Exploits

日期	标题	类型	平台	作者
2020-11-09	KMSpico 17.1.0.0 – ‘Service KMSELDI’ Unquoted Service Path	local	windows	SamAlucard
2020-11-09	iDeskService 3.0.2.1 – ‘iDeskService’ Unquoted Service Path	local	windows	Leslie Lara
2020-11-09	HP Display Assistant x64 Edition 3.20 – ‘DTSRVC’ Unquoted Service Path	local	windows	Julio Aviña
2020-11-09	Magic Mouse 2 utilities 2.20 – ‘magicmouse2service’ Unquoted Service Path	local	windows	SamAlucard
2020-11-09	SuiteCRM 7.11.15 – ‘last_name’ Remote Code Execution (Authenticated)	webapps	php	M. Cory Billington
2020-11-09	MEMU PLAY 3.7.0 – ‘MEmusvc’ Unquoted Service Path	local	windows	SamAlucard
2020-11-09	Genexis Platinum-4410 P4410-V2-1.28 – Broken Access Control and CSRF	webapps	hardware	Jinson Varghese Behanan
2020-11-09	Realtek Audio Service 1.0.0.55 – ‘RtkAudioService64.exe’ Unquoted Service Path	local	windows	Erika Figueroa
2020-11-09	Realtek Andrea RT Filters 1.0.64.10 – ‘AERTSr64.EXE’ Unquoted Service Path	local	windows	Erika Figueroa
2020-11-09	Motorola Device Manager 2.5.4 – ‘ForwardDaemon.exe ‘ Unquoted Service Path	local	windows	Angel Canseco
2020-11-09	Motorola Device Manager 2.5.4 – ‘MotoHelperService.exe’ Unquoted Service Path	local	windows	Angel Canseco
2020-11-09	Motorola Device Manager 2.4.5 – ‘ForwardDaemon.exe ‘ Unquoted Service Path	local	windows	Angel Canseco
2020-11-09	HP WMI Service 1.4.8.0 – ‘HPWMISVC.exe’ Unquoted Service Path	local	windows	Jocelyn Arenas
2020-11-09	Syncplify.me Server! 5.0.37 – ‘SMWebRestServicev5’ Unquoted Service Path	local	windows	Julio Aviña
2020-11-09	Joplin 1.2.6 – ‘link’ Cross Site Scripting	webapps	multiple	Philip Holbrook
2020-11-09	DigitalPersona 4.5.0.2213 – ‘DpHostW’ Unquoted Service Path	local	windows	SamAlucard
2020-11-09	Privacy Drive v3.17.0 – ‘pdsvc.exe’ Unquoted Service Path	local	windows	Mohammed Alshehri
2020-11-09	Genexus Protection Server 9.6.4.2 – ‘protsrvservice’ Unquoted Service Path	local	windows	SamAlucard
2020-11-06	BlogEngine 3.3.8 – ‘Content’ Stored XSS	webapps	aspx	Andrey Stoykov
2020-11-06	Sentrifugo Version 3.2 – ‘announcements’ Remote Code Execution (Authenticated)	webapps	php	Fatih Çelik
2020-11-06	Sentrifugo 3.2 – ‘assets’ Remote Code Execution (Authenticated)	webapps	php	Fatih Çelik
2020-11-06	CMSUno 1.6.2 – ‘lang’ Remote Code Execution (Authenticated)	webapps	php	Fatih Çelik
2020-11-06	SmartBlog 2.0.1 – ‘id_post’ Blind SQL injection	webapps	php	C0wnuts
2020-11-05	iDS6 DSSPro Digital Signage System 6.2 – Cross-Site Request Forgery (CSRF)	webapps	hardware	LiquidWorm
2020-11-05	TP-Link WDR4300 – Remote Code Execution (Authenticated)	remote	hardware	Patrik Lantz
2020-11-05	Amarok 2.8.0 – Denial-of-Service	local	windows	FishballAndMeatball
2020-11-05	iDS6 DSSPro Digital Signage System 6.2 – Improper Access Control Privilege Escalation	webapps	hardware	LiquidWorm
2020-11-05	iDS6 DSSPro Digital Signage System 6.2 – CAPTCHA Security Bypass	webapps	hardware	LiquidWorm
2020-11-04	Student Attendance Management System 1.0 – ‘username’ SQL Injection / Remote Code Execution	webapps	php	Mosaaed
2020-11-04	School Log Management System 1.0 – ‘username’ SQL Injection / Remote Code Execution	webapps	php	Mosaaed
2020-11-04	PDW File Browser 1.3 – Remote Code Execution	webapps	php	David Bimmel
2020-11-04	Processwire CMS 2.4.0 – ‘download’ Local File Inclusion	webapps	php	Y1LD1R1M
2020-11-03	Complaints Report Management System 1.0 – ‘username’ SQL Injection / Remote Code Execution	webapps	php	Mosaaed
2020-11-03	Multi Restaurant Table Reservation System 1.0 – ‘table_id’ Unauthenticated SQL Injection	webapps	php	yunaranyancat
2020-11-02	Quick N Easy FTP Service 3.2 – Unquoted Service Path	local	windows	yunaranyancat
2020-11-02	Foxit Reader 9.7.1 – Remote Command Execution (Javascript API)	local	windows	Nassim Asrir
2020-11-02	Monitorr 1.7.6m – Authorization Bypass	webapps	php	Lyhin\'s Lab
2020-11-02	Monitorr 1.7.6m – Remote Code Execution (Unauthenticated)	webapps	php	Lyhin\'s Lab
2020-11-02	WordPress Plugin Simple File List 4.2.2 – Arbitrary File Upload	webapps	php	H4rk3nz0
2020-11-02	Apache Flink 1.9.x – File Upload RCE (Unauthenticated)	webapps	java	bigger.wing
2020-10-30	DedeCMS v.5.8 – “keyword” Cross-Site Scripting	webapps	php	Noth
2020-10-30	CSE Bookstore 1.0 – ‘quantity’ Persistent Cross-site Scripting	webapps	php	Vyshnav nk
2020-10-30	Simple College Website 1.0 – ‘username’ SQL Injection / Remote Code Execution	webapps	php	yunaranyancat
2020-10-30	Online Job Portal 1.0 – ‘userid’ SQL Injection	webapps	php	Akıner Kısa
2020-10-30	Citadel WebCit < 926 - Session Hijacking Exploit	webapps	multiple	Simone Quatrini
2020-10-29	Genexis Platinum-4410 P4410-V2-1.28 – Cross Site Request Forgery to Reboot	webapps	hardware	Mohammed Farhan
2020-10-29	WebLogic Server 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 – Unauthenticated RCE via GET request	webapps	java	Mohammed Althibyani
2020-10-29	Mailman 1.x > 2.1.23 – Cross Site Scripting (XSS)	webapps	cgi	Valerio Alessandroni
2020-10-29	Online Examination System 1.0 – ‘name’ Stored Cross Site Scripting	webapps	php	Nikhil Kumar
2020-10-28	IP Watcher v3.0.0.30 – ‘PACService.exe’ Unquoted Service Path	local	windows	Mohammed Alshehri