Exploitdb Exploits
50,076 exploits tracked across all sources.
AN_GradeBook <5.0.1 - SQL Injection
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
by Lukas Kinneberg
CVSS 8.8
RosarioSIS 10.8.4 - CSV Injection via Periods Module
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
by Ranjeet Jaiswal
CVSS 5.4
October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)
by Okan Kurtulus
mooSocial mooDating 1.2 - Cross-Site Scripting in URL Handler
A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
by CraCkEr
CVSS 3.5
Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS)
by Andrey Stoykov
Keeper Password Manager <17.2 - Info Disclosure
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).
by H4rk3nz0
CVSS 5.5
Perch CMS 3.2 - Authenticated Stored Cross-Site Scripting via SVG File Upload
Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags that execute when the file is viewed, potentially stealing user session information or performing client-side attacks.
by Mirabbas Ağalarov
CVSS 5.4
Perch CMS 3.2 - Authenticated Remote Code Execution via Arbitrary PHP File Upload
Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets management interface. Attackers can upload a malicious .phar file with embedded system command execution capabilities to execute arbitrary commands on the server.
by Mirabbas Ağalarov
CVSS 7.2
Wifi Soft Unibox Administration 3.0-3.1 - SQL Injection via Login Username Field
Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page.
by Ansh Jain
CVSS 9.8
Netgate pfSense <2.7.0 - Command Injection
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.
by Emir Polat
CVSS 8.8
PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities
by Vulnerability-Lab
PaulPrinting CMS - (Search Delivery) Cross Site Scripting
by Vulnerability-Lab
Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities
by Vulnerability-Lab
Aures Booking & POS Terminal - Local Privilege Escalation
by Vulnerability-Lab
Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities
by Vulnerability-Lab
RWS WorldServer <11.7.3 - Info Disclosure
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
by RedTeam Pentesting GmbH
CVSS 5.3
Microsoft Office - Privilege Escalation
Microsoft Office Elevation of Privilege Vulnerability
by nu11secur1ty
CVSS 7.8
Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
by qw3rTyTy
CVSS 7.5
PimpMyLog 1.7.14 - Unauthenticated Admin Account Creation via Configuration Endpoint
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.
by thoughtfault
CVSS 9.8
phpfm 1.7.9 - Auth Bypass
phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server.
by thoughtfault
CVSS 9.8
Blackcat CMS 1.4 - Authenticated Remote Code Execution via jQuery Plugin Manager
Blackcat CMS 1.4 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the jquery plugin manager. Attackers can upload a zip file with a PHP shell script and execute arbitrary system commands by accessing the uploaded plugin's PHP file with a 'code' parameter.
by Mirabbas Ağalarov
CVSS 7.2
By Source