Exploitdb Exploits

50,121 exploits tracked across all sources.

Sort: Activity Stars
CVE-2024-28995 EXPLOITDB HIGH python
SolarWinds Serv-U - Directory Traversal
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
by İbrahimsql
CVSS 8.6
CVE-2024-0204 EXPLOITDB CRITICAL python
Fortra GoAnywhere MFT Unauthenticated Remote Code Execution
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
by İbrahimsql
CVSS 9.8
CVE-2025-4971 EXPLOITDB HIGH text
Broadcom Automic Automation Agent Unix <24.3.0 HF4-21.0.13 HF1 - Pr...
Broadcom Automic Automation Agent Unix versions < 24.3.0 HF4 and < 21.0.13 HF1 allow low privileged users who have execution rights on the agent executable to escalate their privileges.
by Flora Schäfer
EIP-2026-119282 EXPLOITDB python
Windows 2024.15 - Unauthenticated Desktop Screenshot Capture
by Chokri Hammedi
CVE-2023-29336 EXPLOITDB HIGH c
Win32k - Privilege Escalation
Win32k Elevation of Privilege Vulnerability
by Milad karimi
CVSS 7.8
CVE-2025-2594 EXPLOITDB HIGH python
WordPress Plugin <4.1.3 - Auth Bypass
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
by Mohammed Idrees Banyamer
CVSS 8.1
CVE-2022-2070 EXPLOITDB CRITICAL python
Grandstream Gds3710 Firmware - Out-of-Bounds Write
In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.
by Pepelux
CVSS 9.8
EIP-2026-103832 EXPLOITDB python
ABB Cylon Aspect 3.08.03 - Guest2Root Privilege Escalation
by LiquidWorm
CVE-2024-13946 EXPLOITDB MEDIUM text
ASPECT-Enterprise <3.* - Binary Planting
DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
by LiquidWorm
CVSS 6.8
CVE-2025-46822 EXPLOITDB HIGH python
OsamaTaher Java-springboot-codebase - Path Traversal
OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
by d3sca
CVE-2025-66576 EXPLOITDB CRITICAL python
Remote Keyboard Desktop 1.0.1 - Code Injection
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.
by Chokri Hammedi
CVSS 9.8
CVE-2025-47916 EXPLOITDB CRITICAL php
Invisioncommunity < 5.0.7 - Remote Code Execution
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
by Egidio Romano
CVSS 10.0
CVE-2025-31161 EXPLOITDB CRITICAL python
CrushFTP - Authentication Bypass
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
by İbrahimsql
CVSS 9.8
CVE-2025-1731 EXPLOITDB HIGH
Zyxel Uos < 1.32 - Incorrect Permission Assignment
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.
by Marco Ivaldi
CVSS 7.8
CVE-2025-3605 EXPLOITDB CRITICAL python
Frontend Login & Registration Blocks <1.0.7 - Privilege Escalation
The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
by Md Shoriful Islam
CVSS 9.8
CVE-2025-32370 EXPLOITDB HIGH python
Kentico Xperience < 13.0.178 - XSS
Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.
by Alex Messham
CVSS 7.2
CVE-2024-11237 EXPLOITDB HIGH c
Tp-link Vn020-f3v(t) Firmware - Out-of-Bounds Write
A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
by Mohamed Maatallah
CVSS 7.5
EIP-2026-103811 EXPLOITDB text
RDPGuard 9.9.9 - Privilege Escalation
by Ahmet Ümit BAYRAM
CVE-2024-21111 EXPLOITDB HIGH
Oracle VM Virtualbox < 7.0.16 - Improper Privilege Management
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows hosts only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
by Milad karimi
CVSS 7.8
CVE-2024-38193 EXPLOITDB HIGH
Windows Ancillary Function Driver - Privilege Escalation
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
by Milad karimi
CVSS 7.8
CVE-2025-2011 EXPLOITDB HIGH python
WordPress Depicter Plugin SQL Injection (CVE-2025-2011)
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
by Andrew Long
CVSS 7.5
CVE-2025-27007 EXPLOITDB CRITICAL text
OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82.
by Abdualhadi khalifa
CVSS 9.8
CVE-2025-27533 EXPLOITDB HIGH python
Apache ActiveMQ <6.1.6 - DoS
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
by Abdualhadi khalifa
CVSS 7.5
CVE-2025-28062 EXPLOITDB HIGH text
Frappe Erpnext - CSRF
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
by Ahmed Thaiban
CVSS 8.1
CVE-2025-47226 EXPLOITDB MEDIUM text
Grokability Snipe-IT <8.1.0 - Info Disclosure
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
by Sn1p3r-H4ck3r
CVSS 5.0