Exploitdb Exploits
50,135 exploits tracked across all sources.
Online Movie Streaming 1.0 - Admin Authentication Bypass
by Richard Jones
Nagios XI < 5.8.0 - OS Command Injection
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
by Haboob Team
CVSS 7.2
Ignition <2.5.2 - RCE
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
by SunCSR Team
CVSS 9.8
Online Hotel Reservation System 1.0 - Admin Authentication Bypass
by Richard Jones
Gila CMS <2.0.0 - RCE
Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through manipulated HTTP headers. Attackers can inject PHP code in the User-Agent header with shell_exec() to run system commands by sending crafted requests to the admin endpoint.
by Enesdex
CVSS 9.8
Cemetry Mapping and Information System 1.0 - Multiple SQL Injections
by Mesut Cetin
Newtarget Custom Global Variables - XSS
Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars[0][name] field.
by Swapnil Subhash Bodekar
CVSS 5.4
Prestashop - SQL Injection
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
by Jaimin Gondaliya
CVSS 9.8
PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval
by rootabeta
OpenCart 3.0.36 - ATO via Cross Site Request Forgery
by Mahendra Purbia
Cemetry Mapping and Information System 1.0 - Multiple Stored Cross-Site Scripting
by Mesut Cetin
EyesOfNetwork 5.3 - RCE & PrivEsc
by Audencia Business SCHOOL Red Team
Anchor CMS 0.12.7 - 'markdown' Stored Cross-Site Scripting
by Ramazan Mert GÖKTEN
Wordpress Plugin wpDiscuz 7.0.4 - Unauthenticated Arbitrary File Upload (Metasploit)
by SunCSR Team
WordPress Plugin Autoptimize 2.7.6 - Authenticated Arbitrary File Upload (Metasploit)
by SunCSR Team
Online Doctor Appointment System Php Full Source Code - XSS
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.
by Mohamed habib Smidi
CVSS 5.4
Life Insurance Management System 1.0 - Multiple Stored XSS
by Arnav Tripathy
Cockpit Version 234 - Server-Side Request Forgery (Unauthenticated)
by Metin Yunus Kandemir
Apache Flink JobManager Traversal
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
by SunCSR Team
CVSS 7.5
Medicalexpo Ecs Imaging < 6.21.5 - SQL Injection
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (such as /req_password_user.php?email=). This allows an attacker to steal data in the database and obtain access to the application. (The database component runs as root.) NOTE: This vulnerability only affects products that are no longer supported by the maintainer
by shoxxdj
CVSS 9.8
Cockpit <0.6.1 - RCE
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.
by Rafael Resende
CVSS 9.8
Employee Record System 1.0 - Unrestricted File Upload to Remote Code Execution
by Saeed Bala Ahmed
By Source