NoGe

100 exploits Active since Oct 2007
CVE-2008-5793 EXPLOITDB text WORKING POC
recly clickheat-heatmap 1.0.1 - Remote Code Execution via PHP File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[mosConfig_absolute_path] parameter to (a) install.clickheat.php, (b) Cache.php and (c) Clickheat_Heatmap.php in Recly/Clickheat/, and (d) Recly/common/GlobalVariables.php; and the (2) mosConfig_absolute_path parameter to (e) _main.php and (f) main.php in includes/heatmap, and (g) includes/overview/main.php.
CVE-2010-1494 EXPLOITDB text WORKING POC
Joomla! com_awdwall 1.5.4 - Path Traversal
Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVE-2010-1714 EXPLOITDB text WORKING POC
com_arcadegames 1.0 - Path Traversal via Controller Parameter
Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
EIP-2026-108384 EXPLOITDB text WORKING POC
Joomla! Component com_jajobboard - Multiple Local File Inclusions
EIP-2026-108524 EXPLOITDB text WORKING POC
Joomla! Component com_s5clanroster - Local File Inclusion
EIP-2026-107292 EXPLOITDB text WORKING POC
FSphp 0.2.1 - Remote File Inclusion
EIP-2026-107249 EXPLOITDB text WORKING POC
FreznoShop 1.3.0 - 'id' SQL Injection
CVE-2008-4624 EXPLOITDB text WORKING POC
Fast Click SQL Lite 1.1.7 - Remote Code Execution via CFG[CDIR] Parameter
PHP remote file inclusion vulnerability in init.php in Fast Click SQL Lite 1.1.7, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CFG[CDIR] parameter.
EIP-2026-106371 EXPLOITDB text WORKING POC
dB Masters MultiMedia's Content Manager 4.5 - SQL Injection
EIP-2026-106369 EXPLOITDB text WORKING POC
Dazzle Blast - Remote File Inclusion
EIP-2026-106675 EXPLOITDB php WORKING POC
e107 Plugin my_gallery 2.4.1 - 'readfile()' Local File Disclosure
CVE-2008-6114 EXPLOITDB text WRITEUP
Mytipper Zogo-shop <1.15.4 - SQL Injection
SQL injection vulnerability in product_details.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbitrary SQL commands via the product parameter.
EIP-2026-106018 EXPLOITDB text WORKING POC
CMSimple 4.4/4.4.2 - Remote File Inclusion
CVE-2009-1345 EXPLOITDB text WRITEUP
cpCommerce 1.2.8 - SQL Injection via id_document Parameter
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
EIP-2026-106089 EXPLOITDB text WORKING POC
Community Translate - Remote File Inclusion
CVE-2009-2881 EXPLOITDB text WRITEUP
Basilic 1.5.13 - SQL Injection via idAuthor Parameter
Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via the idAuthor parameter to (1) index.php and possibly (2) allpubs.php in publications/.
CVE-2008-6287 EXPLOITDB text WORKING POC
Broadcast Machine 0.1 - Remote Code Execution via baseDir Parameter
Multiple PHP remote file inclusion vulnerabilities in Broadcast Machine 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter to (1) MySQLController.php, (2) SQLController.php, (3) SetupController.php, (4) VideoController.php, and (5) ViewController.php in controllers/.
CVE-2008-5776 EXPLOITDB text WRITEUP
Aperto Blog 0.1.1 - Path Traversal
Multiple directory traversal vulnerabilities in Aperto Blog 0.1.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) action parameter to admin.php and the (2) get parameter to index.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVE-2009-3203 EXPLOITDB perl WORKING POC
AJ Auction Pro OOPD 2.x - SQL Injection via store.php id Parameter
SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4529 EXPLOITDB text WORKING POC
asiCMS alpha 0.208 - Remote Code Execution via _ENV[asicms][path] Parameter
Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the _ENV[asicms][path] parameter to (1) Association.php, (2) BigMath.php, (3) DiffieHellman.php, (4) DumbStore.php, (5) Extension.php, (6) FileStore.php, (7) HMAC.php, (8) MemcachedStore.php, (9) Message.php, (10) Nonce.php, (11) SQLStore.php, (12) SReg.php, (13) TrustRoot.php, and (14) URINorm.php in classes/Auth/OpenID/; and (15) XRDS.php, (16) XRI.php and (17) XRIRes.php in classes/Auth/Yadis/.
EIP-2026-105008 EXPLOITDB text WRITEUP
AFCommerce - 'adminpassword.php' Remote File Inclusion
EIP-2026-105007 EXPLOITDB text WRITEUP
AFCommerce - 'adblock.php' Remote File Inclusion
EIP-2026-105009 EXPLOITDB text WRITEUP
AFCommerce - 'controlheader.php' Remote File Inclusion
CVE-2009-3307 EXPLOITDB text WORKING POC
FSphp 0.2.1 - Remote File Inclusion via FSPHP_LIB Parameter
Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the FSPHP_LIB parameter to (1) FSphp.php, (2) navigation.php, and (3) pathwrite.php in lib/.
EIP-2026-100493 EXPLOITDB text WRITEUP
Pre E-Learning Portal - 'search_result.asp' SQL Injection