Exploitdb Exploits
31,337 exploits tracked across all sources.
Apple Mac OS X < 10.10.4 - Numeric Error
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.
by Pedro Ribeiro
Bonita BPM Portal <6.5.3 - Open Redirect
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.
by High-Tech Bridge SA
CVSS 6.1
SysAid Help Desk <15.2 - Auth Bypass
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
by Pedro Ribeiro
Alcatel-lucent Omniswitch Firmware < 6.4.5.r02 - CSRF
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
by RedTeam Pentesting
Milw0rm Clone Script - SQL Injection
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
by Pancaker
WordPress Plugin Wp-ImageZoom 1.1.0 - Multiple Vulnerabilities
by T3N38R15
WordPress Plugin WP Mobile Edition - Local File Inclusion
by Ali Khalil
Pasworld - 'detail.php' Blind SQL Injection
by Sebastian khan
D-Link DSL-2730B AU_2.01 - Authentication Bypass DNS Change
by Todor Donev
WiFi HD 8.1 - Directory Traversal / Denial of Service
by Wh1t3Rh1n0 (Michael Allen)
Broadlight Residential Gateway DI3124 - Remote DNS Change
by Todor Donev
WordPress Plugin Really Simple Guest Post 1.0.6 - Local File Inclusion
by Kuroi'SH
Zanematthew ZM Ajax Login & Register < 1.0.9 - Path Traversal
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
by Panagiotis Vagenas
Zanematthew ZM Ajax Login & Register < 1.0.9 - XSS
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
by Panagiotis Vagenas
WebDrive 12.2 (B4172) - Buffer Overflow (PoC)
by Vulnerability-Lab
VFront 0.99.2 - Cross-Site Request Forgery / Persistent Cross-Site Scripting
by hyp3rlinx
WordPress Plugin LeagueManager 3.9.11 - SQL Injection
by javabudd
Linux Kernel (PonyOS 3.0) - ELF Loader Local Privilege Escalation
by Hacker Fantastic
Aruba Networks ClearPass Policy Manager <6.4.5 - XSS
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
by Cristiano Maruti
By Source