Exploitdb Exploits
31,341 exploits tracked across all sources.
Yogeshojha Rengine - OS Command Injection
reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmap_cmd parameter with malicious base64-encoded payloads to achieve remote code execution during scan engine configuration.
by Caner Tercan
CVSS 8.8
dizqueTV 1.5.3 - RCE
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.
by Ahmed Said Saud Al-Busaidi
Os4ed Opensis - SQL Injection
OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
by Devrim Dıragumandan
CVSS 8.8
Elber Wayber Analog/Digital Audio STL 4.00 - Device Config Disclosure
by LiquidWorm
Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass
by LiquidWorm
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config
by LiquidWorm
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass
by LiquidWorm
Helpdeskz < 2.0.2 - XSS
A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.
by Md. Sadikul Islam
CVSS 4.8
Calibre-web 0.6.21 - Stored XSS
by Catalin Iovita_ Alexandru Postolache
Genexus Protection Server 9.7.2.10 - Code Injection
Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations.
by SamAlucard
SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path
by Milad karimi
Oracle Database 12c Release 1 - Unquoted Service Path
by Milad karimi
Bonjour Service 'mDNSResponder.exe' - Unquoted Service Path Privilege Escalation
by bios
Xhibiter NFT Marketplace 1.10.2 - SQL Injection
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.
by Sohel Yousef
Microweber - XSS
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
by tmrswrr
CVSS 5.4
Azon Dominator Affiliate Marketing Script - SQL Injection
by Buğra Enis Dönmez
Flatboard 3.2 - XSS
Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fields. Attackers can insert JavaScript payloads that execute when other users view the forum, potentially stealing session cookies and executing client-side scripts.
by tmrswrr
Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)
by Jerry Thomas
Carbon Forum 5.9.0 Persistent XSS via Forum Name Field
Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.
by Chokri Hammedi
CVSS 6.4
XMB Forum 1.9.12.06 - XSS
XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.
by Chokri Hammedi
Aegon Life v1.0 - XSS
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php.
by Aslam Anwar Mahimkar
CVSS 6.1
By Source