Text Exploits
31,341 exploits tracked across all sources.
FoF Pretty Mail 1.1.2 - Code Injection
FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.
by Chokri Hammedi
FoF Pretty Mail 1.1.2 - Local File Inclusion
FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.
by Chokri Hammedi
Lepton CMS <7.0.0 - RCE
An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place.
by tmrswrr
CVSS 7.8
Lepton-cms Leptoncms - Unrestricted File Upload
An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area.
by tmrswrr
CVSS 7.2
Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
by Saud Alenazi
Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G
by hyp3rlinx
ASUS Control Center Express 01.06.15 - Unquoted Service Path
by Alaa Kachouh
Membership For WooCommerce <2.1.7 - Unauthenticated RCE
The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.
by Milad karimi
CVSS 9.8
Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal
by Ven3xy
Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
by Sandeep Vishwakarma
Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
by Sandeep Vishwakarma
Gibbon <26.0.00 - SSRF/RCE
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
by Ali Maharramli_Fikrat Guliev_Islam Rzayev
CVSS 9.8
E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)
by Sandeep Vishwakarma
Axigen WebMail <10.3.3.61 - XSS
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.
by Vincent McRae_ Mesut Cetin
CVSS 9.6
Casbin Casdoor < 1.331.0 - CSRF
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
by Van Lam Nguyen
CVSS 6.5
Purei CMS 1.0 - SQL Injection
Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.
by Number 7
liveSite <2019.1 - RCE
liveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the component /livesite/edit_designer_region.php or /livesite/add_email_campaign.php.
by tmrswrr
CVSS 9.8
Phpgurukul Tourism Management System - Unrestricted File Upload
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image.
by SoSPiro
CVSS 8.1
SPA-CART CMS 1.9.0.3 - XSS
SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.
by Eren Sen
CVSS 7.5
Lime Survey CE <v.5.3.32+220817 - XSS
Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function.
by Subhankar Singh
CVSS 6.1
By Source