Text Exploits
31,343 exploits tracked across all sources.
PDW File Browser 1.3 - XSS
PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through file rename and path parameters. Attackers can craft malicious URLs or rename files with XSS payloads to execute arbitrary JavaScript in victims' browsers when they access the file browser.
by David Bimmel
CVSS 5.4
ReQuest Serious Play Media Player 3.0 - Info Disclosure
ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is not properly verified before being used to read web log files. Attackers can exploit this to disclose contents of files from local resources.
by LiquidWorm
ReQuest Serious Play F3 Media Server 7.0.3 - RCE
ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.
by LiquidWorm
ReQuest Serious Play F3 Media Server <7.0.3.4968 - Info Disclosure
ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers to disclose the webserver's Python debug log file containing system information, credentials, paths, processes and command arguments running on the device. Attackers can access sensitive information by visiting the message_log page.
by LiquidWorm
Genexis Platinum-4410 Firmware - XSS
Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.
by Amal Mohandas
CVSS 5.4
Online Health Care System 1.0 - Multiple Cross Site Scripting (Stored)
by Akıner Kısa
Online Library Management System - Unrestricted File Upload
An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root).
by Jyotsna Adhana
CVSS 9.8
Admerc Gym Management System - XSS
Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'.
by Jyotsna Adhana
CVSS 6.1
Gym Management System - SQL Injection
An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable.
by Jyotsna Adhana
CVSS 9.8
Car Rental Management System - Unrestricted File Upload
An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).
by Jyotsna Adhana
CVSS 9.8
User Registration & Login and User Management System 2.1 - SQL Injection
by Ihsan Sencan
Stock Management System 1.0 - 'brandId and categoriesId' SQL Injection
by Ihsan Sencan
School Faculty Scheduling System 1.0 - 'username' SQL Injection
by Jyotsna Adhana
School Faculty Scheduling System 1.0 - 'id' SQL Injection
by Jyotsna Adhana
Lot Reservation Management System 1.0 - Cross-Site Scripting (Stored)
by Ankita Pal
Lot Reservation Management System 1.0 - Authentication Bypass
by Ankita Pal
Hrsale - Path Traversal
Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.
by Sosecure
CVSS 5.3
Stock Management System 1.0 - 'Product Name' Persistent Cross-Site Scripting
by Adeeb Shah
Stock Management System 1.0 - 'Categories Name' Persistent Cross-Site Scripting
by Adeeb Shah
Stock Management System 1.0 - 'Brand Name' Persistent Cross-Site Scripting
by Adeeb Shah
School Faculty Scheduling System 1.0 - Stored Cross Site Scripting POC
by Jyotsna Adhana
School Faculty Scheduling System 1.0 - Authentication Bypass POC
by Jyotsna Adhana
By Source