Latest Exploits

Sony PSN Community Lithium Forums 2012 Q4 suffer from a cross site scripting vulnerability.

File List versions 3.3 and 3.5 PRO for iOS suffer from cross site scripting, local file inclusion, and remote arbitrary file upload vulnerabilities.

Sony PSN Community Lithium Forums 2012 Q4 suffer from a cross site scripting vulnerability.

Sony PSN Community Lithium Forums 2012 Q4 suffers from a script insertion vulnerability.

PayPal suffered from a persistent cross site scripting vulnerability.

No-IP Dynamic Update Client (DUC) version 2.1.9 local IPaddress stack overflow exploit.

Wireless Disk PRO for iOS version 2.3 suffers from local file inclusion, cross site scripting, and OS command injection vulnerabilities.

Avira Personal appears to suffer from a privilege escalation vulnerability.

PayPal Community Forum suffers from a mail encoding script insertion vulnerability.

WordPress Search and Share plugin versions 0.9.3 and below suffer from cross site scripting and path disclosure vulnerabilities.

WordPress Securimage plugin version 3.2.4 suffers from a cross site scripting vulnerability.

Lan Messenger version 1.2 suffers from a buffer overflow vulnerability.

This Metasploit module abuses the SAP NetWeaver SXPG_CALL_SYSTEM function, on the SAP SOAP RFC Service, to execute remote commands. This Metasploit module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64 bits and Linux 64 bits platforms.

This Metasploit module abuses the SAP NetWeaver SXPG_COMMAND_EXECUTE function, on the SAP SOAP RFC Service, to execute remote commands. This Metasploit module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64 bits and Linux 64 bits platforms.

Securimage suffers from a cross site scripting issue in 'example_form.php' that uses the 'REQUEST_URI' variable. The vulnerability is present because there isn't any filtering to the mentioned variable in the affected script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

UMI.CMS version 2.9 suffers from a cross site request forgery vulnerability.

Linux kernel open-time capability file_ns_capable() local root exploit.

AlienVault OSSIM versions 4.1.2 and below suffer from remote SQL injection vulnerabilities.

Joomla DJ Classifieds Extension component version 2.0 suffers from a remote blind SQL injection vulnerability.

Flightgear versions 2.0 and 2.4 suffer from a remote format string vulnerability.