Exploits

Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。

类型: 漏洞条目
总量: 24,950
页码: 98

Symantec Advanced Secure Gateway (ASG) / ProxySG – Unrestricted File Upload

===========Security Intelligence============

2019-09-16 Pankaj Kumar Thakur webapps

Notepad++ < 7.7 (x64) - Denial of Service

# Exploit Title: Notepad++ all x64 versions before 7.7. Remote memory corruption via .ml file.

2019-09-16 Bogdan Kurinnoy dos

docPrint Pro 8.0 – SEH Buffer Overflow

import struct

2019-09-16 Connor McGarr local

CollegeManagementSystem-CMS 1.3 – ‘batch’ SQL Injection

# Exploit Title: CollegeManagementSystem-CMS 1.3 - 'batch' SQL Injection

2019-09-16 cakes webapps

Ticket-Booking 1.4 – Authentication Bypass

# Exploit Title: Ticket-Booking 1.4 - Authentication Bypass

2019-09-14 cakes webapps

College-Management-System 1.2 – Authentication Bypass

# Exploit Title: College-Management-System 1.2 - Authentication Bypass

2019-09-14 cakes webapps

Folder Lock 7.7.9 – Denial of Service

# Exploit Title: Folder Lock v7.7.9 Denial of Service Exploit

2019-09-13 Achilles dos

Dolibarr ERP-CRM 10.0.1 – ‘User-Agent’ Cross-Site Scripting

# Exploit Title: Dolibarr ERP/CRM 10.0.1 - User-Agent Http Header Cross

2019-09-13 Metin Yunus Kandemir webapps

phpMyAdmin 4.9.0.1 – Cross-Site Request Forgery

=============================================

2019-09-13 Manuel García Cárdenas webapps

LimeSurvey 3.17.13 – Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory < 20190912-0 >

2019-09-13 SEC Consult webapps

Microsoft DirectWrite – Invalid Read in SplicePixel While Processing OTF Fonts

Microsoft DirectWrite is a modern Windows API for high-quality text rendering. A majority of its code resides in the ...

2019-09-12 Google Security Research dos

Microsoft DirectWrite – Out-of-Bounds Read in sfac_GetSbitBitmap While Processing TTF Fonts

Microsoft DirectWrite is a modern Windows API for high-quality text rendering. A majority of its code resides in the ...

2019-09-12 Google Security Research dos

AVCON6 systems management platform – OGNL Remote Command Execution

# Exploit Title: AVCON6 systems management platform - OGNL - Remote root command execution

2019-09-11 Nassim Asrir webapps

eWON Flexy – Authentication Bypass

#!/usr/bin/env python

2019-09-11 Photubias webapps

WordPress Plugin Photo Gallery 1.5.34 – SQL Injection

# Exploit Title: WordPress Plugin Photo Gallery by 10Web Add new and in add galleries / Gallery groups. GET request ...

2019-09-10 MTK webapps

WordPress Plugin Photo Gallery 1.5.34 – Cross-Site Scripting

# Exploit Title: WordPress Plugin Photo Gallery by 10Web

2019-09-10 MTK webapps

WordPress Plugin Photo Gallery 1.5.34 – Cross-Site Scripting (2)

# Exploit Title: WordPress Plugin Photo Gallery by 10Web

2019-09-10 MTK webapps

LibreNMS – Collectd Command Injection (Metasploit)

##

2019-09-10 Metasploit remote

October CMS – Upload Protection Bypass Code Execution (Metasploit)

##

2019-09-10 Metasploit remote

Microsoft Windows 10 – UAC Protection Bypass Via Microsoft Windows Store (WSReset.exe) (Metasploit)

##

2019-09-10 Metasploit local

Microsoft Windows 10 – UAC Protection Bypass Via Microsoft Windows Store (WSReset.exe) and Registry (Metasploit)

##

2019-09-10 Metasploit local

WordPress Core 5.2.3 – Cross-Site Host Modification

#!/usr/bin/perl -w

2019-09-09 Todor Donev webapps

Dolibarr ERP-CRM 10.0.1 – ‘elemid’ SQL Injection

# Exploit Title: Dolibarr ERP/CRM - elemid Sql Injection

2019-09-09 Metin Yunus Kandemir webapps

Enigma NMS 65.0.0 – Cross-Site Request Forgery

#--------------------------------------------------------------------#

2019-09-09 xerubus webapps

Enigma NMS 65.0.0 – OS Command Injection

#!/usr/bin/python

2019-09-09 xerubus webapps

Enigma NMS 65.0.0 – SQL Injection

#--------------------------------------------------------------------#

2019-09-09 xerubus webapps

Online Appointment – SQL Injection

# Exploit Title: Online Appointment SQL Injection

2019-09-09 mohammad zaheri webapps

Rifatron Intelligent Digital Security System – ‘animate.cgi’ Stream Disclosure

#!/bin/bash

2019-09-09 LiquidWorm webapps

WordPress Plugin Sell Downloads 1.0.86 – Cross-Site Scripting

# Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting

2019-09-09 Mr Winst0n webapps

Dolibarr ERP-CRM 10.0.1 – SQL Injection

# Exploit Title: Dolibarr ERP/CRM - Multiple Sql Injection

2019-09-09 Metin Yunus Kandemir webapps

Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN – Remote Code Execution

#!/usr/bin/python

2019-09-06 Justin Wagner remote

Inventory Webapp – ‘itemquery’ SQL injection

# Exploit Title: Inventory Webapp SQL injection

2019-09-06 mohammad zaheri webapps

Microsoft Windows NTFS – Privileged File Access Enumeration

[+] Credits: John Page (aka hyp3rlinx)

2019-09-06 hyp3rlinx local

FusionPBX 4.4.8 – Remote Code Execution

#!/usr/bin/python3

2019-09-06 Askar remote

Publisure Hybrid – Multiple Vulnerabilities

#####################################################################################

2019-09-06 Jean-Marie Bourbon webapps

AwindInc SNMP Service – Command Injection (Metasploit)

##

2019-09-05 Metasploit remote

WordPress Plugin Download Manager 2.9.93 – Cross-Site Scripting

CVE:CVE-2019-15889

2019-09-04 MgThuraMoeMyint webapps

DASAN Zhone ZNID GPON 2426A EU – Multiple Cross-Site Scripting

Multiple Cross-Site Scripting (XSS) in the web interface of DASAN Zhone ZNID GPON 2426A EU version S3.1.285 applicati...

2019-09-04 Adam Ziaja webapps

ktsuss 1.4 – suid Privilege Escalation (Metasploit)

##

2019-09-03 Metasploit local

ptrace – Sudo Token Privilege Escalation (Metasploit)

##

2019-09-03 Metasploit local

Cisco UCS Director – default scpuser password (Metasploit)

##

2019-09-03 Metasploit remote

Cisco Data Center Network Manager – Unauthenticated Remote Code Execution (Metasploit)

##

2019-09-03 Metasploit remote

Cisco RV110W/RV130(W)/RV215W Routers Management Interface – Remote Command Execution (Metasploit)

##

2019-09-03 Metasploit remote

FileThingie 2.5.7 – Arbitrary File Upload

# Exploit Title: FileThingie 2.5.7 - Arbitrary File Upload

2019-09-03 cakes webapps

Cisco Email Security Appliance (IronPort) C160 – ‘Host’ Header Injection

#!/usr/bin/perl -w

2019-09-02 Todor Donev remote

Webmin < 1.920 - 'rpc.cgi' Remote Code Execution (Metasploit)

##

2019-09-02 James Bercegay webapps

Opencart 3.x – Cross-Site Scripting

# Exploit Title: Opencart 3.x.x Authenticated Stored XSS

2019-09-02 Nipun Somani webapps

ChaosPro 2.0 – SEH Buffer Overflow

#!C:\Python27\python.exe

2019-09-02 Jonathan Crosby local

ChaosPro 2.1 – SEH Buffer Overflow

#!C:\Python27\python.exe

2019-09-02 Jonathan Crosby local

ChaosPro 3.1 – SEH Buffer Overflow

#!C:\Python27\python.exe

2019-09-02 Jonathan Crosby local