Exploitdb Exploits
50,186 exploits tracked across all sources.
Dlink Dwl-2600ap Firmware < 4.2.0.15 - OS Command Injection
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.
by Metasploit
CVSS 7.8
Odin Secure FTP Expert 7.6.3 - Buffer Overflow
Odin Secure FTP Expert 7.6.3 contains a local denial of service vulnerability that allows attackers to crash the application by manipulating site information fields. Attackers can generate a buffer overflow by pasting 108 bytes of repeated characters into connection fields, causing the application to crash.
by Ivan Marmolejo
CVSS 8.4
10-Strike Network Inventory Explorer 9.03 - Buffer Overflow
10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious text file with carefully constructed payload to trigger a stack-based buffer overflow and bypass data execution prevention through a ROP chain.
by Hodorsec
CVSS 9.8
Microsoft Windows 10 1903 - Memory Corruption
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
by Daniel García Gutiérrez
CVSS 10.0
DrayTek - RCE
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
by 0xsha
CVSS 9.8
Everest/AIDA64 5.50.2100 - DoS
Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating file open functionality. Attackers can generate a 450-byte buffer of repeated characters and paste it into the file open dialog to trigger an application crash.
by Ivan Marmolejo
CVSS 5.5
Easy RM to MP3 Converter 2.7.3.700 - 'Input' Local Buffer Overflow (SEH)
by Felipe Winsnes
rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution
by vikingfr
ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)
by Mustafa Emre Gül
Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal
by hongphukt
Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution
by Engin Demirbilek
Tp-link Archer C50 - Resource Leak
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field.
by thewhiteh4t
CVSS 7.5
10-Strike Network Inventory Explorer 8.54 - Buffer Overflow
10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting SEH records. Attackers can craft a malicious payload targeting the 'Computer' parameter during the 'Add' function to trigger remote code execution.
by Felipe Winsnes
CVSS 8.4
Avast SecureLine 5.5.522.0 - Code Injection
Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem account permissions during service startup.
by Roberto Piña
CVSS 7.8
10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path
by Felipe Winsnes
LeptonCMS 4.5.0 - XSS
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements.
by SunCSR
CVSS 6.1
Veyon Service <4.4.2 - Privilege Escalation
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.
by Víctor García
CVSS 8.0
Wpforms Contact Form < 1.5.9 - XSS
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
by Jinson Varghese Behanan
CVSS 5.4
UliCMS <2020.2 - XSS
UliCMS before 2020.2 has PageController stored XSS.
by SunCSR
CVSS 6.1
Grandstream UCM6200 <1.0.19.20 - SQL Injection
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
by Jacob Baines
CVSS 9.8
ProficySCADA for iOS <5.0.25920 - DoS
ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input field. Attackers can overwrite the password field with 257 bytes of repeated characters to trigger an application crash and prevent successful authentication.
by Ivan Marmolejo
CVSS 7.5
FIBARO System Home Center 5.021 - RCE
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
by LiquidWorm
CVSS 7.5
By Source