Text Exploits
31,386 exploits tracked across all sources.
WordPress Plugin contact-form-7 5.1.6 - Remote File Upload
by Mehran Feizi
HP System Event Utility <1.4.33 - RCE
A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local attacker to execute arbitrary code via an HP System Event Utility system service.
by hyp3rlinx
CVSS 7.8
Sync Breeze Enterprise 12.4.18 - Code Injection
Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.
by boku
CVSS 7.8
Disk Savvy Enterprise 12.3.18 - Code Injection
Disk Savvy Enterprise 12.3.18 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Savvy Enterprise\bin\disksvs.exe' to inject malicious executables and escalate privileges.
by boku
CVSS 7.8
Disk Sorter Enterprise <12.4.16 - Code Injection
Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.
by boku
CVSS 7.8
FreeSSHd <1.3.1 - Privilege Escalation
FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated privileges.
by boku
CVSS 7.8
Vanilla 2.6.3 - Stored Cross-Site Scripting via Branding Settings Page
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
by Sayak Naskar
CVSS 5.4
CHIYU BF-430 Firmware < 1.16.00 - Stored Cross-Site Scripting via TF_submask Field
Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
by Luca.Chiou
CVSS 6.1
Dota 2 < 7.23f - Remote Code Execution via Crafted Map in GetValue Call
schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a GetValue call.
by Bogdan Kurinnoy
CVSS 7.8
LearnDash 3.0-3.1.2 - Cross-Site Scripting via ld-profile Search Field
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
by Jinson Varghese Behanan
CVSS 5.4
Forcepoint Web Security 8.0.0-8.5.3 - Cross-Site Scripting via Host Header Injection
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
by Prasenjit Kanti Paul
CVSS 6.1
iPadOS < 13.3.1 - Out-of-bounds Write
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
by Google Security Research
CVSS 7.8
QuickDate 1.3.2 - SQL Injection via _located Parameter
QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find_matches endpoint. Attackers can inject UNION-based SQL statements to extract database information including user credentials, database name, and system version.
by Ihsan Sencan
CVSS 8.2
PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection
by Amel BOUZIANE-LEBLOND
EyesOfNetwork 5.3 - Unauthenticated SQL Injection via Username Field in getApiKey
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
by Clément Billac
CVSS 9.8
ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path
by ZwX
Online Job Portal 1.0 - Cross Site Request Forgery (Add User)
by Ihsan Sencan
By Source