP-2026-112668 EXPLOITDB text WORKING POC
TI Online Examination System v2 - Arbitrary File Download
EIP-2026-112235 EXPLOITDB text WORKING POC
Smart SMS & Email Manager 3.3 - 'contact_type_id' SQL Injection
CVE-2018-20166 EXPLOITDB HIGH ruby WORKING POC
Rukovoditel 2.3.1 - Code Injection
A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed case, such as the .pHp extension.
CVSS 8.8
EIP-2026-111899 EXPLOITDB text WORKING POC
SAT CFDI 3.3 - SQL Injection
EIP-2026-112020 EXPLOITDB text WORKING POC
Shipping System CMS 1.0 - SQL Injection
EIP-2026-111932 EXPLOITDB text WORKING POC
School Management System CMS 1.0 - 'username' SQL Injection
CVE-2018-18924 EXPLOITDB HIGH text WORKING POC
ProjeQtOr 7.2.5 - RCE
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message.
CVSS 8.8