Text Exploits
31,341 exploits tracked across all sources.
Aegon Life v1.0 - SQL Injection
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
by Aslam Anwar Mahimkar
CVSS 8.8
WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated)
by Onur Göğebakan
CMSimple 5.15 - RCE
CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.
by Ahmet Ümit BAYRAM
CVSS 8.8
Progress Sitefinity < 15.0.0 - XSS
Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
by Aldi Saputra Wahyudi
CVSS 5.4
Akaunting 3.1.8 - Code Injection
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.
by tmrswrr
ElkArte Forum 1.1.9 - RCE
ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme installation process. Attackers can upload a ZIP archive with a PHP file containing system commands, which can then be executed by accessing the uploaded file in the theme directory.
by tmrswrr
ITSS iMLog <1.307 - XSS
A cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.
by Gabriel Felipe
CVSS 5.4
BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection
by Ivan Spiridonov
8theme XStore <9.3.5 - SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.
by Abdualhadi khalifa
CVSS 9.3
Apache OFBiz <18.12.13 - Path Traversal
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.
Users are recommended to upgrade to version 18.12.13, which fixes the issue.
by Abdualhadi khalifa
CVSS 9.8
Chyrp - XSS
Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.
by Ahmet Ümit BAYRAM
CVSS 5.4
Pyrocms - XSS
PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Attackers can insert a payload in the 'Redirect From' field to execute arbitrary JavaScript when administrators view the redirects page.
by tmrswrr
CVSS 5.4
CE Phoenix v3.0.1 - XSS
CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.
by tmrswrr
Prison Management System - SQL Injection Authentication Bypass
by Sanjay Singh
Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
by Ahmet Ümit BAYRAM
iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)
by modrnProph3t
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Device Config Disclosure
by LiquidWorm
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 - Device Config Disclosure
by LiquidWorm
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 - Authentication Bypass
by LiquidWorm
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Device Config Disclosure
by LiquidWorm
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Authentication Bypass
by LiquidWorm
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Authentication Bypass
by LiquidWorm
Flowise <1.6.2 - RCE
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
by Maerifat Majeed
CVSS 7.6
By Source