D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi (function genacgi_main() in /htdocs/cgibin), which is accessible without credentials.
Pachev FTP Server 1.0 – Path Traversal
qdPM 9.1 – Remote Code Execution
BOOTP Turbo 2.0 – Denial of Service (SEH)(PoC)
WordPress WP Fanzone theme version 3.1 suffers from a remote SQL injection vulnerability.
Neowise CarbonFTP version 1.4 suffers from an insecure proprietary password encryption implementation.
KeePass 2.44 – Denial of Service (PoC)
Citrix XenMobile Server 10.8 – XML External Entity Injection
Hospital Management System version 4.0 suffers from a persistent cross site scripting vulnerability in add-patient.php. This version is already known to have persistent cross site scripting issues.