Text Exploits
31,329 exploits tracked across all sources.
KBVault Mysql Free Knowledge Base <0.16a - RCE
KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the file upload and deletion functionality. Through this functionality, a user can upload an ASPX script to Uploads/Documents/ to run any arbitrary code.
by Fatih Emiral
CVSS 9.8
LG MRA58K - Out-of-Bounds Heap Read in CAVIFileParser::Destroy Resulting in Invalid Free
by Google Security Research
LG MRA58K - Missing Bounds-Checking in AVI Stream Parsing
by Google Security Research
LG MRA58K - 'ASFParser::ParseHeaderExtensionObjects' Missing Bounds-Checking
by Google Security Research
Gstreamer < 1.10.1 - NULL Pointer Dereference
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
by Hanno Boeck
CVSS 5.5
Easy File Sharing Web Server 7.2 - Authentication Bypass
by Touhid M.Shaikh
WP Jobs <1.5 - SQL Injection
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.
by Dimitrios Tsagkarakis
CVSS 8.8
libquicktime 1.2.4 - DoS
The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
libquicktime 1.2.4 - DoS
The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
libquicktime 1.2.4 - DoS
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
libquicktime 1.2.4 - DoS
The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
libquicktime 1.2.4 - DoS
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
libquicktime 1.2.4 - DoS
The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
Gnome Libcroco - Memory Corruption
The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.
by qflb.wu
CVSS 6.5
nuevoMailer <6.0 - SQL Injection
SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter.
by Oleg Boytsev
CVSS 9.8
libquicktime 1.2.4 - DoS
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.
by qflb.wu
CVSS 6.5
Gnome Libcroco - Infinite Loop
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
by qflb.wu
CVSS 6.5
Net Monitor for Employees Pro <5.3.4 - Auth Bypass
Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design goal. The local attacker must have privileges to write to program.exe in a protected directory, such as the %SYSTEMDRIVE% directory, and thus the issue is not interpreted as a direct privilege escalation. However, the local attacker might have the goal of executing program.exe even though program.exe is a blocked application.
by Saeid Atabaki
CVSS 7.3
Craft CMS <2.6.2982 - XSS
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
by Ahsan Tahir
CVSS 5.4
By Source