ToXiC350

21 exploits Active since Sep 2007
CVE-2008-1848 EXPLOITDB text WORKING POC
JoomlaXplorer <1.6.2 - XSS
Cross-site scripting (XSS) vulnerability in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter in a show_error action to index.php.
CVE-2008-0148 EXPLOITDB text WORKING POC
Tutos - Access Control
TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.
CVE-2008-0490 EXPLOITDB text WORKING POC
Wordpress WP Cal Plugin - SQL Injection
SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-0491 EXPLOITDB text WORKING POC
Fgallery - SQL Injection
SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.
CVE-2008-0149 EXPLOITDB text WORKING POC
TUTOS 1.3 - Info Disclosure
TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.
EIP-2026-111313 EXPLOITDB text WORKING POC
PK-Designs PKs Movie Database 3.0.3 - Cross-Site Scripting / SQL Injection
CVE-2008-0566 EXPLOITDB text WORKING POC
Deltascripts Php Links - Code Injection
PHP remote file inclusion vulnerability in includes/smarty.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path_to_public_program parameter.
CVE-2007-4920 EXPLOITDB java WORKING POC
Php Webquest < 2.5 - SQL Injection
SQL injection vulnerability in soporte_derecha_w.php in PHP Webquest 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id_actividad parameter.
CVE-2008-0565 EXPLOITDB text WORKING POC
Deltascripts Php Links < 1.3 - SQL Injection
SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
EIP-2026-109288 EXPLOITDB perl WORKING POC
Mambo Component Galleries 1.0 - 'aid' SQL Injection
CVE-2008-5226 EXPLOITDB perl WORKING POC
MambAds 1.0 RC1 - SQL Injection
SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQL commands via the ma_cat parameter in a view action to index.php, a different vector than CVE-2007-5177.
EIP-2026-108837 EXPLOITDB perl WORKING POC
Joomla! Component QuickTime VR 0.1 - SQL Injection
EIP-2026-108804 EXPLOITDB text WORKING POC
Joomla! Component mygallery - 'cid' SQL Injection
CVE-2008-1849 EXPLOITDB text WORKING POC
Mambo/Joomla! <1.6.2 - Path Traversal
Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter in a show_error action.
EIP-2026-108201 EXPLOITDB perl WORKING POC
Joomla! Component altas 1.0 - Multiple SQL Injections
EIP-2026-108678 EXPLOITDB perl WORKING POC
Joomla! Component is 1.0.1 - Multiple SQL Injections
CVE-2008-4764 EXPLOITDB text WORKING POC
Com Extplorer < 2.0.0 - Path Traversal
Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action.
CVE-2008-0468 EXPLOITDB text WORKING POC
Flinx < 1.3 - SQL Injection
SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-0745 EXPLOITDB text WORKING POC
Domphp - Path Traversal
Directory traversal vulnerability in aides/index.php in DomPHP 0.82 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVE-2008-0502 EXPLOITDB perl WORKING POC
Connectix Boards < 0.8.2 - Code Injection
PHP remote file inclusion vulnerability in templates/Official/part_userprofile.php in Connectix Boards 0.8.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the template_path parameter.
CVE-2008-2217 EXPLOITDB text WORKING POC
Mario Valdez Content Management System - Path Traversal
Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cm_imgpath parameter.