Text Exploits
31,386 exploits tracked across all sources.
webERP 4.15.1 - Unauthenticated Database Backup File Access
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
by Besim
CVSS 9.8
Fishing Reservation System 7.5 - SQL Injection
Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject malicious SQL commands. Attackers can exploit vulnerable parameters like uid, pid, type, m, y, and code to compromise the database management system and web application without user interaction.
by Vulnerability-Lab
CVSS 7.1
BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection
by Daniel Martinez Adan
Oracle Database 11g Release 2 - 'OracleDBConsoleorcl' Unquoted Service Path
by Nguyen Khang
Online Scheduling System 1.0 - 'username' SQL Injection
by Saurav Shukla
SaltStack Salt < 2019.2.4 - Authenticated Path Traversal via ClearFuncs Methods
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
by Jasper Lievisse Adriaanse
CVSS 6.5
NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration
by Cold z3ro
PHP AddressBook 9.0.0.1 - SQL Injection
PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint.
by David Velazquez
CVSS 8.2
Outline Service 1.3.3 - Privilege Escalation
Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in C:\Program Files (x86)\Outline to inject malicious code that would execute with LocalSystem permissions during service startup.
by Minh Tuan
CVSS 7.8
osTicket < 1.14.2 - Stored Cross-Site Scripting via SLA Name
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
by Mehmet Kelepçe
CVSS 5.4
php-fusion 9.03.50 - Cross-Site Scripting via FAQ or Shoutbox Admin Panel go Parameter
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php
by SunCSR
CVSS 5.4
Online Scheduling System 1.0 - Persistent Cross-Site Scripting
by boku
Apache OFBiz 17.12.01 - Cross-Site Request Forgery
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
by Faiz Ahmed Zaidi
CVSS 8.8
Super Backup 2.0.5 for iOS - Directory Traversal
by Vulnerability-Lab
School ERP Pro 1.0 - Info Disclosure
School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information.
by Besim
CVSS 7.5
Easy Transfer Wifi Transfer v1.7 - XSS
Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts by manipulating the oldPath, newPath, and path parameters in Create Folder and Move/Edit functions. Attackers can exploit improper input validation via POST requests to execute arbitrary JavaScript in the context of the mobile web application.
by Vulnerability-Lab
Easy Transfer 1.7 iOS - Path Traversal
Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download sensitive system files and inject malicious scripts into application parameters.
by Vulnerability-Lab
CVSS 6.2
Andrea ST Filters Service <1.0.64.7 - Code Injection
Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquoted path to inject malicious code that will execute with elevated LocalSystem privileges during service startup.
by Roberto Piña
CVSS 7.8
By Source