Exploitdb Exploits
50,121 exploits tracked across all sources.
Invesalius3 - Remote Code Execution
by Alessio Romano (sfoffo)_ Riccardo Degli Esposti (partywave)
HughesNet HT2000W Satellite Modem - Password Reset
by Simon Greenblatt
Elber Wayber Analog/Digital Audio STL 4.00 - Device Config Disclosure
by LiquidWorm
Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass
by LiquidWorm
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config
by LiquidWorm
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass
by LiquidWorm
Helpdeskz < 2.0.2 - XSS
A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.
by Md. Sadikul Islam
CVSS 4.8
Calibre-web 0.6.21 - Stored XSS
by Catalin Iovita_ Alexandru Postolache
Genexus Protection Server 9.7.2.10 - Code Injection
Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations.
by SamAlucard
SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path
by Milad karimi
Oracle Database 12c Release 1 - Unquoted Service Path
by Milad karimi
stitionai devika v1 - Path Traversal
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
by Alperen Ergel
CVSS 9.1
Bonjour Service 'mDNSResponder.exe' - Unquoted Service Path Privilege Escalation
by bios
Xhibiter NFT Marketplace 1.10.2 - SQL Injection
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.
by Sohel Yousef
Microweber - XSS
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
by tmrswrr
CVSS 5.4
Azon Dominator Affiliate Marketing Script - SQL Injection
by Buğra Enis Dönmez
Flatboard 3.2 - XSS
Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fields. Attackers can insert JavaScript payloads that execute when other users view the forum, potentially stealing session cookies and executing client-side scripts.
by tmrswrr
Poultry Farm Management System v1.0 - Remote Code Execution (RCE)
by Jerry Thomas
Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)
by Jerry Thomas
By Source