Exploitdb Exploits
50,135 exploits tracked across all sources.
Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)
by LiquidWorm
Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure
by LiquidWorm
MiniTool Partition Wizard v12.0 - Privilege Escalation
MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
by Saud Alenazi
CVSS 7.8
Razer Sila Gaming Router <2.0.441_api-2.0.418 - Info Disclosure
A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.
by Kevin Randall
CVSS 7.5
Razer Sila Gaming Router <v2.0.441_api-2.0.418 - Command Injection
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.
by Kevin Randall
CVSS 9.8
Franklinfueling Colibri Firmware - Path Traversal
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.
by Momen Eldawakhly
CVSS 7.5
Telesquare TLR-2855KS6 - Info Disclosure
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.
by Momen Eldawakhly
CVSS 9.1
Telesquare TLR-2855KS6 - Info Disclosure
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
by Momen Eldawakhly
CVSS 7.5
SUNNY TRIPOWER 5.0 - Info Disclosure
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
by Momen Eldawakhly
CVSS 8.1
Sherpa Connector Service <2020.2.20328.2050 - Privilege Escalation
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.
by Manthan Chhabra
CVSS 7.8
Tribalsystems Zenario < 9.0.55143 - Unrestricted File Upload
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
by minhnq22
CVSS 7.2
qdPM 9.2 - CSRF
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
by Chetanya Sharma
CVSS 8.8
Minewebcms < 1.15.2 - XSS
Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
by Chetanya Sharma
CVSS 4.8
ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
by Devansh Bordia
OpServices OpMon <9.11 - XSS
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.
by Marlon Petry
CVSS 6.1
Rejected
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
by Marlon Petry
KRAMER VIAware - RCE
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.
by sharkmoos
CVSS 9.8
WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion
by Hassan Khan Yusufzai
Izsoft Easy Cookies Policy < 1.6.2 - Incorrect Authorization
The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue.
by 0xB9
CVSS 6.5
WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)
by Hassan Khan Yusufzai
WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion
by Hassan Khan Yusufzai
WordPress Plugin admin-word-count-column 2.2 - Local File Read
by Hassan Khan Yusufzai
Impresscms < 1.4.4 - SQL Injection
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
by Egidio Romano
CVSS 9.8
Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)
by Milad karimi
By Source