|
2021-07-19
|
|
PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection
|
26 |
WEB
|
faisalfs10x
|
|
2021-07-19
|
|
WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XS
|
20 |
WEB
|
Vikas Srivastava
|
|
2021-07-19
|
|
WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation
|
25 |
WEB
|
nhattruong
|
|
2021-07-19
|
|
WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
|
20 |
WEB
|
nhattruong
|
|
2021-07-16
|
|
Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
|
22 |
WEB
|
Metin Yunus Kandemir
|
|
2021-07-16
|
|
ForgeRock Access Manager 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)
|
29 |
WEB
|
Photubias
|
|
2021-07-15
|
|
WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated)
|
25 |
WEB
|
Simone Cristofaro
|
|
2021-07-15
|
|
osCommerce 2.3.4.1 - Remote Code Execution (2)
|
29 |
WEB
|
Bryan Leong
|
|
2021-07-14
|
|
WordPress Plugin Current Book 1.0.1 - 'Book Title' Persistent Cross-Site Scripting
|
29 |
WEB
|
Vikas Srivastava
|
|
2021-07-14
|
|
Webmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF)
|
26 |
WEB
|
Mesh3l_911
|
|
2021-07-13
|
|
Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload
|
27 |
WEB
|
Luca Bernardi
|
|
2021-07-13
|
|
OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)
|
36 |
WEB
|
Alexandre ZANNI
|
|
2021-07-13
|
|
Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
|
37 |
WEB
|
Subhadip Nag
|
|
2021-07-13
|
|
WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS)
|
25 |
WEB
|
Swapnil Subhash Bodekar
|
|
2021-07-13
|
|
Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)
|
21 |
WEB
|
Central InfoSec
|
|
2021-07-13
|
|
Apache Tomcat 9.0.0.M1 - Open Redirect
|
24 |
WEB
|
Central InfoSec
|
|
2021-07-09
|
|
Zoo Management System 1.0 - 'Multiple' Persistent Cross-Site-Scripting (XSS)
|
30 |
WEB
|
Subhadip Nag
|
|
2021-07-09
|
|
Church Management System 1.0 - SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
|
27 |
WEB
|
Eleonora Guardini
|
|
2021-07-08
|
|
Wordpress Plugin SP Project & Document Manager 4.21 - Remote Code Execution (RCE) (Authenticated)
|
27 |
WEB
|
Ron Jost
|
|
2021-07-08
|
|
Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unau
|
23 |
WEB
|
faisalfs10x
|
|
2021-07-08
|
|
Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)
|
26 |
WEB
|
Patrik Lantz
|
|
2021-07-08
|
|
Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)
|
24 |
WEB
|
Subhadip Nag
|
|
2021-07-08
|
|
Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)
|
30 |
WEB
|
Davide \'yth1n\' Bianchin
|
|
2021-07-07
|
|
WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (
|
24 |
WEB
|
Beren Kuday GÖRÜN
|
|
2021-07-07
|
|
Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
|
24 |
WEB
|
faisalfs10x
|
|
2021-07-07
|
|
Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2)
|
35 |
WEB
|
enox
|
|
2021-07-06
|
|
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal
|
27 |
WEB
|
TheSmuggler
|
|
2021-07-06
|
|
Phone Shop Sales Managements System 1.0 - Arbitrary File Upload
|
26 |
WEB
|
faisalfs10x
|
|
2021-07-06
|
|
Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)
|
22 |
WEB
|
faisalfs10x
|
|
2021-07-06
|
|
Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation
|
24 |
WEB
|
Andrea D\'Ubaldo
|
|
2021-07-06
|
|
Exam Hall Management System 1.0 - Unrestricted File Upload (Unauthenticated)
|
24 |
WEB
|
Thamer Almohammadi
|
|
2021-07-06
|
|
Billing System Project 1.0 - Remote Code Execution (RCE) (Unauthenticated)
|
31 |
WEB
|
Talha DEMİRSOY
|
|
2021-07-06
|
|
Pallets Werkzeug 0.15.4 - Path Traversal
|
25 |
WEB
|
faisalfs10x
|
|
2021-07-06
|
|
Black Box Kvm Extender 3.4.31307 - Local File Inclusion
|
23 |
WEB
|
Ferhat Çil
|
|
2021-07-06
|
|
Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)
|
24 |
WEB
|
SivertPL
|
|
2021-07-06
|
|
Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
|
21 |
WEB
|
Andrea D\'Ubaldo
|
|
2021-07-06
|
|
perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)
|
21 |
WEB
|
Alhasan Abbas
|
|
2021-07-05
|
|
Ricon Industrial Cellular Router S9922XL - Remote Command Execution (RCE)
|
21 |
WEB
|
LiquidWorm
|
|
2021-07-05
|
|
TextPattern CMS 4.9.0-dev - Remote Command Execution (RCE) (Authenticated)
|
21 |
WEB
|
Mevlüt Akçam
|
|
2021-07-05
|
|
Simple Client Management System 1.0 - Remote Code Execution (RCE)
|
27 |
WEB
|
Ishan Saha
|
|
2021-07-05
|
|
Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated)
|
26 |
WEB
|
Ron Jost
|
|
2021-07-05
|
|
Church Management System 1.0 - 'password' SQL Injection (Authentication Bypass)
|
33 |
WEB
|
Murat DEMİRCİ
|
|
2021-07-05
|
|
Church Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
|
28 |
WEB
|
Murat DEMİRCİ
|
|
2021-07-05
|
|
Church Management System 1.0 - Arbitrary File Upload (Authenticated)
|
32 |
WEB
|
Murat DEMİRCİ
|
|
2021-07-05
|
|
Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
|
32 |
WEB
|
Subhadip Nag
|
|
2021-07-05
|
|
Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)
|
26 |
WEB
|
Geiseric
|
|
2021-07-05
|
|
OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2)
|
24 |
WEB
|
Alexandre ZANNI
|
|
2021-07-05
|
|
WordPress Plugin WP Learn Manager 1.1.2 - Stored Cross-Site Scripting (XSS)
|
28 |
WEB
|
Mohammed Adam
|
|
2021-07-02
|
|
Garbage Collection Management System 1.0 - SQL Injection (Unauthenticated)
|
26 |
WEB
|
ircashem
|
|
2021-07-02
|
|
Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)
|
25 |
WEB
|
Ron Jost
|
|
2021-07-02
|
|
Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)
|
22 |
WEB
|
Ron Jost
|
|
2021-07-02
|
|
b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
|
22 |
WEB
|
Alperen Ergel
|
|
2021-07-02
|
|
AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)
|
26 |
WEB
|
Tyler Butler
|
|
2021-07-02
|
|
Scratch Desktop 3.17 - Remote Code Execution
|
24 |
WEB
|
Stig Magnus Baugstø
|
|
2021-07-01
|
|
Vianeos OctoPUS 5 - 'login_user' SQLi
|
26 |
WEB
|
Audencia Business SCHOOL Red Team
|
|
2021-07-01
|
|
Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)
|
26 |
WEB
|
Ron Jost
|
|
2021-07-01
|
|
Online Voting System 1.0 - Remote Code Execution (Authenticated)
|
27 |
WEB
|
Salman Asad
|
|
2021-07-01
|
|
Online Voting System 1.0 - Authentication Bypass (SQLi)
|
22 |
WEB
|
Salman Asad
|
|
2021-06-30
|
|
Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
|
24 |
WEB
|
Murat DEMİRCİ
|
|
2021-06-30
|
|
Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)
|
23 |
WEB
|
Barış Yıldızoğlu
|
|
2021-06-30
|
|
Apache Superset 1.1.0 - Time-Based Account Enumeration
|
29 |
WEB
|
Dolev Farhi
|
|
2021-06-30
|
|
phpAbook 0.9i - SQL Injection
|
28 |
WEB
|
Alejandro Perez
|
|
2021-06-28
|
|
Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)
|
30 |
WEB
|
Bryan Leong
|
|
2021-06-28
|
|
Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
|
22 |
WEB
|
Captain_hook
|
|
2021-06-28
|
|
WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)
|
30 |
WEB
|
Toby Jackson
|
|
2021-06-25
|
|
Lightweight facebook-styled blog 1.3 - Remote Code Execution (RCE) (Authenticated) (Metasploit)
|
26 |
WEB
|
Maide Ilkay Aydogdu
|
|
2021-06-25
|
|
Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
|
25 |
WEB
|
Barış Yıldızoğlu
|
|
2021-06-25
|
|
Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)
|
25 |
WEB
|
Bryan Leong
|
|
2021-06-24
|
|
TP-Link TL-WR841N - Command Injection
|
25 |
WEB
|
Koh You Liang
|
|
2021-06-24
|
|
Adobe ColdFusion 8 - Remote Command Execution (RCE)
|
32 |
WEB
|
Pergyz
|
|
2021-06-24
|
|
VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated)
|
26 |
WEB
|
CHackA0101
|
|
2021-06-23
|
|
Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass)
|
24 |
WEB
|
Rinku Kumar
|
|
2021-06-23
|
|
Online Library Management System 1.0 - Arbitrary File Upload Remote Code Execution (Unauthenticated)
|
42 |
WEB
|
Berk Can Geyikci
|
|
2021-06-23
|
|
Online Library Management System 1.0 - 'Search' SQL Injection
|
25 |
WEB
|
Berk Can Geyikci
|
|
2021-06-23
|
|
WordPress Plugin Poll_ Survey_ Questionnaire and Voting system 1.5.2 - 'date_answers' Blind SQL Inje
|
25 |
WEB
|
Toby Jackson
|
|
2021-06-23
|
|
WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)
|
27 |
WEB
|
Mohammed Adam
|
|
2021-06-22
|
|
Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference (IDOR)
|
23 |
WEB
|
Pratik Khalane
|
|
2021-06-22
|
|
Responsive Tourism Website 3.1 - Remote Code Execution (RCE) (Unauthenticated)
|
26 |
WEB
|
Tagoletta
|
|
2021-06-21
|
|
Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
|
26 |
WEB
|
Ishan Saha
|
|
2021-06-21
|
|
Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)
|
25 |
WEB
|
Riadh Benlamine
|
|
2021-06-21
|
|
Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF)
|
26 |
WEB
|
Riadh Benlamine
|
|
2021-06-21
|
|
Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
|
27 |
WEB
|
g0ldm45k
|
|
2021-06-21
|
|
OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated)
|
24 |
WEB
|
Ron Jost
|
|
2021-06-18
|
|
Node.JS - 'node-serialize' Remote Code Execution (3)
|
27 |
WEB
|
Beren Kuday GÖRÜN
|
|
2021-06-18
|
|
ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)
|
25 |
WEB
|
Piyush Patil
|
|
2021-06-18
|
|
ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
|
26 |
WEB
|
Piyush Patil
|
|
2021-06-17
|
|
Online Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)
|
27 |
WEB
|
Tagoletta
|
|
2021-06-17
|
|
Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration
|
23 |
WEB
|
Ricardo Ruiz
|
|
2021-06-17
|
|
Unified Office Total Connect Now 1.0 - 'data' SQL Injection
|
25 |
WEB
|
Ajaikumar Nadar
|
|
2021-06-16
|
|
CKEditor 3 - Server-Side Request Forgery (SSRF)
|
24 |
WEB
|
ahmed
|
|
2021-06-16
|
|
Teachers Record Management System 1.0 - 'email' Stored Cross-site Scripting (XSS)
|
24 |
WEB
|
nhattruong
|
|
2021-06-16
|
|
Teachers Record Management System 1.0 - 'Multiple' SQL Injection (Authenticated)
|
23 |
WEB
|
nhattruong
|
|
2021-06-16
|
|
OpenEMR 5.0.1.3 - Authentication Bypass
|
35 |
WEB
|
Ron Jost
|
|
2021-06-16
|
|
Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting
|
23 |
WEB
|
Fatih İLGİN
|
|
2021-06-15
|
|
Client Management System 1.1 - 'Search' SQL Injection
|
29 |
WEB
|
BHAVESH KAUL
|
|
2021-06-15
|
|
Client Management System 1.1 - 'username' Stored Cross-Site Scripting (XSS)
|
25 |
WEB
|
BHAVESH KAUL
|
|
2021-06-14
|
|
OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)
|
25 |
WEB
|
Ron Jost
|
|
2021-06-14
|
|
TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated)
|
27 |
WEB
|
Mert Daş
|
|
2021-06-14
|
|
Small CRM 3.0 - 'Authentication Bypass' SQL Injection
|
35 |
WEB
|
BHAVESH KAUL
|
|
2021-06-14
|
|
Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)
|
32 |
WEB
|
Riadh Benlamine
|
|
2021-06-14
|
|
COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)
|
28 |
WEB
|
BHAVESH KAUL
|
|
2021-06-14
|
|
GLPI 9.4.5 - Remote Code Execution (RCE)
|
24 |
WEB
|
Brian Peters
|
|
2021-06-14
|
|
Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR)
|
21 |
WEB
|
Abdulazeez Alaseeri
|
|
2021-06-14
|
|
Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
|
21 |
WEB
|
Abdulazeez Alaseeri
|
|
2021-06-11
|
|
WoWonder Social Network Platform 3.1 - Authentication Bypass
|
23 |
WEB
|
securityforeveryone.com
|
|
2021-06-11
|
|
Zenario CMS 8.8.52729 - 'cID' SQL injection (Authenticated)
|
23 |
WEB
|
Avinash R
|
|
2021-06-11
|
|
Solar-Log 500 2.8.2 - Unprotected Storage of Credentials
|
27 |
WEB
|
Luca.Chiou
|
|
2021-06-11
|
|
Solar-Log 500 2.8.2 - Incorrect Access Control
|
26 |
WEB
|
Luca.Chiou
|
|
2021-06-11
|
|
Grocery crud 1.6.4 - 'order_by' SQL Injection
|
27 |
WEB
|
TonyShavez
|
|
2021-06-11
|
|
WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
|
32 |
WEB
|
0xB9
|
|
2021-06-11
|
|
OpenEMR 5.0.0 - Remote Code Execution (Authenticated)
|
36 |
WEB
|
Ron Jost
|
|
2021-06-11
|
|
Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forger
|
27 |
WEB
|
Alex Birnberg
|
|
2021-06-11
|
|
Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)
|
30 |
WEB
|
Mohammad Hossein Kaviyany
|
|
2021-06-11
|
|
Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)
|
31 |
WEB
|
Abdulazeez Alaseeri
|
|
2021-06-10
|
|
TextPattern CMS 4.8.7 - Stored Cross-Site Scripting (XSS)
|
33 |
WEB
|
Mert Daş
|
|
2021-06-10
|
|
Student Result Management System 1.0 - 'class' SQL Injection
|
32 |
WEB
|
Riadh Benlamine
|
|
2021-06-09
|
|
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
|
35 |
WEB
|
legend
|
|
2021-06-09
|
|
WordPress Plugin visitors-app 0.3 - 'user-agent' Stored Cross-Site Scripting (XSS)
|
23 |
WEB
|
Mesut Cetin
|
|
2021-06-09
|
|
OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting
|
25 |
WEB
|
Mert Daş
|
|
2021-06-09
|
|
OpenCart 3.0.3.7 - 'Change Password' Cross-Site Request Forgery (CSRF)
|
29 |
WEB
|
Mert Daş
|
|
2021-06-09
|
|
Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)
|
29 |
WEB
|
Rodolfo Mariano
|
|
2021-06-08
|
|
WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
|
31 |
WEB
|
Fellipe Oliveira
|
|
2021-06-07
|
|
Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
|
34 |
WEB
|
UnD3sc0n0c1d0
|
|
2021-06-07
|
|
Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)
|
28 |
WEB
|
enox
|
|
2021-06-07
|
|
Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)
|
24 |
WEB
|
enox
|
