b1ack0wl ASUS TM-AC1900 - Arbitrary Command Execution (Metasploit)
webapps hardware

Synacktiv Sony Playstation 4 (PS4) < 6.72 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)
webapps hardware

Abdulazeez Alaseeri Wordpress Plugin Good LMS 2.1.4 - 'id' Unauthenticated SQL Injection
webapps php

Sarang Tumne Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
webapps php

Fatih Çelik CMSUno 1.6.2 - 'user' Remote Code Execution (Authenticated)
webapps php

Ahmed Abbas Customer Support System 1.0 - 'username' Authentication Bypass
webapps php

Ahmed Abbas Customer Support System 1.0 - Cross-Site Request Forgery
webapps php

Ahmed Abbas Customer Support System 1.0 - 'description' Stored XSS in The Admin Panel
webapps php

Mufaddal Masalawala Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
webapps php CVE-2020-15255

Joe Helle ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting
webapps php CVE-2020-28351

Fortunato Lodari Car Rental Management System 1.0 - SQL injection + Arbitrary File Upload
webapps php

Philip Holbrook Joplin 1.2.6 - 'link' Cross Site Scripting
webapps multiple CVE-2020-28249

M. Cory Billington SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)
webapps php CVE-2020-28328

Jinson Varghese Behanan Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF
webapps hardware CVE-2020-25015

Andrey Stoykov BlogEngine 3.3.8 - 'Content' Stored XSS
webapps aspx

Fatih Çelik Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)
webapps php