Exploitdb Exploits
50,095 exploits tracked across all sources.
WolfCMS 0.8.3.1 - Cross-Site Request Forgery in Plugin Settings
Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugin/[pluginname]/settings by crafting a malicious request.
by Sureshbabu Narvaneni
CVSS 6.5
iScripts SonicBB 1.0 - Reflected Cross-Site Scripting via Search Query Parameter
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
by ManhNho
CVSS 6.1
Western Bridge Cobub Razor 0.7.2 - Info Disclosure
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/installation/createuserinfo requests, resulting in account creation.
by ppb
CVSS 7.5
Safari < 11.1 - Remote Code Execution via WebKit Memory Corruption
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
by Google Security Research
CVSS 8.8
CyberArk Password Vault < 9.7 - Exposure of Sensitive Information via Logon Message Replay
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.
by RedTeam Pentesting
CVSS 5.3
CyberArk Password Vault < 9.9.5 and 10.x < 10.1 - Remote Code Execution via REST API Authorization Header
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.
by RedTeam Pentesting
CVSS 9.8
DNNArticle 11 for DNN - Unauthenticated Sensitive Information Exposure via GetCSS.ashx URI
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
by Esmaeil Rahimian
CVSS 9.8
Sophos Endpoint Protection 10.7 - Info Disclosure
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.
by hyp3rlinx
CVSS 7.8
Sophos Endpoint Protection 10.7 - Tamper Protection Bypass via Registry Key Deletion
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\ registry key.
by hyp3rlinx
CVSS 5.5
Western Bridge Cobub Razor 0.7.2 - Stored XSS
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin.
by ppb
CVSS 8.8
Adobe Flash Player < 28.0.0.161 - Use-After-Free in Primetime SDK Media Player Listener Handling
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
by SyFi
CVSS 7.8
beep < 1.3.4 - Local Privilege Escalation via Race Condition
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
by Pirhack
CVSS 7.0
FiberHome VDSL2 Modem HG 150-UB Firmware - Authentication Bypass via Cookie Header
FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.
by Noman Riffat
CVSS 9.8
Android 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 - Remote Code Execution in Bluetooth
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105.
by Marcin Kozlowski
CVSS 8.8
MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php
MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php.
by 0xB9
CVSS 7.2
Microsoft Malware Protection Engine - Remote Code Execution via Crafted File Scan
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.
by Google Security Research
CVSS 8.8
Internet Explorer - Remote Code Execution via Scripting Engine Memory Corruption
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0876, CVE-2018-0889, CVE-2018-0893, and CVE-2018-0925.
by Google Security Research
CVSS 7.5
Z-BlogPHP <1.5.1.1740 - Info Disclosure
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability
by zzw
CVSS 5.3
Z-BlogPHP 1.5.1.1740 - Cross-Site Scripting via cmd.php Parameters
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability
by zzw
CVSS 6.1
YzmCMS 3.6 - Cross-Site Scripting via Index.php Parameters
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
by zzw
CVSS 6.1
WordPress Activity Log <2.4.1 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
by Stefan Broeder
CVSS 6.1
Joom Sky JS Jobs < 1.2.1 - Cross-Site Scripting
The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.
by Sureshbabu Narvaneni
CVSS 5.4
GetSimple CMS 3.3.13 - Cross-Site Scripting via uploadify.swf movieName Parameter
Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.
by Sureshbabu Narvaneni
CVSS 6.1
DuckDuckGo 4.2.0 - Private IP Address Exposure via WebRTC STUN Request
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
by Dhiraj Mishra
CVSS 4.3
ProcessMaker < 3.5.4 - Authenticated Remote Code Execution via Plugin Upload
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
by Metasploit
By Source