[webapps] Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)

Bludit

[local] NCH Express Invoice - Clear Text Password Storage and Account Takeover

NCH Express Invoice - Clear Text Password Storage and Account Takeover

[webapps] MCL-Net 4.3.5.8788 - Information Disclosure

MCL-Net 4.3.5.8788 - Information Disclosure

[webapps] Smart Office Web 20.28 - Remote Information Disclosure (Unauthenticated)

Smart Office Web 20.28 - Remote Information Disclosure (Unauthenticated)

[remote] Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing

Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing

[webapps] HiSecOS 04.0.01 - Privilege Escalation

HiSecOS 04.0.01 - Privilege Escalation

[webapps] Super Socializer 7.13.52 - Reflected XSS

Super Socializer 7.13.52 - Reflected XSS

[webapps] WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)

WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)

[webapps] SPIP v4.2.0 - Remote Code Execution (Unauthenticated)

SPIP v4.2.0 - Remote Code Execution (Unauthenticated)

[remote] Nokia ASIKA 7.13.52 - Hard-coded private key disclosure

Nokia ASIKA 7.13.52 - Hard-coded private key disclosure

[webapps] Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)

Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)

[webapps] Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)

Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)

[webapps] The Shop v2.5 - SQL Injection

The Shop v2.5 - SQL Injection

[webapps] Jobpilot v2.61 - SQL Injection

Jobpilot v2.61 - SQL Injection

[webapps] Diafan CMS 6.0 - Reflected Cross-Site Scripting (XSS)

Diafan CMS 6.0 - Reflected Cross-Site Scripting (XSS)

[webapps] Groomify v1.0 - SQL Injection

Groomify v1.0 - SQL Injection

[webapps] WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password

WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password

[webapps] Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)

Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)

[webapps] PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

[webapps] Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)

Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)

Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] projectSend r1605 - Stored XSS

projectSend r1605 - Stored XSS

[webapps] Online Thesis Archiving System v1.0 - Multiple-SQLi

Online Thesis Archiving System v1.0 - Multiple-SQLi

[remote] Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak

Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak

[webapps] projectSend r1605 - CSV injection

projectSend r1605 - CSV injection

[remote] Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution

Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution

[webapps] PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

[webapps] Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)

Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)

[remote] Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution

Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution

[webapps] Sales Tracker Management System v1.0 - Multiple Vulnerabilities

Sales Tracker Management System v1.0 - Multiple Vulnerabilities

[webapps] Teachers Record Management System 1.0 - File Upload Type Validation

Teachers Record Management System 1.0 - File Upload Type Validation

[webapps] Online Examination System Project 1.0 - Cross-site request forgery (CSRF)

Online Examination System Project 1.0 - Cross-site request forgery (CSRF)

[webapps] Thruk Monitoring Web Interface 3.06 - Path Traversal

Thruk Monitoring Web Interface 3.06 - Path Traversal

[webapps] WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

[local] USB Flash Drives Control 4.1.0.0 - Unquoted Service Path

USB Flash Drives Control 4.1.0.0 - Unquoted Service Path

[webapps] Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)

Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)

[local] Macro Expert 4.9 - Unquoted Service Path

Macro Expert 4.9 - Unquoted Service Path

[webapps] Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)

Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)

[webapps] MotoCMS Version 3.4.3 - SQL Injection

MotoCMS Version 3.4.3 - SQL Injection

[webapps] Total CMS 1.7.4 - Remote Code Execution (RCE)

Total CMS 1.7.4 - Remote Code Execution (RCE)

[webapps] File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

[webapps] STARFACE 7.3.0.10 - Authentication with Password Hash Possible

STARFACE 7.3.0.10 - Authentication with Password Hash Possible

[webapps] Rukovoditel 3.3.1 - CSV injection

Rukovoditel 3.3.1 - CSV injection

[remote] Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)

Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)

[webapps] Pydio Cells 4.1.2 - Server-Side Request Forgery

Pydio Cells 4.1.2 - Server-Side Request Forgery

[webapps] Online Security Guards Hiring System 1.0 - Reflected XSS

Online Security Guards Hiring System 1.0 - Reflected XSS

[webapps] Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download

Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download

[webapps] MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)

MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)

[webapps] SCRMS 2023-05-27 1.0 - Multiple SQL Injection

SCRMS 2023-05-27 1.0 - Multiple SQL Injection

[webapps] Pydio Cells 4.1.2 - Unauthorised Role Assignments

Pydio Cells 4.1.2 - Unauthorised Role Assignments

[webapps] unilogies/bumsys v1.0.3 beta - Unrestricted File Upload

unilogies/bumsys v1.0.3 beta - Unrestricted File Upload

[webapps] Faculty Evaluation System 1.0 - Unauthenticated File Upload

Faculty Evaluation System 1.0 - Unauthenticated File Upload

[webapps] Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)

Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)

[webapps] WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)

WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)

[remote] Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)

Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)

[local] Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation

Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation

[webapps] SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)

SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)

[webapps] Ulicms 2023.1 - create admin user via mass assignment

Ulicms 2023.1 - create admin user via mass assignment

[webapps] Zenphoto 1.6 - Multiple stored XSS

Zenphoto 1.6 - Multiple stored XSS