Exploitdb Exploits
31,364 exploits tracked across all sources.
Caldera Forms <1.6.0-rc.1 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.
by Federico Scalco
CVSS 4.8
Rvsitebuilder CMS - Database Backup Download
by Hesam Bazvand
MySQL Squid Access Report 2.1.4 - SQL Injection / Cross-Site Scripting
by Keerati T.
MySQL Squid Access Report 2.1.4 - SQL Injection / Cross-Site Scripting
by Keerati T.
Match Clone Script - XSS
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).
by ManhNho
CVSS 6.1
Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery
by Sureshbabu Narvaneni
Kodi <17.6 - XSS
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
by Manuel García Cárdenas
CVSS 6.1
Brave Browser < 0.13.0 - Improper Input Validation
Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.
by Sahil Tikoo
CVSS 7.5
Brave Browser < 0.13.0 - Denial of Service
Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code, because window dialogs are mishandled.
by Sahil Tikoo
CVSS 6.5
jDownloads <3.2.59 - XSS
The jDownloads extension before 3.2.59 for Joomla! has XSS.
by Sureshbabu Narvaneni
CVSS 6.1
D-Link DIR-615 T1 - XSS
D-Link DIR-615 T1 devices allow XSS via the Add User feature.
by Sayan Chatterjee
CVSS 4.8
Microsoft Windows 10 - TOCTOU Race Condition
A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
by Google Security Research
CVSS 3.3
Microsoft Edge - 'OpenProcess()' ACG Bypass
by Google Security Research
Western Bridge Cobub Razor 0.8.0 - SQL Injection
A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php.
by Kyhvedn
CVSS 9.8
Sophos Cyberoam Cr25ing Utm Firmware - Access Control
Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated by a request for Licenseinformation.jsp. This is fixed in 10.6.5.
by Frogy
CVSS 8.8
MikroTik Version 6.41.4 - DoS
A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a crafted FTP request on port 21 that begins with many '\0' characters, preventing the affected router from accepting new FTP connections. The router will reboot after 10 minutes, logging a "router was rebooted without proper shutdown" message.
by FarazPajohan
CVSS 7.5
Joomla! <2.0.4 - RCE
The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a Leads file.
by Sairam Jetty
CVSS 7.8
Iscripts Easycreate - XSS
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
by ManhNho
CVSS 5.4
Dvd-x-player Dvd X Player - Memory Corruption
DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.
by Prasenjit Kanti Paul
CVSS 7.8
Wuzhicms - CSRF
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add.
by taoge
CVSS 8.8
Iptanus Wordpress File Upload < 4.3.4 - XSS
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
by ManhNho
CVSS 6.1
Iptanus Wordpress File Upload < 4.3.3 - XSS
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
by ManhNho
CVSS 5.4
WordPress Activity Log <2.4.1 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
by Stefan Broeder
CVSS 6.1
Iscripts Easycreate - XSS
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
by ManhNho
CVSS 5.4
By Source