GulfTech Security

165 exploits Active since Mar 2004
CVE-2008-3701 EXPLOITDB text WORKING POC
Kayako SupportSuite <3.20.02 - SQL Injection
SQL injection vulnerability in staff/index.php in Kayako SupportSuite 3.20.02 and earlier allows remote authenticated users to execute arbitrary SQL commands via the customfieldlinkid parameter in a delcflink action.
CVE-2005-2460 EXPLOITDB text WORKING POC
Kayako liveResponse 2.x - Cross-Site Scripting via Username Parameter or Name Field
Multiple cross-site scripting (XSS) vulnerabilities in Kayako liveResponse 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter or (2) name field when entering a session or sending a message.
CVE-2005-2461 EXPLOITDB text WORKING POC
Kayako liveResponse 2.x - SQL Injection via Calendar Year or Date Parameter
Multiple SQL injection vulnerabilities in the calendar feature in Kayako liveResponse 2.x allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) date parameter.
CVE-2004-1413 EXPLOITDB text WRITEUP
Kayako eSupport 2.x - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (3) questiondetails, (4) ticketkey22, (5) email22 parameters to index.php, or (6) the e-mail field of the Forgot Key feature.
CVE-2005-0842 EXPLOITDB text WRITEUP
Kayako eSupport 2.3 - Cross-Site Scripting via _i or _c Parameter
Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) _i or (2) _c parameter.
CVE-2004-1835 EXPLOITDB text WRITEUP
Invision Gallery 1.0.1 - SQL Injection via img/cat/sort_key/order_key/user/album Parameters
Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters.
CVE-2008-3375 EXPLOITDB php WORKING POC
JamRoom < 3.4.0 - Unauthenticated Authentication Bypass via Serialized Cookie
The jrCookie function in includes/jamroom-misc.inc.php in JamRoom before 3.4.0 allows remote attackers to bypass authentication and gain administrative access via a boolean value within serialized data in a JMU_Cookie cookie.
EIP-2026-107938 EXPLOITDB text WRITEUP
Invision Power Top Site List < 2.0 Alpha 3 - SQL Injection (PoC)
Invision Power Top Site List < 2.0 Alpha 3 - SQL Injection (PoC)
EIP-2026-107937 EXPLOITDB text WRITEUP
Invision Power Top Site List < 1.1 RC 2 - SQL Injection
CVE-2005-1948 EXPLOITDB text WORKING POC
Invision Gallery - SQL Injection via Comment or Rating Parameter
Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.
CVE-2005-1597 EXPLOITDB text WRITEUP
Invision Power Board <= 2.0.3 - Cross-Site Scripting via Highlite Parameter
Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the highlite parameter.
EIP-2026-107923 EXPLOITDB text WRITEUP
Invision Power Board (IP.Board) < 2.0 Alpha 3 - SQL Injection (PoC)
EIP-2026-107922 EXPLOITDB text WRITEUP
Invision Power Board (IP.Board) < 1.3.1 - Design Error
EIP-2026-107921 EXPLOITDB text WRITEUP
Invision Power Board (IP.Board) < 1.3 - SQL Injection
EIP-2026-107904 EXPLOITDB text WORKING POC
Invision Community Blog 1.0/1.1 - Multiple Input Validation Vulnerabilities
CVE-2006-0758 EXPLOITDB text WRITEUP
HiveMail <= 1.3 - Cross-Site Scripting via PHP_SELF Variable
Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable.
CVE-2006-0757 EXPLOITDB text WORKING POC
HiveMail <= 1.3 - Remote Code Execution via Eval Injection in Multiple Parameters
Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators.
CVE-2006-0757 EXPLOITDB text WORKING POC
HiveMail <= 1.3 - Remote Code Execution via Eval Injection in Multiple Parameters
Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators.
CVE-2005-1672 EXPLOITDB text WRITEUP
Help Center Live - Cross-Site Scripting via Multiple Input Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the (1) find parameter to index.php, (2) name or (3) message field of a chat request, or (4) the message body when opening a trouble ticket.
EIP-2026-107577 EXPLOITDB text WORKING POC
HelpCenter Live! 1.0/1.2.x - Multiple Input Validation Vulnerabilities
EIP-2026-107551 EXPLOITDB text WORKING POC
HAMweather 3.9.8 - 'template.php' Script Code Injection
CVE-2008-3374 EXPLOITDB text WORKING POC
Gregarius < 0.5.4 - SQL Injection via rsargs Array Parameter
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an __exp__getFeedContent action.
CVE-2006-0823 EXPLOITDB text WRITEUP
Geeklog 1.4.0-1.4.0sr1 and 1.3.11-1.3.11sr4 - SQL Injection via Userid or Sessid Parameter
Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php.
CVE-2006-1127 EXPLOITDB text WRITEUP
Gallery 2 up to 2.0.2 - Cross-Site Scripting via X-Forwarded-For Header
Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is not properly handled when adding a comment to an album.
EIP-2026-107315 EXPLOITDB text WRITEUP
FusionBB 0.x - Multiple Input Validation Vulnerabilities