Exploitdb Exploits
50,135 exploits tracked across all sources.
GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF
GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not directly enable remote code execution.
by boku
CVSS 6.5
GetSimple CMS My SMTP Contact Plugin <1.1.2 - Code Injection
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
by boku
CVSS 7.2
Glftpd - Resource Allocation Without Limits
An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit.
by xynmaps
CVSS 7.5
Tileservergl < 3.0.0 - XSS
An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.
by Akash Chathoth
CVSS 6.1
htmly 2.8.0 - XSS
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
by nu11secur1ty
CVSS 5.4
Horde Groupware < 5.2.22 - XSS
An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.
by nu11secur1ty
CVSS 6.1
Digital Crime Report Management System 1.0 - SQL Injection
Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.
by GaluhID
CVSS 8.2
jQuery <3.5.0 - XSS
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
by Central InfoSec
CVSS 6.9
jQuery <3.5.0 - XSS
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
by Central InfoSec
CVSS 6.9
MariaDB <10.2.37, 10.3.28, 10.4.18, 10.5.9 - RCE
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
by Central InfoSec
CVSS 7.2
CITSmart <9.1.2.28 - Info Disclosure
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."
by skysbsb
CVSS 8.8
Citsmart < 9.1.2.23 - Injection
CITSmart before 9.1.2.23 allows LDAP Injection.
by skysbsb
CVSS 9.8
Genexis Platinum 4410 Firmware - OS Command Injection
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI.
by Jay Sharma
CVSS 9.8
Blitar Tourism 1.0 - Auth Bypass
Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter. Attackers can manipulate the login request by sending a crafted username with SQL injection techniques to gain unauthorized administrative access.
by sigeri94
CVSS 8.2
Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)
by GaluhID
ExpressVPN Router < - Info Disclosure
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.
by Jai Kumar Sharma
CVSS 7.5
Vsftpd - OS Command Injection
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
by HerculesRD
CVSS 9.8
PrestaShop <1.7.6.8 - Blind SQL Injection
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
by Vanshal Gaur
CVSS 9.8
Cmsimple - XSS
CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.
by Quadron Research Lab
CVSS 6.1
Composr 10.0.36 - Code Injection
Composr 10.0.36 allows upload and execution of PHP files.
by Orion Hridoy
CVSS 9.8
DMA Softlab Radius Manager 4.4.0 - CSRF
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
by Issac Briones
CVSS 8.8
Linux Kernel < 5.4.72 - Information Disclosure
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
by Google Security Research
CVSS 6.5
Dell Emc Openmanage Server Administrator < 9.4 - Path Traversal
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.
by Rhino Security Labs
CVSS 9.1
Composr 10.0.36 - XSS
Composr 10.0.36 allows XSS in an XML script.
by Orion Hridoy
CVSS 6.1
Atlassian Jira Service Desk < 4.10.0 - XSS
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
by Captain_hook
CVSS 4.8
By Source