Text Exploits
31,386 exploits tracked across all sources.
Inim Smartliving Firmware < 6.0 - Use of Hard-coded Credentials
Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the system.
by LiquidWorm
CVSS 9.8
7070 Hazr Profesyonel Web Sitesi 1.0 - Authentication Bypass via SQL Injection
PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass authentication by using '=' 'or' as both username and password to gain unauthorized access to the administrative interface.
by Ahmet Ümit BAYRAM
CVSS 7.5
Snipe-IT 4.7.5 - XSS
Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags to execute arbitrary JavaScript when the accessory is viewed by other users.
by Metin Yunus Kandemir
CVSS 6.4
Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting
by omurugur
NETGATE Data Backup 3.0.620 - Code Injection
NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files in specific directory locations.
by ZwX
CVSS 7.8
Amiti Antivirus <25.0.640 - Code Injection
Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.
by ZwX
CVSS 7.8
OwnCloud 8.1.8 - Username Enumeration via Share Endpoint Wildcard Search
OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Attackers can send crafted GET requests to /index.php/core/ajax/share.php with a wildcard search parameter to retrieve comprehensive user information.
by Daniel Moreno
CVSS 9.8
Microsoft Visual Basic 2010 Express - XML External Entity Injection
by ZwX
Online Clinic Management System 2.2 - HTML Injection
by Cemal Cihad ÇİFTÇİ
Cisco Wireless LAN Controller Software 8.4-8.9 - Denial of Service via Crafted URL
A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially crafted URLs. An attacker could exploit this vulnerability by authenticating with low privileges to an affected controller and submitting the crafted URL to the web interface of the affected device. Conversely, an unauthenticated attacker could exploit this vulnerability by persuading a user of the web interface to click the crafted URL. A successful exploit could allow the attacker to cause an unexpected restart of the device, resulting in a DoS condition.
by SecuNinja
CVSS 6.5
Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass
by hyp3rlinx
Online Invoicing System 2.6 - 'description' Persistent Cross-Site Scripting
by Cemal Cihad ÇİFTÇİ
Intelbras WRN 150 1.0.18 - Cross-Site Request Forgery via Password Change
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.
by Prof. Joas Antonio
CVSS 6.5
DokuWiki 2018-04-22b - Info Disclosure
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzing the server's error response messages.
by Talha ŞEN
CVSS 5.3
SmartHouse Webapp 6.5.33 - CSRF/XSS
SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious scripts into various application parameters.
by LiquidWorm
CVSS 5.3
Visual Studio 2008 - XML External Entity Injection
by hyp3rlinx
Microsoft Excel 2016 1901 - XML External Entity Injection
by hyp3rlinx
Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions
by hyp3rlinx
TexasSoft CyberPlanet 6.4.131 - Code Injection
TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe' to inject malicious executables and gain elevated system privileges.
by Cristian Ayala G
CVSS 7.8
Online Inventory Manager 3.2 - Stored Cross-Site Scripting in Group Description Field
Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie theft and client-side script execution.
by Cemal Cihad ÇİFTÇİ
CVSS 6.4
Easy-Hide-IP 5.0.0.3 - Code Injection
Easy-Hide-IP 5.0.0.3 contains an unquoted service path vulnerability in the EasyRedirect service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe' to inject malicious executables and escalate privileges.
by Rene Cortes S
CVSS 7.8
Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path
by Luis Martínez
Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation
by Abdelhamid Naceri
ProShow Producer 9.0.3797 - Code Injection
ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.
by ZwX
CVSS 7.8
By Source