Exploitdb Exploits
50,076 exploits tracked across all sources.
WordPress Theme Creative Multi-Purpose 9.1.3 - Persistent Cross-Site Scripting
by wp0Day.com
WordPress Plugin WP PRO Advertising System 4.6.18 - SQL Injection
by wp0Day.com
WordPress Plugin WP Mobile Detector 3.5 - Arbitrary File Upload
by Aaditya Purani
WordPress Plugin Double Opt-In for Download 2.0.9 - SQL Injection
by Kacper Szurek
Nagios XI 5.2.7 - Multiple Vulnerabilities
by Security-Assessment.com
Electroweb Online Examination System 1.0 - SQL Injection
by Ali Ghanbari
Dream Gallery 1.0 - Cross-Site Request Forgery (Add Admin)
by Ali Ghanbari
ArticleSetup 1.00 - Cross-Site Request Forgery (Change Admin Password)
by Ali Ghanbari
Apache Continuum 1.4.2 - Multiple Vulnerabilities
by David Shanahan
GNU Bash through 4.3 bash43-026 - Remote Code Execution via Environment Variable Function Parsing
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
by lastc0de
CVSS 8.8
Notilus Travel Solution Software 2012 R3 - SQL Injection
by Alex Haynes
Relay Ajax Directory Manager relayb01-071706/1.5.1/1.5.3 - Arbitrary File Upload
by RedTeam Pentesting GmbH
Joomla! Component SecurityCheck 2.8.9 - Multiple Vulnerabilities
by ADEO Security
Websockify (C Implementation) 0.8.0 - Buffer Overflow (PoC)
by RedTeam Pentesting GmbH
Liferay Portal < 6.2 - Stored Cross-Site Scripting via Profile Search FirstName Field
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
by Fernando Câmara
CVSS 6.1
Wireshark - erf_meta_read_tag SIGSEGV
by Google Security Research
HPE Data Protector <7.03_108,8.x<8.15,9.x<9.06 - RCE
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
by Ian Lovering
CVSS 9.8
Flatpress 1.0.3 - Cross-Site Request Forgery / Arbitrary File Upload
by LiquidWorm
AirOS NanoStation M2 5.6-beta - Multiple Vulnerabilities
by Pablo Rebolini
By Source