Android - ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN


FLEX 1080 < 1085 Web 1.6.0 - Denial of Service


WeChat - Memory Corruption in CAudioJBM::InputAudioFrameToJBM


Android Binder - Use-After-Free (Metasploit)


Tasks 9.7.3 - Insecure Permissions


Xiaomi browser 10.2.4.g - Browser Search History Disclosure


AWebServer GhostBuilding 18 - Denial of Service (DoS)


Bookeen Notea - Directory Traversal


ES File Explorer 4.1.9.7.4 - Arbitrary File Read


Magic Home Pro 1.5.1 - Authentication Bypass


Roxy Fileman 1.4.5 -  Arbitrary File Upload


Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)


Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)


ENTAB ERP 1.0 - Username PII leak


EQ Enterprise management system v2.2.0 - SQL Injection


HelloWeb 2.0 - Arbitrary File Download


InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal


OLK Web Store 2020 - Cross-Site Request Forgery


Password Manager for IIS v2.0 - XSS


Snitz Forum v1.0 - Blind SQL Injection


wkhtmltopdf 0.12.6 -  Server Side Request Forgery


BlogEngine 3.3.8 - 'Content' Stored XSS


DotNetNuke 9.5 - File Upload Restrictions Bypass


DotNetNuke 9.5 - Persistent Cross-Site Scripting


ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)


H8 SSRMS - 'id' IDOR


IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration


Kartris 1.6 - Arbitrary File Upload


Microsoft SharePoint Server 2019 - Remote Code Execution


Microsoft SharePoint Server 2019 - Remote Code Execution (2)


Nyron 1.0 - SQLi (Unauthenticated)


Orchard Core RC1 - Persistent Cross-Site Scripting


ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)


Sitecore - Remote Code Execution v8.2


Smart Office Web 20.28 - Remote Information Disclosure (Unauthenticated)


SmarterTools SmarterTrack 7922 - 'Multiple' Information Disclosure


Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)


Umbraco CMS 8.9.1 - Directory Traversal


Umbraco v8.14.1 - 'baseUrl' SSRF


Adobe ColdFusion 8 - Remote Command Execution (RCE)


Aruba Instant (IAP) - Remote Code Execution


CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting


CHIYU IoT devices - 'Multiple' Cross-Site Scripting (XSS)


CHIYU TCP/IP Converter devices - CRLF injection


Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection


IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)


IPFire 2.25 - Remote Code Execution (Authenticated)


LISTSERV 17 - Insecure Direct Object Reference (IDOR)


LISTSERV 17 - Reflected Cross Site Scripting (XSS)


Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)


Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI


Movable Type 7 r.5002  - XMLRPC API OS Command Injection (Metasploit)


ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)


Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal


Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)


Zen Load Balancer 3.10.1 - Remote Code Execution


pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting


MinIO < 2024-01-31T20-20-33Z - Privilege Escalation


Answerdev 1.0.3 - Account Takeover


Casdoor 1.901.0 - Cross-Site Request Forgery (CSRF)


Casdoor < v1.331.0 - '/api/set-password' CSRF


Ladder v0.0.21 - Server-side request forgery (SSRF)


Minio 2022-07-29T19-40-48Z - Path traversal


Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download


Pydio Cells 4.1.2 - Server-Side Request Forgery


Pydio Cells 4.1.2 - Unauthorised Role Assignments


Amcrest Dahua NVR Camera IP2M-841 - Denial of Service (PoC)


Cisco IP Phone 11.7 - Denial of service (PoC)


DD-WRT 45723 - UPNP Buffer Overflow (PoC)


DLink DIR 819 A1 - Denial of Service


Electrolink FM/DAB/TV Transmitter - Unauthenticated Remote DoS


Extreme Networks Aerohive HiveOS 11.0 - Remote Denial of Service (PoC)


FortiRecorder 6.4.3 - Denial of Service


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)


Microtik SSH Daemon 6.44.3 - Denial of Service (PoC)


Paradox Security Systems IPR512 - Denial Of Service


qubes-mirage-firewall  v0.8.3 - Denial Of Service (DoS)


Router ZTE-H108NS - Stack Buffer Overflow (DoS)


RouterOS 6.40.5 - 6.44 and 6.48.1 - 6.49.10 - Denial of Service


Siemens S7 Layer 2 - Denial of Service (DoS)


SoX 14.4.2 - Denial Of Service


Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service


TP-Link Archer C50 3 - Denial of Service (PoC)


TP-Link TL-WR940N V4 - Buffer OverFlow


VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) - Remote Denial Of Service


ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE)


Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation


DS Wireless Communication - Remote Code Execution


ECOA Building Automation System - Missing Encryption Of Sensitive Information


FS-S3900-24T4S - Privilege Escalation


Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account


Saflok - Key Derication Function Exploit


Sony Playstation 4 (PS4) < 7.02 / FreeBSD 9 / FreeBSD 12 - 'ip6_setpktopt' Kernel Local Privilege Escalation (PoC)


ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access


Accu-Time Systems MAXIMUS 1.0 - Telnet Remote Buffer Overflow (DoS)


Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root


Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)


Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak


Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution


Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution


Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)


Aruba Instant 8.7.1.0 - Arbitrary File Modification


ASKEY RTF3505VW-N1 - Privilege Escalation


Atcom 2.7.x.x - Authenticated Command Injection


Auerswald COMfortel 2.8F - Authentication Bypass


Auerswald COMpact 8.0B - Arbitrary File Disclosure


Auerswald COMpact 8.0B - Multiple Backdoors


Auerswald COMpact 8.0B - Privilege Escalation


AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal


Aztech DSL5005EN Router - 'sysAccess.asp' Admin Password Change (Unauthenticated)


CHIYU IoT Devices - 'Telnet' Authentication Bypass


Cisco 7937G - DoS/Privilege Escalation


Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers


Cypress Solutions CTM-200 2.7.1 - Root Remote OS Command Injection


Cypress Solutions CTM-200/CTM-ONE - Hard-coded Credentials Remote Root (Telnet/SSH)


D-Link DIR-846 - Remote Command Execution (RCE) vulnerability


D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution


Dell EMC iDRAC7/iDRAC8 2.52.52.52 -  Remote Code Execution (RCE)


Dell EMC Networking PC5500 firmware versions 4.1.0.22 and  Cisco Sx / SMB - Information Disclosure


Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure


Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)


Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)


Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)


Dixell XWEB 500 - Arbitrary File Write


DLINK DAP-1620 A1 v1.01 - Directory Traversal


DLINK DIR850 - Insecure Access Control


DLINK DIR850 - Open Redirect


Dlink DSL2750U - 'Reboot' Command Injection


DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)


Drobo 5N2 4.1.1 - Remote Command Injection


DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure


EasyNas 1.1.0 - OS Command Injection


EBBISLAND EBBSHAVE 6100-09-04-1441 - Remote Buffer Overflow


ECOA Building Automation System - Hard-coded Credentials SSH Access


Epson Stylus SX510W Printer Remote Power Off - Denial of Service


EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)


EuroTel ETL3100 - Transmitter Default Credentials


EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download


Franklin Fueling Systems  TS-550 - Exploit and Default Password


Franklin Fueling Systems TS-550 - Default Password


FRITZ!Box 7.20 - DNS Rebinding Protection Bypass


Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure


GL-iNet MT6000 4.5.5 - Arbitrary File Download


GL.iNet AR300M v3.216 Remote Code Execution - CVE-2023-46456 Exploit


GL.iNet AR300M v4.3.7 Arbitrary File Read - CVE-2023-46455 Exploit


GL.iNet AR300M v4.3.7 Remote Code Execution - CVE-2023-46454 Exploit


GoAhead Web Server 5.1.1 - Digest Authentication Capture Replay Nonce Reuse


H3C SSL VPN - Username Enumeration


Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution


HiSilicon DVR/NVR hi3520d firmware - Remote Backdoor Account


HNAS SMU 14.8.7825 - Information Disclosure


Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)


Hughes Satellite Router HX200 v8.3.1.14 -  Remote File Inclusion


ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 - Remote File CRUD


ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure


ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS)


Ilevia EVE X1/X5 Server 4.7.18.0.eden - Reverse Rootshell


iRZ Mobile Router - CSRF to RCE


KevinLAB BEMS 1.0 - Undocumented Backdoor Account


Kramer VIAware - Remote Code Execution (RCE) (Root)


Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE)


KZTech T3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Hard coded Credentials Shell Access


Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated)


Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection


Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)


Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection


Milesight Routers UR5X_ UR32L_ UR32_ UR35_ UR41 - Credential Leakage Through Unprotected System Logs and Weak Password Encryption


MiniDVBLinux 5.4  - Change Root Password


MiniDVBLinux 5.4  - Remote Root Command Injection


MiniDVBLinux 5.4 - Arbitrary File Read


MiniDVBLinux 5.4 - Unauthenticated Stream Disclosure


MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP - Remote Code Execution (RCE)


MiniDVBLinux <=5.4  - Config Download Exploit


Mitrastar GPT-2541GNAC-N1 - Privilege escalation


MSNSwitch Firmware MNT.2408 - Remote Code Execution


mySCADA myPRO 7 - Hardcoded Credentials


Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)


Nokia ASIKA 7.13.52 - Hard-coded private key disclosure


Omnia MPX 1.5.0+r1 - Path Traversal


Optoma 1080PSTX Firmware C02 - Authentication Bypass


Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection


Osprey Pump Controller 1.0.1 - (pseudonym) Semi-blind Command Injection


Osprey Pump Controller 1.0.1 - (userName) Blind Command Injection


Osprey Pump Controller 1.0.1 - Administrator Backdoor Access


Osprey Pump Controller 1.0.1 - Authentication Bypass Credentials Modification


Osprey Pump Controller 1.0.1 - Cross-Site Request Forgery


Osprey Pump Controller 1.0.1 - Predictable Session Token / Session Hijack


Osprey Pump Controller 1.0.1 - Unauthenticated File Disclosure


Osprey Pump Controller 1.0.1 - Unauthenticated Remote Code Execution Exploit


Osprey Pump Controller v1.0.1 - Unauthenticated Reflected XSS


pfsenseCE v2.6.0 - Anti-brute force protection bypass


Positron Broadcast Signal Processor TRA7005 v1.20 - Authentication Bypass


ProLink PRS1841 PLDT Home fiber - Default Password


R Radio Network FM Transmitter 1.07 system.cgi - Password Disclosure


ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)


Ricoh Printer - Directory and File Exposure


Router ZTE-H108NS - Authentication Bypass


Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE)


Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)


Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)


Sagemcom F@ST 3890 (50_10_19-T1) Cable Modem - 'Cable Haunt' Remote Code Execution


Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 - Remote Code Execution (RCE)


Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution


Schneider Electric v1.0 - Directory traversal & Broken Authentication


Screen SFT DAB 600/C - Authentication Bypass Account Creation


Screen SFT DAB 600/C - Authentication Bypass Admin Password Change


Screen SFT DAB 600/C - Authentication Bypass Erase Account


Screen SFT DAB 600/C - Authentication Bypass Password Change


Screen SFT DAB 600/C - Authentication Bypass Reset Board Config


Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)


SDT-CW3B1 1.1.0 - OS Command Injection


Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)


Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)


Shelly PRO 4PM v0.11.0 - Authentication Bypass


Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation


Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure


SmartRG Router SR510n 2.6.13 - Remote Code Execution


SolarView Compact 6.0 - OS Command Injection


SolarView Compact 6.00 - Command Injection


SolarView Compact 6.00 - Directory Traversal


Sony IPELA Network Camera 1.82.01 - 'ftpclient.cgi' Remote Stack Buffer Overflow


SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow


Synology DiskStation Manager - smart.cgi Remote Command Execution (Metasploit)


Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access


Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities


Telesquare SDT-CW3B1 1.1.0 - OS Command Injection


TELSAT marKoni FM Transmitter 1.9.5 - Backdoor Account Information Disclosure


TELSAT marKoni FM Transmitter 1.9.5 - Insecure Access Control Change Password


TELSAT marKoni FM Transmitter 1.9.5 - Root Command Injection


TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution


TEM Opera Plus FM Family Transmitter 35.45 - XSRF


Tenda D151 & D301 - Configuration Download (Unauthenticated)


Tenda HG6 v3.3.0 - Remote Command Injection


Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing


Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change


Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction


TitanNit Web Control 2.01 / Atemio 7600 - Root Remote Code Execution


TP-Link Archer AX21 - Unauthenticated Command Injection


TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)


TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated)


TP-Link WDR4300 - Remote Code Execution (Authenticated)


TPC-110W - Missing Authentication for Critical Function


USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 - Remote Root Backdoor


Verizon 4G LTE Network Extender - Weak Credentials Algorithm


Viessmann Vitogate 300 2.1.3.0 - Remote Code Execution (RCE)


WAGO 750-8212 PFC200 G2 2ETH RS - Privilege Escalation


WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE


Zyxel NWA-1100-NH - Command Injection


Zyxel USG FLEX 5.21 - OS Command Injection


Zyxel zysh - Format string


ABB FlowX v4.00 - Exposure of Sensitive Information


Adtran Personal Phone Manager 10.8.1 - 'emailAddress' Stored Cross-Site Scripting (XSS)


Adtran Personal Phone Manager 10.8.1 - 'Multiple' Reflected Cross-Site Scripting (XSS)


Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration


AirControl 1.4.2 - PreAuth Remote Code Execution


AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)


All-Dynamics Digital Signage System 2.0.2 - Cross-Site Request Forgery (Add Admin)


Altenergy Power Control Software C1.2.5 - OS command injection


Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure


Aquatronica Control System 5.1.6 - Information Disclosure


Artica Proxy 4.3.0 - Authentication Bypass


ASUS TM-AC1900 - Arbitrary Command Execution (Metasploit)


Ateme TITAN File 3.9 - SSRF File Enumeration


ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure


Avaya Aura Communication Manager 5.2 - Remote Code Execution


Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting


Black Box Kvm Extender 3.4.31307 - Local File Inclusion


BrightSign Digital Signage Diagnostic Web Server 8.2.26 - File Delete Path Traversal


BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)


BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)


Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass


Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal


Check Point Security Gateway - Information Disclosure (Unauthenticated)


CHIYU IoT Devices - Denial of Service (DoS)


Cisco Adaptive Security Appliance Software 9.11 - Local File Inclusion


Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion


Cisco ASA 9.14.1.10 and FTD 6.6.0.1 - Path Traversal (2)


Cisco ASA and FTD 9.6.4.42 - Path Traversal


Cisco Firepower Management Center < 6.6.7.1 - Authenticated RCE


Cisco UCS Manager 2.2(1d) - Remote Command Execution


Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass


Citrix ADC NetScaler - Local File Inclusion (Metasploit)


COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass


COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure


COMMAX Smart Home IoT Control System CDP-1020n - SQL Injection Authentication Bypass


COMMAX Smart Home Ruvie CCTV Bridge DVR Service - Config Write / DoS (Unauthenticated)


COMMAX Smart Home Ruvie CCTV Bridge DVR Service - RTSP Credentials Disclosure


COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNC_Ctrl.dll' Heap Buffer Overflow


COMMAX WebViewer ActiveX Control 2.1.4.5 - 'Commax_WebViewer.ocx' Buffer Overflow


Compro Technology IP Camera - ' index_MJpeg.cgi' Stream Disclosure


Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure


Compro Technology IP Camera - 'killps.cgi' Denial of Service (DoS)


Compro Technology IP Camera - 'Multiple' Credential Disclosure


Compro Technology IP Camera - RTSP stream disclosure (Unauthenticated)


Comtrend AR-5387un router - Persistent XSS (Authenticated)


Comtrend VR-3033 - Command Injection


Creston Web Interface 1.0.0.2159 - Credential Disclosure


D-Link DAP-1325 - Broken Access Control


D-Link DIR-615 T1 20.10 - CAPTCHA Bypass


D-Link DSR-250N 3.12 - Denial of Service (PoC)


Dbltek GoIP - Local File Inclusion


DBPower C300 HD Camera - Remote Configuration Disclosure


Denver IP Camera SHO-110 - Unauthenticated Snapshot


Dingtian-DT-R002 3.1.276A - Authentication Bypass


DLINK DPH-400SE - Exposure of Sensitive Information


Draytek VigorAP 1000C - Persistent Cross-Site Scripting


Eaton Intelligent Power Manager 1.6 - Directory Traversal


ECOA Building Automation System - 'multiple' Cross-Site Request Forgery (CSRF)


ECOA Building Automation System - Arbitrary File Deletion


ECOA Building Automation System - Configuration Download Information Disclosure


ECOA Building Automation System - Cookie Poisoning Authentication Bypass


ECOA Building Automation System - Directory Traversal Content Disclosure


ECOA Building Automation System - Local File Disclosure


ECOA Building Automation System - Path Traversal Arbitrary File Upload


ECOA Building Automation System - Remote Privilege Escalation


ECOA Building Automation System - Weak Default Credentials


Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)


Edimax EW-7438RPn - Information Disclosure (WiFi Password)


Edimax EW-7438RPn 1.13 - Remote Code Execution


Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution


Eibiz i-Media Server Digital Signage 3.8.0 - Authentication Bypass


Eibiz i-Media Server Digital Signage 3.8.0 - Configuration Disclosure


Eibiz i-Media Server Digital Signage 3.8.0 - Privilege Escalation


Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Authentication Bypass


Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass


Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config


Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Authentication Bypass


Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Device Config Disclosure


Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 - Authentication Bypass


Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 - Device Config Disclosure


Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass


Elber Wayber Analog/Digital Audio STL 4.00 - Device Config Disclosure


Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure


Electrolink FM/DAB/TV Transmitter (Login Cookie) - Authentication Bypass


Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) - Credentials Disclosure


Electrolink FM/DAB/TV Transmitter - Pre-Auth MPFS Image Remote Code Execution


Electrolink FM/DAB/TV Transmitter - Remote Authentication Removal


ESCAM QD-900 WIFI HD Camera - Remote Configuration Disclosure


F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion


F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated)


FatPipe Networks WARP 10.2.2 - Authorization Bypass


FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - 'Add Admin' Cross-Site Request Forgery (CSRF)


FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Config Download (Unauthenticated)


FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Hidden Backdoor Account (Write Access)


FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Remote Privilege Escalation


Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting


FLIR AX8 1.46.16  - Remote Command Injection


Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification


Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE


Genexis Platinum-4410 - 'SSID' Persistent XSS


Genexis Platinum-4410 2.1 - Authentication Bypass


Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF


Genexis Platinum-4410 P4410-V2-1.28 - Cross Site Request Forgery to Reboot


Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting


GeoVision Camera GV-ADR2701 - Authentication Bypass


GeoVision Geowebserver 5.3.3 - Local FIle Inclusion


GLiNet - Router Authentication Bypass


Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection


Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection


Hikvision Web Server Build 210702 - Command Injection


HiSecOS 04.0.01 - Privilege Escalation


HiSilicon Video Encoders - Full admin access via backdoor password


HiSilicon Video Encoders - RCE via unauthenticated command injection


HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware


HiSilicon Video Encoders - Unauthenticated file disclosure via path traversal


HiSilicon Video Encoders - Unauthenticated RTSP buffer overflow (DoS)


Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore < 14.8.7825.01 - IDOR


HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting (XSS)


Huawei DG8045 Router 1.0 - Credential Disclosure


Huawei HG255 - Directory Traversal (Metasploit)


Huawei HG630 2 Router - Authentication Bypass


HughesNet HT2000W Satellite Modem - Password Reset


I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure


iBall-Baton WRA150N Rom-0 Backup - File Disclosure (Sensitive Information)


IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal


IBM RICOH 6400 Printer - HTML Injection


IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting


IBM RICOH InfoPrint 6500 Printer - HTML Injection


iDS6 DSSPro Digital Signage System 6.2 - CAPTCHA Security Bypass


iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)


iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation


Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)


Intelbras Router RF 301K 1.1.2 - Authentication Bypass


Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)


IQrouter 3.3.1 Firmware - Remote Code Execution


Karel IP Phone IP1211 Web Management Panel - Directory Traversal


KevinLAB BEMS 1.0 - Authentication Bypass


KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)


Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)


Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Authentication Bypass


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Command Injection (Authenticated)


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)


KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Remote Code Execution


Linksys AX3200 V1.1.00 - Command Injection


Linksys EA7500 2.0.8.194281 - Cross-Site Scripting


Linksys RE6500 1.0.11.001 - Unauthenticated RCE


Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download


MAC 1200R - Directory Traversal


Macally WIFISD2-2A82 2.000.010 - Guest to Root Privilege Escalation


MCL-Net 4.3.5.8788 - Information Disclosure


Mida eFramework 2.8.9 - Remote Code Execution


Mida eFramework 2.9.0 - Back Door Access


Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection


Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)


Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure


Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access)


Nanometrics Centaur 4.3.23 - Unauthenticated Remote Memory Leak


NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration


NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)


Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)


Netgear R7000 Router - Remote Code Execution


Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)


Netis E1+ 1.2.32533 - Backdoor Account (root)


Netis E1+ V1.2.32533 - Unauthenticated WiFi Password Leak


Netis WF2419 2.2.36123 - Remote Code Execution


Netlink GPON Router 1.0.11 - Remote Code Execution


Netlink XPON 1GE WiFi V2801RGW - Remote Command Execution


Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (XSS) (Unauthenticated)


NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation


OptiLink ONT1GEW GPON 2.1.11_X101 Build 1127.190306 - Remote Code Execution (Authenticated)


P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)


Panasonic Sanyo CCTV Network Camera 2.03-0x - Cross-Site Request Forgery (Change Password)


piSignage 2.6.4 - Directory Traversal


PNPSCADA 2.200816204020 - 'interf' SQL Injection (Authenticated)


PnPSCADA v2.x - Unauthenticated PostgreSQL Injection


QiHang Media Web Digital Signage 3.0.9 - Cleartext Credential Disclosure


QiHang Media Web Digital Signage 3.0.9 - Remote Code Execution (Unauthenticated)


QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Deletion


QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Disclosure


RAD SecFlow-1v SF_0290_2.3.01.26  - Persistent Cross-Site Scripting


RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)


Razer Sila - Command Injection


Razer Sila - Local File Inclusion (LFI)


ReQuest Serious Play F3 Media Server 7.0.3 - Debug Log Disclosure


ReQuest Serious Play F3 Media Server 7.0.3 - Remote Code Execution (Unauthenticated)


ReQuest Serious Play F3 Media Server 7.0.3 - Remote Denial of Service


ReQuest Serious Play Media Player 3.0 - Directory Traversal File Disclosure


RICOH Aficio SP 5200S Printer - 'entryNameIn' HTML Injection


RICOH Aficio SP 5210SF Printer - 'entryNameIn' HTML Injection


Ricon Industrial Cellular Router S9922XL - Remote Command Execution (RCE)


Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution


Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal


SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)


Satellian 1.12 - Remote Code Execution


Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection


Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection


Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read


SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure


SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure


Selea Targa 512 IP OCR-ANPR Camera - Stream Disclosure (Unauthenticated)


Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution (Unauthenticated)


Selea Targa IP OCR-ANPR Camera - 'files_list' Remote Stored XSS


Selea Targa IP OCR-ANPR Camera - CSRF Add Admin


Selea Targa IP OCR-ANPR Camera - Developer Backdoor Config Overwrite


Selea Targa IP OCR-ANPR Camera - Directory Traversal File Disclosure (Unauthenticated)


Selea Targa IP OCR-ANPR Camera - Multiple SSRF (Unauthenticated)


Seowon 130-SLC router - 'queriesCnt' Remote Code Execution (Unauthenticated)


Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated)


Seowon SlC 130 Router - Remote Code Execution


Sickbeard 0.1 - Remote Command Injection


Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking


Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery


Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password


Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP


Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit


Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset


Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation


Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure


Sipwise C5 NGCP CSC - 'Multiple' Persistent Cross-Site Scripting (XSS)


Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery (CSRF)


SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)


Solar-Log 200 PM+ 3.6.0 Build 99 - 15.10.2019 - Stored XSS


SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)


SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)


SonicWall SMA 10.2.1.0-17sv - Password Reset


Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS)


Sonicwall SonicOS 7.0 - Host Header Injection


SonicWall SSL-VPN 8.0.0.0 - 'visualdoor' Remote Code Execution (Unauthenticated)


Sony BRAVIA Digital Signage 1.7.8 - System API Information Disclosure


Sony BRAVIA Digital Signage 1.7.8 - Unauthenticated Remote File Inclusion


Sony Playstation 4 (PS4) < 6.72 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)


Sony Playstation 4 (PS4) < 7.02 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)


Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass


SOYAL Biometric Access Control System 5.0 - 'Change Admin Password' CSRF


SOYAL Biometric Access Control System 5.0 - Master Code Disclosure


SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin)


SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure


SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration


SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)


SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)


Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)


Telesquare TLR-2855KS6 - Arbitrary File Creation


Telesquare TLR-2855KS6 - Arbitrary File Deletion


Tenda AC5 AC1200 Wireless - 'WiFi Name & Password' Stored Cross Site Scripting


Thecus N4800Eco Nas Server Control Panel - Comand Injection


Tiandy IPC and NVR 9.12.7 - Credential Disclosure


TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware)


TLR-2005KSH - Arbitrary File Delete


TLR-2005KSH - Arbitrary File Upload


TP LINK TL-WR849N - Remote Code Execution


TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)


TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)


TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass


TP-Link TL-WR740N - Authenticated Directory Transversal


TP-Link TL-WR740N - Buffer Overflow 'DOS'


TP-LINK TL-WR740N - Multiple HTML Injection


TP-Link TL-WR740N - UnAuthenticated Directory Transversal


TP-Link TL-WR841N - Command Injection


TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot


TVT NVMS 1000 - Directory Traversal


Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)


UBICOD Medivision Digital Signage 1.5.1 - Authorization Bypass


UBICOD Medivision Digital Signage 1.5.1 - Cross-Site Request Forgery (Add Admin)


UCM6202 1.0.18.13 - Remote Command Injection


Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS)


Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation


Vodafone H-500-s 3.5.10 - WiFi Password Disclosure


Wago PFC200 - Authenticated Remote Code Execution (Metasploit)


Wavlink WN530HG4 - Password Disclosure


Wavlink WN533A8 - Cross-Site Scripting (XSS)


Wavlink WN533A8 - Password Disclosure


YeaLink SIP-TXXXP 53.84.0.15 - 'cmd' Command Injection (Authenticated)


ZBL EPON ONU Broadband Router 1.0 - Remote Privilege Escalation


ZTE Router F602W - Captcha Bypass


Zucchetti Axess CLOKI Access Control 1.64 - Cross Site Request Forgery (CSRF)


Zyxel Armor X1 WAP6806 - Directory Traversal


Color Notes 1.4 - Denial of Service (PoC)


Macaron Notes great notebook 5.5 - Denial of Service (PoC)


My Notes Safe 5.3 - Denial of Service (PoC)


n+otes 1.6.2 - Denial of Service (PoC)


Notex the best notes 6.4 - Denial of Service (PoC)


P2PWIFICAM2 for iOS 10.4.1 - 'Camera ID' Denial of Service (PoC)


Post-it 5.0.1 - Denial of Service (PoC)


ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC)


Secure Notepad Private Notes 3.0.3 - Denial of Service (PoC)


Sticky Notes & Color Widgets 1.4.2 - Denial of Service (PoC)


Sticky Notes Widget Version 3.0.6 - Denial of Service (PoC)


WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC)


memono Notepad Version 4.2 - Denial of Service (PoC)


AirKeyboard iOS App 1.0.5 - Remote Input Injection


Wifi HD Wireless Disk Drive 11 - Local File Inclusion


AirDisk Pro 5.5.3 for iOS - Persistent Cross-Site Scripting


Easy Transfer 1.7 for iOS - Directory Traversal


File Transfer iFamily 2.1 - Directory Traversal


HardDrive 2.1 for iOS - Arbitrary File Upload


Mini Mouse 9.3.0 - Local File inclusion


Owlfiles File Manager 12.0.1 - Multiple Vulnerabilities


Playable 9.18 iOS - Persistent Cross-Site Scripting


Sky File 2.1.0 iOS - Directory Traversal


Super Backup 2.0.5 for iOS - Directory Traversal


SuperBackup 2.0.5 for iOS - Persistent Cross-Site Scripting


H2 Database 1.4.199 - JNI Code Execution


AD Manager Plus 7122 - Remote Code Execution (RCE)


Apache Log4j 2 - Remote Code Execution (RCE)


Apache Log4j2 2.14.1 - Information Disclosure


CatDV 9.2 - RMI Authentication Bypass


Cisco DCNM JBoss 10.4 - Credential Leakage


GitLab CE/EE < 16.7.2 - Password Reset


JetBrains TeamCity 2018.2.4 - Remote Code Execution


JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)


Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)


Neo4j 3.4.18 - RMI based Remote Code Execution (RCE)


Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)


Ametys CMS v4.4.1 - Cross Site Scripting (XSS)


Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit)


Apache Flink 1.9.x - File Upload RCE (Unauthenticated)


Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)


Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)


Apache OFBiz 18.12.12 - Directory Traversal


Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution


ApacheOfBiz 17.12.01 - Remote Command Execution (RCE)


AppSmith 1.47 - Remote Code Execution (RCE)


Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read


Cisco Data Center Network Manager 11.2 - Remote Code Execution


Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection


Cisco Data Center Network Manager 11.2.1 - 'LanFabricImpl' Command Injection


Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting


CITSmart ITSM 9.1.2.22 - LDAP Injection


CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)


CloverDX 5.9.0 - Cross-Site Request Forgery (CSRF)


Confluence Data Center 7.18.0 - Remote Code Execution (RCE)


Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)


DataEase 2.4.0 - Database Configuration Information Exposure


Eclipse Jetty 11.0.5 - Sensitive File Disclosure


ERPNext 12.29 - Cross-Site Scripting (XSS)


Exhibitor Web UI 1.7.1 - Remote Code Execution


ForgeRock Access Manager 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)


Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution


Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)


Java-springboot-codebase 1.1 - Arbitrary File Read


Jenkins 2.235.3 - 'Description' Stored XSS


Jenkins 2.235.3 - 'tooltip' Stored Cross-Site Scripting


Jenkins 2.235.3 - 'X-Forwarded-For' Stored XSS


Jenkins 2.441 - Local File Inclusion


Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in


Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting


Jetty 9.4.37.v20210219 - Information Disclosure


Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal


Jira 8.3.4 - Information Disclosure (Username Enumeration)


Karaf v4.4.3 Console - RCE


Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)


Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation


LabVantage 8.3 - Information Disclosure


Liferay CE Portal 6.0.2 - Remote Command Execution


Liferay Portal 6.2.5 - Insecure Permissions


ManageEngine ADSelfService Build prior to 6003 - Remote Code Execution (Unauthenticated)


ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection


ManageEngine Applications Manager 14700 - Remote Code Execution (Authenticated)


ManageEngine EventLog Analyzer 10.0 - Information Disclosure


ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection


ManageEngine Service Desk 10.0 - Cross-Site Scripting


Nacos 2.0.3 - Access Control vulnerability


Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)


Novel Boutique House-plus 3.5.1 - Arbitrary File Download


OpenAM 13.0 - LDAP Injection


Oracle Hospitality RES 3700 5.7 - Remote Code Execution


Oracle Weblogic 10.3.6.0.0 - Remote Command Execution


Oracle WebLogic Server 12.2.1.0 - RCE (Unauthenticated)


Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution


Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)


Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery (change admin password)


Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)


Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated)


Spring Boot common-user-management 0.1 - Remote Code Execution (RCE)


Spring Cloud 3.2.2 - Remote Command Execution (RCE)


Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)


Sysaid 20.1.11 b26 - Remote Command Execution


Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape


TylerTech Eagle 2018.3.11 - Remote Code Execution


VMWAre vCloud Director 9.7.0.15498291 - Remote Code Execution


WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure


WebLogic Server 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 - Unauthenticated RCE via GET request


WSO2 3.1.0 - Arbitrary File Delete


WSO2 3.1.0 - Persistent Cross-Site Scripting


Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration


AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)


AVideo Platform 8.1 - Information Disclosure (User Enumeration)


EasyPMS 1.0.0 - Authentication Bypass


NSClient++ 0.5.2.35 - Authenticated Remote Code Execution


openMAINT 1.1-2.4.2 - Arbitrary File Upload


Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information


Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)


BMC Compuware iStrobe Web - 20.13 - Pre-auth RCE


Desktop Central 9.1.0 - Multiple Vulnerabilities


dizqueTV 1.5.3 - Remote Code Execution (RCE)


Openfire 4.6.0 - 'groupchatJID' Stored XSS


Openfire 4.6.0 - 'path' Stored XSS


Openfire 4.6.0 - 'sql' Stored XSS


Openfire 4.6.0 - 'users' Stored XSS


Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)


STARFACE 7.3.0.10 - Authentication with Password Hash Possible


ZKTeco ZEM/ZMM 8.88 - Missing Authentication


BearFTP 0.1.0 - 'PASV' Denial of Service


dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service (PoC)


Go SSH servers 0.0.2 - Denial of Service (PoC)


Grafana 7.0.1 - Denial of Service (PoC)


libupnp 1.6.18 - Stack-based buffer overflow (DoS)


Redir 3.3 - Denial of Service (PoC)


Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC)


usersctp - Out-of-Bounds Reads in sctp_load_addresses_from_init


VIM 8.2 - Denial of Service (PoC)


(shellcode) Linux-x64 - create a shell with execve() sending argument using XOR (/bin//sh) [55 bytes]


Apport 2.20 - Local Privilege Escalation


aptdaemon < 1.1.1 - File Existence Disclosure


binutils 2.37 - Objdump Segmentation Fault


Blueman < 2.1.4 - Local Privilege Escalation


Dell Security Management Server <1.9.0 - Local Privilege Escalation


Diamorphine Rootkit - Signal Privilege Escalation (Metasploit)


Enlightenment v0.25.3 - Privilege escalation


ExifTool 12.23 - Arbitrary Code Execution


glibc 2.38 - Buffer Overflow


Gnome Fonts Viewer 3.34.0 - Heap Corruption


GNU screen v4.9.0 - Privilege Escalation


Google Chrome  109.0.5414.74 - Code Execution via missing lib file (Ubuntu)


Google SLO-Generator 2.0.0 - Code Execution


libbabl 0.1.62 - Broken Double Free Detection (PoC)


Linux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation


Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)


Linux Kernel 5.8 < 5.16.11 - Local Privilege Escalation (DirtyPipe)


Linux Kernel 6.2 -  Userspace Processes To Enable Mitigation


Linux PAM Environment - Variable Injection Local Privilege Escalation


MariaDB 10.2 - 'wsrep_provider' OS Command Execution


Mini-XML 3.2 - Heap Overflow


MySQL User-Defined (Linux) x32 / x86_64 - 'sys_exec' Local Privilege Escalation (2)


NVIDIA Container Toolkit 1.16.1 - Time-of-check Time-of-Use (TOCTOU)


OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)


PackageKit < 1.1.13 - File Existence Disclosure


PolicyKit-1 0.105-31 - Privilege Escalation


Polkit 0.105-26 0.117-2 - Local Privilege Escalation


Reliable Datagram Sockets (RDS) - rds_atomic_free_op NULL pointer dereference Privilege Escalation (Metasploit)


Socat 1.7.3.4 - Heap-Based Overflow (PoC)


sudo 1.8.0 to 1.9.12p1 - Privilege Escalation


Sudo 1.8.25p - 'pwfeedback' Buffer Overflow


Sudo 1.9.17 Host Option - Elevation of Privilege


Sudo chroot 1.9.17 - Local Privilege Escalation


tar-fs 3.0.0 - Arbitrary File Write/Overwrite


xglance-bin 11.00 - Privilege Escalation


Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)


AnyDesk 5.5.2 - Remote Code Execution


Apache CouchDB 3.2.1 - Remote Code Execution (RCE)


Apache James Server 2.3.2 - Insecure User Creation Arbitrary File Write (Metasploit)


Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)


Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution


ASTPP VoIP 4.0.1 - Remote Code Execution


Barco WePresent - file_transfer.cgi Command Injection (Metasploit)


crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow


CTROMS Terminal OS Port Portal - 'Password Reset' Authentication Bypass (Metasploit)


Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)


GNU gdbserver 9.2 - Remote Command Execution (RCE)


GNU Wget < 1.18 - Arbitrary File Upload (2)


HD-Network Real-time Monitoring System 2.0 - Local File Inclusion (LFI)


LBT-T300-mini1 - Remote Buffer Overflow


Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution


Mitel mitel-cs018 - Call Data Information Disclosure


Multiple DrayTek Products - Pre-authentication Remote Root Code Execution


Nagios XI - Authenticated Remote Command Execution (Metasploit)


netkit-telnet-0.17 telnetd (Fedora 31) - 'BraveStarr' Remote Code Execution


Nexus Repository Manager - Java EL Injection RCE (Metasploit)


OneTrust SDK 6.33.0 - Denial Of Service (DoS)


OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)


OpenSMTPD 6.6.1 - Remote Code Execution


OpenSMTPD 6.6.3 - Arbitrary File Read


OpenSSH server (sshd) 9.8p1 - Race Condition


Pachev FTP Server 1.0 - Path Traversal


Pandora FMS - Ping Authenticated Remote Code Execution (Metasploit)


ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)


Proxmox VE - TOTP Brute Force


Raspberry Pi 5.10 - Default Credentials


Rconfig 3.x - Chained Remote Code Execution (Metasploit)


Redis - Replication Code Execution (Metasploit)


ThinkPHP - Multiple PHP Injection RCEs (Metasploit)


uftpd 2.10 - Directory Traversal (Authenticated)


Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit)


vCloud Director 9.7.0.15498291 - Remote Code Execution


aaPanel 6.8.21 - Directory Traversal (Authenticated)


ASTPP 4.0.1 VoIP Billing - Database Backup Download


Aurba 501 - Authenticated RCE


BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution


BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution (PoC)


Boa Web Server v0.94.14 - Authentication Bypass


Cassandra Web 0.5.0 - Remote File Read


CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting (XSS)


Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)


Centos WebPanel 7 - 'term' SQL Injection


Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)


F-Secure Internet Gatekeeper 5.40 - Heap Overflow (PoC)


Mahara 19.10.2 CMS - Persistent Cross-Site Scripting


Metabase 0.46.6 - Pre-Auth Remote Code Execution


Nokia BMC Log Scanner - Remote Code Execution


Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion


Pi-hole 4.4.0 - Remote Code Execution (Authenticated)


Pi-hole < 4.4 - Authenticated Remote Code Execution


Pi-hole < 4.4 - Authenticated Remote Code Execution / Privileges Escalation


Raysync 3.3.3.8 - RCE


Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)


Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2)


ScadaBR 1.0 - Arbitrary File Upload (Authenticated) (2)


Selenium 3.141.59 - Remote Code Execution (Firefox/geckodriver)


TerraMaster TOS 4.2.06 - RCE (Unauthenticated)


TerraMaster TOS 4.2.06 - Unauthenticated Remote Code Execution (Metasploit)


Usermin 1.820 - Remote Code Execution (RCE) (Authenticated)


Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)


Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)


Webmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF)


Webmin 1.984 - Remote Code Execution (Authenticated)


Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)


ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)


ZeroShell 3.9.0 - Remote Command Execution


Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated)


D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)


TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)


Palo Alto PAN-OS  < v11.1.2-h3  - Command Injection and Arbitrary File Creation


Wing FTP Server 6.3.8 - Remote Code Execution (Authenticated)


Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service)


Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)


HospitalRun  1.0.0-beta - Local Root Exploit for macOS


Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)


MacOS 320.whatis Script - Privilege Escalation


macOS LaunchDaemon iOS 17.2 - Privilege Escalation


Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution


VMWare Fusion - Local Privilege Escalation


VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)


VMware Fusion 11.5.2 - Privilege Escalation


RoyalTSX 6.0.1 - RTSZ File Handling Heap Memory Corruption PoC


Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)


Apache Tomcat 10.1 - Denial Of Service


BIND - 'TSIG' Denial of Service


Elasticsearch - StackOverflow DoS


glFTPd 2.11a - Remote Denial of Service


Hasura GraphQL 1.3.3 - Denial of Service


iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()


jQuery UI 1.12.1 - Denial of Service (DoS)


KeePass 2.44 - Denial of Service (PoC)


macOS/iOS ImageIO - Heap Corruption when Processing Malformed TIFF Image


Nxlog Community Edition 2.10.2150 - DoS (Poc)


OpenPLC WebServer 3 - Denial of Service


ProFTPD 1.3.7a - Remote Denial of Service


Pure-FTPd 1.0.48 - Remote Denial of Service


Tautulli 2.1.9 - Denial of Service (Metasploit)


Wyrestorm Apollo VX20  < 1.3.58 - Incorrect Access Control 'DoS'


Xlight FTP 1.1 - Denial Of Service (DOS)


ABB Cylon Aspect 3.07.02 (userManagement.php) - Weak Password Policy


ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution


ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) - Stored Cross-Site Scripting


ABB Cylon Aspect 3.08.02 (licenseUpload.php) - Stored Cross-Site Scripting


ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution


ABB Cylon Aspect 3.08.02 - Cookie User Password Disclosure


ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)


ABB Cylon Aspect 3.08.02 - PHP Session Fixation


ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection


ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery


ABB Cylon FLXeon 9.3.4 - Default Credentials


ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)


ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)


ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure


ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning


Cosy+ firmware 21.2s7 - Command Injection


D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)


Netman 204 - Remote command without authentication


TOTOLINK N300RB 8.54 - Command Execution


ZTE ZXHN H168N 3.1 - Remote Code Execution (RCE) via authentication bypass


7-Zip 24.00 - Directory Traversal


A-PDF All to MP3 Converter 2.0.0 - DEP Bypass via HeapCreate + HeapAlloc


ABB Cylon Aspect Studio 3.08.03 - Binary Planting


Blink1Control2 2.2.7 - Weak Password Encryption


Chromium 83 - Full CSP Bypass


Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution


Counter Strike: GO - '.bsp' Memory Control (PoC)


Daikin Security Gateway  14 - Remote Password Reset


Docker Desktop 4.44.3 - Unauthenticated  API Exposure


Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution


ImageMagick 7.1.0-49 - Arbitrary File Read


is-localhost-ip 2.0.0 - SSRF


Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping


Lucee Scheduled Job v1.0 -  Command Execution


Mbed TLS 3.6.4 - Use-After-Free


Metasploit Framework 6.0.11 - msfvenom APK template command injection


Microsoft Defender for Endpoint (MDE) - Elevation of Privilege


Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing


Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure


Microsoft VSCode Python Extension - Code Execution


NetBT e-Fatura - Privilege Escalation


ollama 0.6.4 - Server Side Request Forgery (SSRF)


Parrot and DJI variants Drone OSes - Kernel Panic Exploit


PrusaSlicer 2.6.1 - Arbitrary code execution


qBittorrent 5.0.1 - MITM RCE


RDPGuard 9.9.9 - Privilege Escalation


SAP Lumira 1.31 - Stored Cross-Site Scripting


sleuthkit 4.11.1 - Command Injection


SmartFoxServer 2X 2.17.0 - Credentials Disclosure


SmartFoxServer 2X 2.17.0 - God Mode Console Remote Code Execution


Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1)


Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2)


Tibco ObfuscationEngine 5.11 - Fixed Key Password Decryption


TightVNC 2.8.83 - Control Pipe Manipulation


TP-Link VN020 F3v(T) TT_V6.2.1021) - DHCP Stack Buffer Overflow


vm2 - sandbox escape


Yank Note v3.52.1 (Electron) - Arbitrary Code Execution


zlog 1.2.15 - Buffer Overflow


ZTE ZXV10 H201L - RCE via authentication bypass


Zyxel USG FLEX H series uOS 1.31 - Privilege Escalation


ABB Cylon Aspect 3.08.03 - Guest2Root Privilege Escalation


ABB Cylon Aspect 3.08.04 DeploySource - Remote Code Execution (RCE)


Aerospike Database 5.1.0.3 - OS Command Execution


Akka HTTP 10.1.14 - Denial of Service


Angular-Base64-Upload Library 0.1.20 - Remote Code Execution (RCE)


Apache ActiveMQ 6.1.6 - Denial of Service (DOS)


Apache APISIX 2.12.1 - Remote Code Execution (RCE)


Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit)


Apache Solr - Remote Code Execution via Velocity Template (Metasploit)


Apache Struts 2.5.20 - Double OGNL evaluation


Apache Tomcat 10.1.39 - Denial of Service (DoS)


Asterisk AMI - Partial File Content & Path Disclosure (Authenticated)


Automic Agent 24.3.0 HF4 - Privilege Escalation


Azure Apache Ambari 2302250400 - Spoofing


Belkin F9K1009 F9K1010 2.00.04/2.00.09 - Hard Coded Credentials


Broadcom Wi-Fi Devices - 'KR00K Information Disclosure


Cisco ISE 3.0 - Authorization Bypass


Cisco ISE 3.0 - Remote Code Execution (RCE)


Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure


ClipBucket 5.5.0 - Arbitrary File Upload


ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)


ConnectWise Control 19.2.24707 - Username Enumeration


CrushFTP 11.3.1 - Authentication Bypass


CrushFTP < 11.1.0 - Directory Traversal


CyberArk PSMP 10.9.1 - Policy Restriction Bypass


Docker based datastores for IBM Instana 241-2 243-0 - No Authentication


Erlang Cookie - Remote Code Execution


Executables Created with perl2exe < V30.10C - Arbitrary Code Execution


EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)


F5 BIG-IP 16.0.x - Remote Code Execution (RCE)


Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution


Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)


FortiOS SSL-VPN 7.4.4 - Insufficient Session Expiration & Cookie Reuse


Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass


Freefloat FTP Server 1.0 - Remote Buffer Overflow


GestioIP 3.5.7 - Cross-Site Request Forgery (CSRF)


GestioIP 3.5.7 - Cross-Site Scripting (XSS)


GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)


GestioIP 3.5.7 - Remote Command Execution (RCE)


GestioIP 3.5.7 - Stored Cross-Site Scripting (Stored XSS)


gogs 0.13.0 - Remote Code Execution (RCE)


Google Chrome 67_ 68 and 69 - Object.create Type Confusion (Metasploit)


Google Chrome 72 and 73 - Array.map Out-of-Bounds Write (Metasploit)


Google Chrome 78.0.3904.70 - Remote Code Execution


Google Chrome 80 - JSCreate Side-effect Type Confusion (Metasploit)


Google Chrome 81.0.4044 V8 - Remote Code Execution


Google Chrome 86.0.4240 V8 - Remote Code Execution


Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow


Grandstream GSD3710 1.0.11.13 - Stack Overflow


Hashicorp Consul v1.0 - Remote Command Execution (RCE)


HFS Http File Server 2.3m Build 300 - Buffer Overflow (PoC)


HP LinuxKI 6.01 - Remote Command Injection


HTMLDOC 1.9.13 - Stack Buffer Overflow


HTTP/2 2.0 - Denial Of Service (DOS)


IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)


IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)


InfluxDB OSS 2.7.11 - Operator Token Privilege Escalation


Ingress-NGINX 4.11.0 - Remote Code Execution (RCE)


Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE


Invision Community 5.0.6 - Remote Code Execution (RCE)


Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)


Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)


Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass


K7 Ultimate Security K7RKScan.sys 17.0.2019 - Denial Of Service (DoS)


Ksix Zigbee Devices - Playback Protection Bypass (PoC)


Langflow 1.3.0 -  Remote Code Execution (RCE)


ManageEngine Desktop Central - Java Deserialization (Metasploit)


McAfee Agent 5.7.6 - Insecure Storage of Sensitive Information


Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)


Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE)


Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)


Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.


Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing


Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution


Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)


MikroTik RouterOS 7.19.1 - Reflected XSS


Nginx 1.20.0 - Denial of Service (DOS)


nostromo 1.9.6 - Remote Code Execution


Opmon 9.11 - Cross-site Scripting


PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)


PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated)


PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)


PX4 Military UAV Autopilot 1.12.3 - Denial of Service (DoS)


python jsonpickle 2.0.0 - Remote Code Execution


Qmail SMTP 1.03 - Bash Environment Variable Injection


Saltstack 3000.1 - Remote Code Execution


SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)


SAP NetWeaver - 7.53 - HTTP Request Smuggling


ScriptCase 9.12.006 (23) - Remote Command Execution (RCE)


SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal


Sony XAV-AX5500 1.13 - Firmware Update Validation Remote Code Execution (RCE)


SOS JobScheduler 1.13.3 - Stored Password Decryption


Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)


Swagger UI 1.0.3 - Cross-Site Scripting (XSS)


Tdarr 2.00.15 - Command Injection


Teleport v10.1.1 - Remote Code Execution (RCE)


Tenda AC20 16.03.08.12 - Command Injection


Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow


Tigo Energy Cloud Connect Advanced (CCA) 4.0.1 - Command Injection


TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption


TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)


Vite 6.2.2 - Arbitrary File Read


VMware Cloud Director 10.5 - Bypass identity verification


vsftpd 3.0.3 - Remote Denial of Service


WebLogic Server - Deserialization RCE - BadAttributeValueExpException (Metasploit)


Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execution  (RCE)


Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration


Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure'


X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)


ABB Cylon Aspect 3.07.02 - File Disclosure


ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)


ABB Cylon Aspect 3.08.03 (MapServicesHandler) - Authenticated Reflected XSS


ABB Cylon Aspect 3.08.03 - Hard-coded Secrets


Academy-LMS 4.3 - Stored XSS


Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR)


Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)


Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)


Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF


Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS)


Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE)


Adobe ColdFusion 2023.6 - Remote File Read


Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read


Adobe Connect 10 - Username Disclosure


Adobe Connect 11.4.5 - Local File Disclosure


Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)


Anchor CMS 0.12.7 - 'markdown' Stored Cross-Site Scripting


Anchor CMS 0.12.7 - CSRF (Delete user)


Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)


Anote 1.0 - Persistent Cross-Site Scripting


Antminer Monitor 0.5.0 - Authentication Bypass


Apache 2.4.x - Buffer Overflow


Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution


Apache Commons Text  1.10.0 - Remote Code Execution


Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)


Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)


Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2)


Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)


Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service


Apache Superset 1.1.0 - Time-Based Account Enumeration


Apache Superset 2.0.0 - Authentication Bypass


Apache Tomcat - AJP 'Ghostcat File Read/Inclusion


Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Metasploit)


Apache Tomcat 11.0.3 - Remote Code Execution


Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)


Apache Tomcat 9.0.0.M1 - Open Redirect


Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Add Artwork


Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile


ASP.net  8.0.10 - Bypass


atjiu pybbs 6.0.0 - Cross Site Scripting (XSS)


Atlassian Confluence < 8.5.3 - Remote Code Execution


Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit)


Atlassian Confluence Widget Connector Macro - SSTI


Atlassian JIRA 8.11.1 - User Enumeration


Atlassian Jira 8.15.0 - Information Disclosure (Username Enumeration)


Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read


Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS


Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)


Avaya IP Office 11 - Password Disclosure


Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS


B-swiss 3 Digital Signage System 3.6.5 -  Database Disclosure


B-swiss 3 Digital Signage System 3.6.5 - Cross-Site Request Forgery (Add Maintenance Admin)


B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution


Bagisto 1.3.3 - Client-Side Template Injection


Baixar GLPI Project 9.4.6 - SQLi


Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting


BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)


BigAnt Office Messenger 5.6.06 - SQL Injection


BigBlueButton 2.2.25 - Arbitrary File Disclosure and Server-Side Request Forgery


Bio Star 2.8.2 - Local File Inclusion


Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure


Blitar Tourism 1.0 - Authentication Bypass SQLi


Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation


Bludit 3.9.2 - Directory Traversal


Bookwyrm v0.4.3 - Authentication Bypass


Boss Mini v1.4.0 - Local File Inclusion (LFI)


Broken Access Control - on NodeBB v3.6.7


BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation


BSA Radar 1.6.7234.24750 - Local File Inclusion


BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting


BTCPay Server v1.7.4 - HTML Injection


Cabot 0.11.12 - Persistent Cross-Site Scripting


Cacti 1.2.8 - Authenticated Remote Code Execution


Cacti 1.2.8 - Unauthenticated Remote Code Execution


Calibre-web 0.6.21 - Stored XSS


Campcodes Online Hospital Management System 1.0 - SQL Injection


Casdoor 1.13.0 - SQL Injection (Unauthenticated)


Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)


Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)


Cayin Content Management Server 11.0 - Remote Command Injection (root)


Cayin Digital Signage System xPost 2.5 - Remote Command Injection


Cayin Signage Media Player 3.0 - Remote Command Injection (root)


Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)


Chained Quiz  1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie


changedetection < 0.45.20 - Remote Code Execution (RCE)


Chevereto 3.17.1 - Cross Site Scripting (Stored)


ChurchCRM 4.2.0 - CSV/Formula Injection


ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)


ChurchRota 2.6.4 - RCE (Authenticated)


Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration


Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover


Citadel WebCit < 926 - Session Hijacking Exploit


Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal


Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution


Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC)


Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit)


Click2Magic 1.1.5 - Stored Cross-Site Scripting


Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)


CMDBuild 3.3.2 - 'Multiple' Cross Site Scripting (XSS)


CMU CERT/CC VINCE 2.0.6 - Stored XSS


Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection


Cockpit Version 234 - Server-Side Request Forgery (Unauthenticated)


Codiad 2.8.4 - Remote Code Execution (Authenticated)


Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)


Codiad 2.8.4 - Remote Code Execution (Authenticated) (3)


Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)


Comodo Unified Threat Management Web Console 2.7.0 - Remote Code Execution


compop.ca 3.5.3 - Arbitrary code Execution


Concrete CMS 9.4.3 - Stored XSS


Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)


CourseMS 2.1 - 'name' Stored XSS


Covenant v0.5 - Remote Code Execution (RCE)


craftercms 4.x.x - CORS


Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass


CyberPanel 2.1 - Remote Code Execution (RCE) (Authenticated)


CyberPanel 2.3.6 - Remote Code Execution (RCE)


Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)


Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)


D-Link DIR-650IN - Authenticated Command Injection


Discourse 3.1.1 - Unauthenticated Chat Message Access


Discourse 3.2.x - Anonymous Cache Poisoning


Django 5.1.13 - SQL Injection


DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF)


Docsify.js 4.11.4 - Reflective Cross-Site Scripting


DotCMS 20.11 - Stored Cross-Site Scripting


dotCMS 25.07.02-1 - Authenticated Blind SQL Injection


Dreamer CMS v4.0.0 - SQL Injection


DzzOffice 2.02.1 - 'Multiple' Cross-Site Scripting (XSS)


Easy File Sharing Web Server v7.2 - Buffer Overflow


Easywall 0.3.1 - Authenticated Remote Command Execution


EgavilanMedia Address Book 1.0 Exploit - SQLi Auth Bypass


EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF


EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Persistent Cross-Site Scripting


EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Stored Cross Site Scripting


Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal


ElasticSearch 7.13.3 - Memory disclosure


Elasticsearch ECE 7.13.3 - Anonymous Database Dump


ELEX WooCommerce WordPress Plugin 1.4.3 - SQL Injection


Employee Record Management System 1.1 - Login Bypass SQL Injection


Ericom Access Server x64 9.2.0 - Server-Side Request Forgery


Ericsson Network Location MPS GMPC21 - Privilege Escalation (Metasploit)


Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit)


ERPNext 12.14.0 - SQL Injection (Authenticated)


esm-dev 136 - Path Traversal


EspoCRM 5.8.5 - Privilege Escalation


Ethercreative Logs 3.0.3 - Path Traversal


Exclusive Addons for Elementor 2.6.9 - Stored Cross-Site Scripting (XSS)


Expense Management System - 'description' Stored Cross Site Scripting


ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow


EyesOfNetwork 5.3 - File Upload Remote Code Execution


EyesOfNetwork 5.3 - LFI


EyesOfNetwork 5.3 - RCE & PrivEsc


FIBARO System Home Center 5.021 - Remote File Include


FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)


FileMage Gateway 1.10.9 - Local File Inclusion


FileRun 2019.05.21 -  Reflected Cross-Site Scripting


FLEX 1085 Web 1.6.0 - HTML Injection


Flexmonster Pivot Table & Charts 2.7.17 - 'Remote JSON' Reflected XSS


Flexmonster Pivot Table & Charts 2.7.17 - 'Remote Report' Reflected XSS


Flexmonster Pivot Table & Charts 2.7.17 - 'To OLAP' Reflected XSS


Flexmonster Pivot Table & Charts 2.7.17 - 'To remote CSV' Reflected XSS


Flowise 3.0.4 - Remote Code Execution (RCE)


Fluig 1.7.0 - Path Traversal


Forcepoint WebSecurity 8.5 - Reflective Cross-Site Scripting


FormaLMS 2.4.4 - Authentication Bypass


FortiLogger 4.4.2.2 - Unauthenticated Arbitrary File Upload (Metasploit)


Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)


Fortinet FortiWeb v8.0.1 - Auth Bypass


FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass


FortiWeb  8.0.2 - Remote Code Execution


FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution


FoxCMS 1.2.5 - Remote Code Execution  (RCE)


FreeBSD rtsold 15.x - Remote Code Execution via DNSSL


Freeter 1.2.1 - Persistent Cross-Site Scripting


FuguHub 8.1 - Remote Code Execution


FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)


Gandia Integra Total 4.4.2236.1 - SQL Injection


Garage Management System 1.0 (categoriesName) - Stored XSS


Geonetwork 4.2.0 - XML External Entity (XXE)


GeoVision GV-ASManager 6.1.0.0  - Information Disclosure


GeoVision GV-ASManager 6.1.0.0 - Broken Access Control


GeoVision GV-ASManager 6.1.1.0 - CSRF


GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated)


Ghost CMS 5.42.1 - Path Traversal


Ghost CMS 5.59.1 - Arbitrary File Read


Gitea 1.12.5 - Remote Code Execution (Authenticated)


Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)


Gitea 1.22.0 - Stored XSS


Gitea 1.24.0 - HTML Injection


Gitea 1.7.5 - Remote Code Execution


GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities


Google Invisible RECAPTCHA 3 - Spoof Bypass


Grafana 11.6.0 - SSRF


Grafana 8.3.0 - Directory Traversal and Arbitrary File Read


Grocery crud 1.6.4 - 'order_by' SQL Injection


Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control


Hasura GraphQL 1.3.3 - Local File Read


Hasura GraphQL 1.3.3 - Remote Code Execution


Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)


Hasura GraphQL 2.2.0 - Information Disclosure


Horde Groupware Webmail 5.2.22 - Stored XSS


HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities


htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)


Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation


i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw


IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow


IBMi Navigator 7.5 -  HTTP Security Token Bypass


IBMi Navigator 7.5 - Server Side Request Forgery (SSRF)


iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)


ILIAS Learning Management System 4.3 - SSRF


ImportExportTools NG 10.0.4 - HTML Injection


In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection


IncomCMS 2.0 - Insecure File Upload


INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution


Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)


Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting


Invision Community 4.7.20 - (calendar/view.php) SQL Injection


IPeakCMS 3.5 - Boolean-based blind SQLi


Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)


Ivanti vADC 9.9 - Authentication Bypass


Jasmin Ransomware - Arbitrary File Download (Authenticated)


Jenzabar 9.2.2 - 'query' Reflected XSS.


JetBrains TeamCity 2023.11.4 - Authentication Bypass


Joplin 1.0.245 - Arbitrary Code Execution (PoC)


Joplin 1.2.6 - 'link' Cross Site Scripting


Joplin Desktop 1.0.184 - Cross-Site Scripting


jQuery 1.0.3 - Cross-Site Scripting (XSS)


jQuery 1.2 - Cross-Site Scripting (XSS)


jQuery 3.3.1 - Prototype Pollution & XSS Exploit


Jumbo Website Manager  - Remote Code Execution


Kentico Xperience 13.0.178 - Cross Site Scripting (XSS)


KONGA 0.14.9 - Privilege Escalation


KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)


Kubio AI Page Builder 2.5.1 - Local File Inclusion (LFI)


Langflow 1.2.x - Remote Code Execution (RCE)


Lantronix Provisioning Manager 7.10.3 - XML External Entity Injection (XXE)


Latrix 0.6.0 - 'txtaccesscode' SQL Injection


LibreNMS 1.46 - 'search' SQL Injection


LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection


LifeRay 7.2.1 GA2 - Stored XSS


LightCMS 1.3.4 - 'exclusive' Stored XSS


Liman 0.7 - Cross-Site Request Forgery (Change Password)


Lingdang CRM 8.6.4.7 - SQL Injection


Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass


Logitech Media Server 8.2.0 - 'Title' Cross-Site Scripting (XSS)


LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)


LPAR2RRD 8.04 - Remote Code Execution (RCE)


Lucee 5.4.2.17 - Authenticated Reflected XSS


M/Monit 3.7.4 - Password Disclosure


M/Monit 3.7.4 - Privilege Escalation


Magento ver. 2.4.6 - XSLT Server Side Injection


MagnusSolution magnusbilling 7.3.0 - Command Injection


mailcow 2025-01a - Host Header Password Reset Poisoning


Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)


ManageEngin AMP 4.3.0 - File-path-traversal


ManageEngine ADSelfService Plus 6.1 - CSV Injection


MaNGOSWebV4  4.0.6 - Reflected XSS


Markdown Explorer 0.1.1 - Persistent Cross-Site Scripting


Markdownify 1.2.0 - Persistent Cross-Site Scripting


Markright 1.0 - Persistent Cross-Site Scripting


Marky 0.0.1 - Persistent Cross-Site Scripting


Mezzanine CMS 6.1.0 - Stored Cross Site Scripting (XSS)


Microsoft SharePoint Enterprise Server 2016 - Spoofing


Mida eFramework 2.9.0 - Remote Code Execution


MiniWeb HTTP Server 0.8.19 - Buffer Overflow (PoC)


Moeditor 0.2.0 - Persistent Cross-Site Scripting


mojoPortal forums 2.7.0.0 - 'Title' Persistent Cross-Site Scripting


Monica 2.19.1 - 'last_name' Stored XSS


Moodle 4.4.0 - Authenticated Remote Code Execution


motionEye 0.43.1b4 - RCE


MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)


Mumara Classic 2.93 - 'license' SQL Injection (Unauthenticated)


myfactory FMS 7.1-911 - 'Multiple' Reflected Cross-Site Scripting (XSS)


Nagios Log Server 2.1.6 - Persistent Cross-Site Scripting


Nagios Log Server 2.1.7 - Persistent Cross-Site Scripting


Nagios Log Server 2024R1.3.1 - API Key Exposure


Nagios Log Server 2024R1.3.1 - Stored XSS


Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE)


Nagios XI Version 2024R1.01 - SQL Injection


Netsia SEBA+ 0.16.1 - Add Root User (Metasploit)


Newgen Correspondence Management System (corms) eGov 12.0 - IDOR


NewsLister - Authenticated Persistent Cross-Site Scripting


Next.js Middleware 15.2.2 -  Authorization Bypass


NodeBB Forum 1.12.2-1.14.2 - Account Takeover


NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write


NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection


nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting


NoteMark < 0.13.0 - Stored XSS


OCS Inventory NG 2.7 - Remote Code Execution


OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)


OctoPrint 1.11.2 - File Upload


Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection


Odoo 12.0 - Local File Inclusion


Online News Portal System 1.0 - 'Title' Stored Cross Site Scripting


Online Voting System Project in PHP - 'username' Persistent Cross-Site Scripting


Open Game Panel - Remote Code Execution (RCE) (Authenticated)


OpenCTI 3.3.1 - Directory Traversal


OpenEDX platform Ironwood 2.5 - Remote Code Execution


Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting


Openlitespeed Web Server 1.7.8 - Command Injection (Authenticated) (1)


Openlitespeed WebServer 1.7.8 - Command Injection (Authenticated) (2)


openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting


OpenPanel 0.3.4 - Directory Traversal


OpenPanel 0.3.4 - Incorrect Access Control


OpenPanel 0.3.4 - OS Command Injection


OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal


OpenText Content Server 20.3 - 'multiple' Stored Cross-Site Scripting


OPSWAT Metadefender Core - Privilege Escalation


Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS


Oracle Fatwire 6.3 - Multiple Vulnerabilities


orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting (XSS) (Authenticated)


orangescrum 1.8.0 - 'Multiple' SQL Injection (Authenticated)


orangescrum 1.8.0 - Privilege escalation (Authenticated)


OSGi v3.7.2 (and below) Console - RCE


OSGi v3.8-3.18 Console - RCE


Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)


Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)


Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover


PaperCut NG/MG 22.0.4 - Authentication Bypass


PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)


Payara Micro Community 5.2021.6 - Directory Traversal


Pega Platform 8.1.0 - Remote Code Execution (RCE)


perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)


perfSONAR v4.4.5 - Partial Blind CSRF


PESCMS TEAM 2.3.2 - Multiple Reflected XSS


phpMyFAQ  3.1.7 - Reflected Cross-Site Scripting (XSS)


phpPgAdmin 7.13.0 - COPY FROM PROGRAM Command Execution (Authenticated)


Phpscript-sgh 0.1.0 - Time Based Blind SQL Injection


Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE


Pimcore 11.4.2 - Stored cross site scripting


Pimcore customer-data-framework 4.2.0 -  SQL injection


Piranha CMS 12.0 - Stored XSS in Text Block


PivotX 3.0.0 RC3 - Remote Code Execution (RCE)


Pixelimity 1.0 - 'password' Cross-Site Request Forgery


Plane 0.23.1 - Server side request forgery (SSRF)


Plastic SCM 10.0.16.5622 - WebAdmin Server Access


Plone CMS 5.2.3 - 'Title' Stored XSS


Postbird 0.8.4 - Javascript Injection


ProcessMaker 3.5.4 - Local File inclusion


ProConf 6.0 -  Insecure Direct Object Reference (IDOR)


Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass


projectworlds Online Admission System 1.0 - SQL Injection


Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE)


Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE)


qdPM < 9.1 - Remote Code Execution


React Server 19.2.0 - Remote Code Execution


Real Web Pentesting Tutorial Step by Step - [Persian]


reNgine 2.2.0 - Command Injection (Authenticated)


RiteCMS 3.0.0 - Reflected Cross Site Scripting (XSS)


RiteCMS 3.1.0 - Authenticated Remote Code Execution


RomM  4.4.0 -  XSS_CSRF Chain


Roundcube 1.6.10 - Remote Code Execution (RCE)


Royal Elementor Addons and Templates 1.3.78 - Unauthenticated Arbitrary File Upload


RPi-Jukebox-RFID 2.8.0 - Remote Command Execution


RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)


RSA IG&L Aveksa 7.1.1 - Remote Code Execution


Rumble Mail Server 0.51.3135 - 'domain and path' Stored XSS


Rumble Mail Server 0.51.3135 - 'servername' Stored XSS


Rumble Mail Server 0.51.3135 - 'username' Stored XSS


RWS WorldServer 11.7.3 - Session Token Enumeration


Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)


Schlix CMS 2.2.6-6 - Arbitary File Upload (Authenticated)


Schlix CMS 2.2.6-6 - Remote Code Execution (Authenticated)


SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)


Scratch Desktop 3.17 - Remote Code Execution


Seacms 11.1 - 'checkuser' Stored XSS


Seacms 11.1 - 'file' Local File Inclusion


Seacms 11.1 - 'ip and weburl' Remote Command Execution


Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)


Selea CarPlateServer (CPS) 4.0.1.6 - Remote Program Execution


ServiceNow - Username Enumeration


ServiceNow Multiple Versions - Input Validation & Template Injection


Servisnet Tessa - Add sysAdmin User (Unauthenticated) (Metasploit)


Servisnet Tessa - MQTT Credentials Dump (Unauthenticated) (Metasploit)


Servisnet Tessa - Privilege Escalation (Metasploit)


Setelsa Conacwin 3.7.1.2 - Local File Inclusion


Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)


Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)


Siklu EtherHaul Series EH-8010 - Arbitrary File Upload


Siklu EtherHaul Series EH-8010 - Remote Command Execution


SilverStripe 5.3.8  - Stored Cross Site Scripting (XSS) (Authenticated)


Simple File List WordPress Plugin 4.2.2 - File Upload to RCE


Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)


SISQUALWFM 7.1.319.103 - Host Header Injection


Sitecore 10.4 - Remote Code Execution (RCE)


Sitefinity 15.0 - Cross-Site Scripting (XSS)


Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI


SmartAgent 3.1.0 - Privilege Escalation


SmarterMail 16 - Arbitrary File Upload


SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS


SnipCommand 0.1.0 - Persistent Cross-Site Scripting


SnipeIT 6.2.1 - Stored Cross Site Scripting


Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)


Socket.io-file 2.0.31 - Arbitrary File Upload


Solar-Log 500 2.8.2 - Incorrect Access Control


Solar-Log 500 2.8.2 - Unprotected Storage of Credentials


SolarWinds Platform 2024.1 SR1 - Race Condition


Sonatype Nexus Repository 3.53.0-01 - Path Traversal


Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure


SonLogger 4.2.3.3 - Unauthenticated Arbitrary File Upload (Metasploit)


Soosyze CMS 2.0 - Brute Force Login


Sophos VPN Web Panel 2020 - Denial of Service (Poc)


SpamTitan 7.07 - Remote Code Execution (Authenticated)


Splunk 9.0.4 - Information Disclosure


Splunk 9.0.5 - admin account take over


Spotweb 1.4.9 - 'search' SQL Injection


Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)


SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS)


Stacks Mobile App Builder 5.2.3 - Authentication Bypass via Account Takeover


StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload


Strapi 3.0.0-beta - Set Password (Unauthenticated)


Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)


Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)


Student Result Management System 1.0 - Authentication Bypass SQL Injection


StudyMD 0.3.2 - Persistent Cross-Site Scripting


SugarCRM 14.0.0 - SSRF/Code Injection


Summar Employee Portal  3.98.0 - Authenticated SQL Injection


Suprema BioStar 2 v2.8.16 - SQL Injection


SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration


SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation


Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)


Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)


Sysax MultiServer 6.90 - Reflected Cross Site Scripting


T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)


T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)


T-Soft E-Commerce 4 - SQLi (Authenticated)


Tagstoo 2.0.1 - Persistent Cross-Site Scripting


Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)


Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)


Tendenci 12.3.1 - CSV/ Formula Injection


Testa Online Test Management System 3.4.7 - 'q' SQL Injection


TestBox CFML Test Framework 4.1.0 - Arbitrary File Write and Remote Code Execution


TestBox CFML Test Framework 4.1.0 - Directory Traversal


Thinfinity VirtualUI  2.5.26.2 - Information Disclosure


Thinfinity VirtualUI 2.5.41.0  - IFRAME Injection


ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)


ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)


Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)


Touchbase.io 1.10 - Stored Cross Site Scripting


Tourism Management System 2.0 - Arbitrary Shell Upload


Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 - Remote Code Execution (Metasploit)


UJCMS 9.6.3 - User Enumeration via IDOR


Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation


UNA CMS 14.0.0-RC - PHP Object Injection


Under Construction Page with CPanel 1.0 - SQL injection


Usermin 2.100 - Username Enumeration


Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution (Metasploit)


VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS


VestaCP 0.9.8 - 'v_sftp_licence' Command Injection


VestaCP 0.9.8 - File Upload CSRF


VestaCP 0.9.8-26 - 'backup' Information Disclosure


VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation


Vianeos OctoPUS 5 - 'login_user' SQLi


Virtual Reception v1.0 - Web Server Directory Traversal


Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)


VMware vCenter Server 6.7 - Authentication Bypass


VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated)


VMware vCenter Server 7.0 - Unauthenticated File Upload


VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)


VTENEXT 19 CE - Remote Code Execution


Watcharr 1.43.0 - Remote Code Execution (RCE)


WBCE CMS 1.6.3 - Authenticated Remote Code Execution (RCE)


WBCE CMS 1.6.4 - Remote Code Execution


WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)


WebDamn User Registration & Login System with User Panel - SQLi Auth Bypass


WebFileSys 2.31.0 - Directory Path Traversal


WebPort 1.19.1 - Reflected Cross-Site Scripting


Webrun 3.6.0.42 - 'P_0' SQL Injection


WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting


WhatsUp Gold 2022 (22.1.0 Build 39) - XSS


WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)


White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)


Wing FTP Server 6.2.5 - Privilege Escalation


Wondercms 4.3.2 - XSS to RCE


WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection


WordPress  Madara - Local File Inclusion


WordPress Backup Migration 1.3.7 - Remote Command Execution


WordPress Depicter Plugin 3.6.1 - SQL Injection


WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing


WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation


WordPress Plugin  5.2.0 - Broken Access Control


Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)


WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting (Authenticated)


WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download


WordPress Quiz Maker 6.7.0.56 - SQL Injection


WordPress User Registration & Membership Plugin 4.1.1 - Unauthenticated Privilege Escalation


WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass


WP Publications WordPress Plugin 1.2 - Stored XSS


WPanel 4.3.1 - Remote Code Execution (RCE) (Authenticated)


Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)


Xinet Elegant 6 Asset Lib Web UI 6.1.655 - SQL Injection


Xmind 2020 - Persistent Cross-Site Scripting


xuucms 3 - 'keywords' SQL Injection


XWiki 14 - SQL Injection via getdeleteddocuments.vm


Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)


XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)


XWiki Platform 15.10.10 - Remote Code Execution


YesWiki 4.5.1 - Unauthenticated Path Traversal


YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)


ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)


Zhiyuan OA - arbitrary file upload leading


Zohocorp ManageEngine ADManager Plus 7210 - Elevation of Privilege


Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)


unzip-stream 0.3.1 - Arbitrary File Write


NodeJS 24.x - Path Traversal


Node.JS - 'node-serialize' Remote Code Execution (2)


Node.JS - 'node-serialize' Remote Code Execution (3)


Numbas < v7.3 - Remote Code Execution


Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)


OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution


OpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Execution


OTRS 6.0.1 - Remote Command Execution (2)


Thruk Monitoring Web Interface 3.06 - Path Traversal


Webmin Usermin 2.100 - Username Enumeration


ImageMagick 7.1.0-49 - DoS


WordPress Plugin WPGraphQL 1.3.5 - Denial of Service


ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution


ABB Cylon Aspect 3.08.02 (escDevicesUpdate.php) - Denial of Service (DOS)


ABB Cylon Aspect 3.08.02 (ethernetUpdate.php)  - Authenticated Path Traversal


ABB Cylon Aspect 3.08.02 (webServerUpdate.php) - Input Validation Config Poisoning


ABB Cylon Aspect 3.08.03 (webServerDeviceLabelUpdate.php)  - File Write DoS


ABB Cylon Aspect 4.00.00 (factorySaved.php) - Unauthenticated XSS


ABB Cylon Aspect 4.00.00 (factorySetSerialNum.php) - Remote Code Execution


PHP 7.0 < 7.4 (Unix) - 'debug_backtrace' disable_functions Bypass


AC Repair and Services System v1.0 - Multiple SQL Injection


Blood Bank & Donor Management System using v2.2 - Stored XSS


code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)


Enrollment System v1.0 - SQL Injection


Equipment Rental Script-1.0 - SQLi


FAQ Management System v1.0 - 'faq' SQL Injection


Flashcard Quiz App v1.0 - 'card' SQL Injection


Petrol Pump Management Software v.1.0 - SQL Injection


Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file


Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting


Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload


PHP-FPM - Underflow Remote Code Execution (Metasploit)


PHPMyAdmin 3.0 - Bruteforce Login Bypass


PHPStudy - Backdoor Remote Code execution (Metasploit)


Pi-Hole - heisenbergCompensator Blocklist OS Command Execution (Metasploit)


PlaySMS - index.php Unauthenticated Template Injection Code Execution (Metasploit)


Real Estate Management System v1.0 - Remote Code Execution via File Upload


Simple Inventory Management System v1.0 - 'email' SQL Injection


Simple Student Attendance System v1.0 -  'classid' Time Based Blind & Union Based SQL Injection


Simple Student Attendance System v1.0 - Time Based Blind SQL Injection


WonderCMS 3.4.2 - Remote Code Execution (RCE)


'customhs_js_content' - 'customhs_js_content' Cross-Site Request Forgery


101 News 1.0 - Multiple-SQLi


4images 1.8 - 'limitnumber' SQL Injection (Authenticated)


4Images 1.8 - 'redirect' Reflected XSS


4images 1.9 - Remote Command Execution (RCE)


4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting


60CycleCMS - 'news.php' SQL Injection


Abantecart v1.3.2 - Authenticated Remote Code Execution


ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials


ABB Cylon Aspect 3.08.01 - Arbitrary File Delete


Academy LMS 6.0 - Reflected XSS


Academy LMS 6.1 - Arbitrary File Upload


Academy LMS 6.2 - SQL Injection


Accounting Journal Management System 1.0 - 'id' SQLi (Authenticated)


Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities


addressbook 9.0.0.1 - 'id' SQL Injection


Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting


Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)


Adive Framework 2.0.8 - Persistent Cross-Site Scripting


Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure


Admidio v4.2.10 - Remote Code Execution (RCE)


admidio v4.2.5 - CSV Injection


AdminLTE PiHole 5.18 - Broken Access Control


Advanced Comment System 1.0 - 'ACS_path' Path Traversal


Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)


Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site Scripting (XSS) (Authenticated)


Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)


AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability.


AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS)


Aero CMS v0.0.1 - PHP Code Injection (auth)


Aero CMS v0.0.1 - SQL Injection (no auth)


Aero CMS v0.0.1 - SQLi


Affiliate Me Version 5.0.1 - SQL Injection


Affiliate Pro 1.7 - 'Multiple' Cross Site Scripting (XSS)


Agilebio Lab Collector Electronic Lab Notebook  v4.234 - Remote Code Execution (RCE)


Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection


Air Cargo Management System v1.0 - SQLi


Akaunting 3.1.8 - Server-Side Template Injection (SSTI)


Akaunting < 3.1.3 - RCE


Alfresco 5.2.4 - Persistent Cross-Site Scripting


Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution (File Upload + SQL injection)


AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)


Alumni Management System 1.0 - _Course Form_ Stored XSS


Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS


Alumni Management System 1.0 - 'id' SQL Injection


Alumni Management System 1.0 - Authentication Bypass


Alumni Management System 1.0 - Unrestricted File Upload To RCE


AmazCart CMS 3.4 - Cross-Site-Scripting (XSS)


AMSS++ 4.7 - Backdoor Admin Account


AMSS++ v 4.31 - 'id' SQL Injection


Anchor CMS 0.12.7 - Persistent Cross-Site Scripting (Authenticated)


Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS)


Anuko Time Tracker - SQLi (Authenticated)


Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality


Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover


Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection


Apache mod_proxy_cluster 1.2.6 - Stored XSS


Apartment Visitor Management System (AVMS) 1.0 - 'username' SQL Injection


Apartment Visitors Management System 1.0 - 'email' SQL Injection


Apartment Visitors Management System 1.0 - Authentication Bypass


appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated)


AquilaCMS 1.409.20 - Remote Command Execution (RCE)


Art Gallery Management System Project in PHP v 1.0 - SQL injection


Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)


Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated


Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated


Artica Proxy 4.50 - Remote Code Execution (RCE)


Artworks Gallery Management System 1.0 - 'id' SQL Injection


Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)


Atom CMS 2.0 - Remote Code Execution (RCE)


Atom CMS v2.0 - SQL Injection (no auth)


atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE


Attendance and Payroll System v1.0 - Remote Code Execution (RCE)


Attendance and Payroll System v1.0 - SQLi Authentication Bypass


ATutor 2.2.4 - 'id' SQL Injection


Aures Booking & POS Terminal - Local Privilege Escalation


Auto Dealer Management System 1.0 - Broken Access Control Exploit


Auto Dealer Management System v1.0 - SQL Injection


Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php


Auto Dealer Management System v1.0 - SQL Injection on manage_user.php


Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)


Automatic-Systems SOC FL9600 FastLine - Directory Transversal


Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin


Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS)


Axigen < 10.5.7 - Persistent Cross-Site Scripting


Azon Dominator Affiliate Marketing Script - SQL Injection


b2evolution 6.11.6 - 'plugin name' Stored XSS


b2evolution 6.11.6 - 'redirect_to' Open Redirect


b2evolution 6.11.6 - 'tab3' Reflected XSS


b2evolution 7-2-2 - 'cf_name' SQL Injection


b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)


Baby Care System 1.0 - 'Post title' Stored XSS


Baby Care System 1.0 - 'roleid' SQL Injection


Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF)


Backdrop CMS 1.23.0 - Stored XSS


Backdrop CMS 1.27.1 - Authenticated Remote Command Execution (RCE)


Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS)


Backup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload


Balbooa Joomla Forms Builder 2.0.6 - SQL Injection (Unauthenticated)


Bang Resto v1.0 - 'Multiple' SQL Injection


Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)


Bangresto 1.0 - SQL Injection


Bank Locker Management System - SQL Injection


Barangay Management System 1.0 - Authentication Bypass


Barcodes generator 1.0 - 'name' Stored Cross Site Scripting


Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)


Basic Shopping Cart 1.0 - Authentication Bypass


Batflat CMS 1.3.6 - 'multiple' Stored XSS


Batflat CMS 1.3.6 - Remote Code Execution (Authenticated)


Beauty Parlour Management System 1.0 - 'sername' SQL Injection


Beauty Parlour Management System 1.0 - Authentication Bypass


Beauty Salon Management System v1.0 - SQLi


Beauty-salon v1.0 - Remote Code Execution (RCE)


Beehive Forum - Account Takeover


berliCRM 1.0.24 - 'src_record' SQL Injection


Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload


Best pos Management System v1.0 - SQL Injection


Best POS Management System v1.0 - Unauthenticated Remote Code Execution


Best Student Result Management System v1.0 - Multiple SQLi


Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)


bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS)


BigTree CMS 4.4.10 - Remote Code Execution


Billing Management System 2.0 - 'email' SQL injection Auth Bypass


Billing Management System 2.0 - Union based SQL injection (Authenticated)


Billing System Project 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Bitrix24 - Remote Code Execution (RCE) (Authenticated)


BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)


BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)


BlackCat CMS 1.3.6 - Cross-Site Request Forgery


Blackcat Cms v1.4 - Remote Code Execution (RCE)


Blackcat Cms v1.4 - Stored XSS


Blood Bank 1.0 - 'bid' SQLi


Blood Bank System 1.0 - Authentication Bypass


Blood Bank v1.0 - Multiple SQL Injection


Blood Bank v1.0 - Stored Cross Site Scripting (XSS)


Blood Donor Management System v1.0 - Stored XSS


BloodX 1.0 - Authentication Bypass


BloodX CMS 1.0 - Authentication Bypass


BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting


bloofoxCMS 0.5.2.1 - CSRF (Add user)


Bludit  3.9.2 - Authentication Bruteforce Mitigation Bypass


Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated)


Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)


Bludit 3.9.12 - Directory Traversal


Bludit 3.9.2 - Auth Bruteforce Bypass


Bludit 3.9.2 - Authentication Bruteforce Bypass (Metasploit)


Bludit 4.0.0-rc-2 - Account takeover


Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)


Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)


Boelter Blue System Management 1.3 - SQL Injection


BoidCMS v2.0.0 - authenticated file upload vulnerability