Exploitdb Exploits
31,394 exploits tracked across all sources.
Raidsonic IB-NAS5220 and IB-NAS4220 - Unauthenticated OS Command Injection via timeHandler.cgi timeZone Parameter
An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.
by m-1-k-3
SonicWALL OEM Scrutinizer 9.5.2 - Multiple Vulnerabilities
by Vulnerability-Lab
NextGEN Gallery Plugin for WordPress 1.9.10-1.9.11 - Path Disclosure
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
by Henrique Montenegro
CVSS 7.5
Ultra Light Forum - Persistent Cross-Site Scripting
by cr4wl3r
Transferable Remote 1.1 iPad iPhone - Multiple Vulnerabilities
by Vulnerability-Lab
OpenPLI 3.0 Beta (OpenPLi-beta-dm7000-20130127-272) - Multiple Vulnerabilities
by m-1-k-3
Sonar - Multiple Cross-Site Scripting Vulnerabilities
by DevilTeam
Linksys router <1.0.00-1.0.05 - Path Traversal
A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.
by m-1-k-3
D-Link DIR-615H1 <8.04 - Command Injection
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.
by m-1-k-3
CVSS 7.2
Linksys router <v2.0.03 - Command Injection
An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.
by m-1-k-3
Windows Vista/7/8, Server 2008/2012, RT - Privilege Escalation via Win32k Window Broadcast
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle window broadcast messages, which allows local users to gain privileges via a crafted application, aka "Win32k Improper Message Handling Vulnerability."
by 0vercl0k
IRIS Citations Management Tool - (Authenticated) Remote Command Execution
by aeon
IP.Gallery 4.2.x/5.0.x - Persistent Cross-Site Scripting
by Mohamed Ramadan
TP-Link - Admin Panel Multiple Cross-Site Request Forgery Vulnerabilities
by CYBSEC Labs
Cisco Linksys E4200 1.0.05 - Code Injection
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submit_type parameter.
by m-1-k-3
CVSS 8.1
Cisco Linksys E4200 1.0.05 - Code Injection
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submit_type parameter.
by m-1-k-3
CVSS 8.1
Air Disk Wireless 1.9 iPad iPhone - Multiple Vulnerabilities
by Vulnerability-Lab
WordPress Theme Pinboard - 'tab' Cross-Site Scripting
by Henrique Montenegro
TP-Link TL-WR2543ND Router - Admin Panel Multiple Cross-Site Request Forgery Vulnerabilities
by Juan Manuel Garcia
By Source