Exploitdb Exploits
31,341 exploits tracked across all sources.
Visual-tools Dvr Vx16 Firmware - OS Command Injection
In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.
by Andrea D\'Ubaldo
CVSS 9.8
WordPress Plugin WP Learn Manager 1.1.2 - Stored Cross-Site Scripting (XSS)
by Mohammed Adam
Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
by Subhadip Nag
Church Management System 1.0 - Arbitrary File Upload (Authenticated)
by Murat DEMİRCİ
Church Management System 1.0 - 'password' SQL Injection (Authentication Bypass)
by Murat DEMİRCİ
Church Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
by Murat DEMİRCİ
b2evolution 7.2.2 - CSRF
b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers can craft a malicious HTML form to submit unauthorized changes to user profiles by tricking victims into loading a specially crafted webpage.
by Alperen Ergel
CVSS 5.3
Nica Winwaste.net - Incorrect Permission Assignment
WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.
by Andrea Intilangelo
CVSS 7.8
Garbage Collection Management System 1.0 - SQL Injection (Unauthenticated)
by ircashem
MIT Scratch-svg-renderer - XSS
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
by Stig Magnus Baugstø
CVSS 9.6
AKCP sensorProbe <SP480-20210624 - XSS
Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.
by Tyler Butler
CVSS 5.4
Vianeos OctoPUS 5 - SQL Injection
Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to extract information.
by Audencia Business SCHOOL Red Team
CVSS 8.2
Online Voting System 1.0 - Remote Code Execution (Authenticated)
by Salman Asad
Online Voting System 1.0 - Authentication Bypass (SQLi)
by Salman Asad
Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
by Murat DEMİRCİ
Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)
by Barış Yıldızoğlu
WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)
by Toby Jackson
Atlassian Data Center < 8.5.14 - XSS
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
by Captain_hook
CVSS 6.1
SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path
by Brian Rodriguez
Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
by Barış Yıldızoğlu
Codecabin WP GO Maps < 8.1.12 - XSS
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
by Mohammed Adam
CVSS 5.4
WordPress Plugin Poll_ Survey_ Questionnaire and Voting system 1.5.2 - 'date_answers' Blind SQL Injection
by Toby Jackson
Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass)
by Rinku Kumar
Online Library Management System 1.0 - 'Search' SQL Injection
by Berk Can Geyikci
Phone Shop Sales Management System - IDOR
Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.
by Pratik Khalane
CVSS 4.3
By Source