Gjoko 'LiquidWorm' Krstic

684 exploits Active since Nov 2005
CVE-2017-20113 EXPLOITDB LOW text WORKING POC
TrueConf Server < 5.0.2 - Stored Cross-Site Scripting
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS 3.5
CVE-2015-5529 EXPLOITDB text WORKING POC
Free Reprintables ArticleFR 3.0.6 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or (4) url parameter to dashboard/tools/pingservers/.
CVE-2015-2679 EXPLOITDB text WORKING POC
genixcms < 0.0.1 - SQL Injection via Page or Username Parameter
Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.
CVE-2015-2678 EXPLOITDB text WORKING POC
genixcms < 0.0.1 - Cross-Site Scripting via cat or page Parameter
Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.
CVE-2015-1423 EXPLOITDB text WORKING POC
Gecko CMS 2.2-2.3 - Authenticated SQL Injection via Admin Index Parameters
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
CVE-2015-1422 EXPLOITDB text WORKING POC
Gecko CMS 2.2-2.3 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
CVE-2014-8656 EXPLOITDB text WORKING POC
Compal Broadband Networks CH6640E/CG6640E Wireless Gateway 1.0 - In...
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin for the admin account and (2) compalbn for the root account, which makes it easier for remote attackers to obtain access to certain sensitive information via unspecified vectors.
CVE-2014-8655 EXPLOITDB text WORKING POC
Compal Broadband Networks CH6640E-CH6640-3.5.11.7-NOSH - Auth Bypass
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via an (a) admin or a (b) root value in the userData cookie in a request to (1) CmgwWirelessSecurity.xml, (2) DocsisConfigFile.xml, or (3) CmgwBasicSetup.xml in xml/ or (4) basicDDNS.html, (5) basicLanUsers.html, or (6) rootDesc.xml.
CVE-2014-8654 EXPLOITDB text WORKING POC
Compal Broadband Networks CH6640E/CG6640E Wireless Gateway 1.0 - CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that (1) have unspecified impact on DDNS configuration via a request to basicDDNS.html, (2) change the wifi password via the psKey parameter to setWirelessSecurity.html, (3) add a static MAC address via the MacAddress parameter in an add_static action to setBasicDHCP1.html, or (4) enable or disable UPnP via the UPnP parameter in an apply action to setAdvancedOptions.html.
CVE-2014-8653 EXPLOITDB text WORKING POC
Compal Broadband Networks (CBN) CH6640E/CG6640E Wireless Gateway 1....
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to inject arbitrary web script or HTML via the userData cookie.
CVE-2014-10034 EXPLOITDB text WORKING POC
couponphp < 1.1.0 - Authenticated SQL Injection via iDisplayLength or iDisplayStart Parameter
Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/.
CVE-2011-5039 EXPLOITDB text WORKING POC
Infoproject Biznis Heroj - SQL Injection via login.php or widget.dokumenti_lista.php
Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to login.php, (3) the filter parameter to widget.dokumenti_lista.php, and (4) the fin_nalog_id parameter to nalozi_naslov.php.
CVE-2012-3837 EXPLOITDB text WORKING POC
Baby Gekko < 1.2.0 - Cross-Site Scripting via Registration Parameters
Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email_address, (3) password, (4) password_verify, (5) firstname, (6) lastname, or (7) verification_code parameter to users/action/register. NOTE: some of these details are obtained from third party information.
CVE-2012-3836 EXPLOITDB text WORKING POC
Baby Gekko < 1.2.0 - Cross-Site Scripting via Multiple Input Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) groupname parameter in a savecategory in the users module; (2) virtual_filename, (3) branch, (4) contact_person, (5) street, (6) city, (7) province, (8) postal, (9) country, (10) tollfree, (11) phone, (12) fax, or (13) mobile parameter in a saveitem action in the contacts module; (14) title parameter in a savecategory action in the menus module; (15) firstname or (16) lastname in a saveitem action in the users module; (17) meta_key or (18) meta_description in a saveitem action in the blog module; or (19) the PATH_INFO to admin/index.php.
CVE-2009-20007 EXPLOITDB CRITICAL perl WORKING POC
Talkative IRC v0.4.4.16 - Buffer Overflow
Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attacker can exploit this flaw by sending an overly long message that overflows a fixed-length buffer, potentially leading to arbitrary code execution in the context of the vulnerable process. This vulnerability is exploitable remotely and does not require authentication.
EIP-2026-119415 EXPLOITDB text WORKING POC
Pelco VideoXpert 1.12.105 - Information Disclosure
EIP-2026-119423 EXPLOITDB python WORKING POC
Serviio PRO 1.8 DLNA Media Streaming Server - REST API Arbitrary Code Execution
EIP-2026-119345 EXPLOITDB text WRITEUP
actiTIME 2015.2 - Multiple Vulnerabilities
EIP-2026-119373 EXPLOITDB text WORKING POC
Gemalto Sentinel License Manager 18.0.1.55505 - Directory Traversal
CVE-2012-2172 EXPLOITDB text WRITEUP
IBM DS Storage Manager Host Software < 10.83 - Cross-Site Scripting via SoftwareRegistration.do updateRegn Parameter
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
EIP-2026-119429 EXPLOITDB text WORKING POC
Soitec SmartEnergy 1.4 - SCADA Login SQL Injection / Authentication Bypass
EIP-2026-119414 EXPLOITDB text WORKING POC
Pelco VideoXpert 1.12.105 - Directory Traversal
EIP-2026-119681 EXPLOITDB text WORKING POC
OpenMRS 2.3 (1.11.4) - Multiple Cross-Site Scripting Vulnerabilities
EIP-2026-119680 EXPLOITDB text WORKING POC
OpenMRS 2.3 (1.11.4) - Local File Disclosure
EIP-2026-119682 EXPLOITDB python WORKING POC
OpenMRS 2.3 (1.11.4) - XML External Entity Processing