Text Exploits
31,346 exploits tracked across all sources.
Learndash < 3.1.2 - XSS
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
by Jinson Varghese Behanan
CVSS 5.4
Forcepoint Web Security < 8.5.4 - XSS
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
by Prasenjit Kanti Paul
CVSS 6.1
iOS <13.3.1 - Memory Corruption
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
by Google Security Research
CVSS 7.8
QuickDate 1.3.2 - SQL Injection
QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find_matches endpoint. Attackers can inject UNION-based SQL statements to extract database information including user credentials, database name, and system version.
by Ihsan Sencan
CVSS 8.2
PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection
by Amel BOUZIANE-LEBLOND
EyesOfNetwork <5.3 - SQL Injection
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
by Clément Billac
CVSS 9.8
ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path
by ZwX
Online Job Portal 1.0 - Cross Site Request Forgery (Add User)
by Ihsan Sencan
AVideo Platform 8.1 - Info Disclosure
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
by Ihsan Sencan
CVSS 7.5
AVideo Platform 8.1 - CSRF
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
by Ihsan Sencan
CVSS 5.3
AVideo Platform 8.1 - CSRF
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
by Ihsan Sencan
CVSS 5.3
Sudo <1.8.26 - Buffer Overflow
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
by Joe Vennix
CVSS 7.8
School Management Software - CSRF
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
by J3rryBl4nks
CVSS 6.5
IceWarp Webmail Server <11.4.4.1 - XSS
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
by Lutfu Mert Ceylan
CVSS 6.1
Lotus Core CMS 1.0.1 - Path Traversal
Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.
by Daniel Monzón
CVSS 8.8
FlexNet Publisher 11.12.1 - CSRF
FlexNet Publisher 11.12.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious HTML form to trick authenticated users into submitting a request that creates a new local admin account with a predefined password.
by Ismail Tasdelen
CVSS 4.0
Microsoft Windows Media Center WMV / WMA 6.3.9600.16384 - Code Execution
by Eduardo Braun Prado
By Source