muuratsalo

25 exploits Active since Feb 2008
CVE-2011-4333 EXPLOITDB MEDIUM WRITEUP
LabWiki <1.1 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from parameter to index.php or the (2) page_no parameter to recentchanges.php.
CVSS 6.1
CVE-2008-5580 EXPLOITDB text WORKING POC
mini-pub <0.3 - Command Injection
mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument.
CVE-2008-5579 EXPLOITDB text WORKING POC
mini-pub <0.3 - Path Traversal
Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in the sFileName parameter.
CVE-2011-4672 EXPLOITDB text WORKING POC
Valid Tiny-erp < 1.6 - SQL Injection
Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _partner_list.php, (2) proioncategory_list.php, (3) _rantevou_list.php, (4) syncategory_list.php, (5) synallasomenos_list.php, (6) ypelaton_list.php, and (7) yproion_list.php.
CVE-2008-1324 EXPLOITDB text WORKING POC
Travelsized CMS 0.4.1 - Path Traversal
Multiple directory traversal vulnerabilities in index.php in Travelsized CMS 0.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1325.
CVE-2008-1325 EXPLOITDB text WORKING POC
Uberghey CMS 0.3.1 - Path Traversal
Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1324.
CVE-2008-0822 EXPLOITDB text WORKING POC
Scribe - Path Traversal
Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a .. (dot dot) in the page parameter.
CVE-2008-0703 EXPLOITDB text WORKING POC
Sflog < 0.96 - Path Traversal
Multiple directory traversal vulnerabilities in sflog! 0.96 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) permalink or (2) section parameter to index.php, possibly involving includes/entries.inc.php and other files included by index.php.
CVE-2008-0819 EXPLOITDB text WRITEUP
Plutostatus Locator - Path Traversal
Directory traversal vulnerability in index.php in PlutoStatus Locator 1.0 pre alpha allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVE-2011-5183 EXPLOITDB text WRITEUP
Bioinformatics Ordersys < 1.6.3 - SQL Injection
Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the where_clause parameter to (1) index.php, (2) index_long.php, or (3) index_short.php in ordering/interface_creator/.
CVE-2008-0559 EXPLOITDB text WRITEUP
Nilsons Blogger - Path Traversal
Multiple directory traversal vulnerabilities in Nilson's Blogger 0.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the permalink parameter in core.php, accessed through index.php; and (2) the thispost parameter in comments.php.
CVE-2008-5581 EXPLOITDB text WORKING POC
mini-pub 0.3 - RCE
PHP remote file inclusion vulnerability in mini-pub.php/front-end/img.php in mini-pub 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the sFileName parameter.
CVE-2008-0840 EXPLOITDB text WORKING POC
Publicwarehouse Lightblog - Path Traversal
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the username parameter.
CVE-2008-1170 EXPLOITDB text WRITEUP
KCWiki 1.0 - RCE
Multiple PHP remote file inclusion vulnerabilities in KCWiki 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the page parameter to (1) minimal/wiki.php and (2) simplest/wiki.php.
CVE-2008-1170 EXPLOITDB text WRITEUP
KCWiki 1.0 - RCE
Multiple PHP remote file inclusion vulnerabilities in KCWiki 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the page parameter to (1) minimal/wiki.php and (2) simplest/wiki.php.
EIP-2026-109059 EXPLOITDB text WRITEUP
LabStoRe 1.5.4 - SQL Injection
CVE-2011-4334 EXPLOITDB HIGH text WRITEUP
LabWiki <1.1 - RCE
edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter.
CVSS 8.8
CVE-2011-4094 EXPLOITDB CRITICAL text STUB
Jara 1.6 - SQL Injection
Jara 1.6 has a SQL injection vulnerability.
CVSS 9.8
CVE-2011-5109 EXPLOITDB text WRITEUP
John GEO Freelancer Calendar < 1.01 - SQL Injection
Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php in the worldcalendar directory.
CVE-2012-0869 EXPLOITDB text WRITEUP
Frams' Fast File EXchange <20120215 - XSS
Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVE-2011-5110 EXPLOITDB text WORKING POC
John GEO Blogs Manager < 1.101 - SQL Injection
Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _authors_list.php, (2) _blogs_list.php, (3) _category_list.php, (4) _comments_list.php, (5) _policy_list.php, (6) _rate_list.php, (7) categoriesblogs_list.php, (8) chosen_authors_list.php, (9) chosen_blogs_list.php, (10) chosen_comments_list.php, and (11) help_list.php in blogs/.
CVE-2008-0798 EXPLOITDB text WORKING POC
Artmedic Webdesign Artmedic Weblog - Path Traversal
Multiple directory traversal vulnerabilities in artmedic webdesign weblog 1.0, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ta parameter to artmedic_index.php, reached through index.php; and the (2) date parameter to artmedic_print.php.
CVE-2008-0812 EXPLOITDB text WORKING POC
Net Banpro Dms - Path Traversal
Directory traversal vulnerability in DMS/index.php in BanPro DMS 1.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the action parameter.
EIP-2026-105337 EXPLOITDB text WRITEUP
awiki 20100125 - Multiple Local File Inclusions
EIP-2026-105255 EXPLOITDB text WRITEUP
artmedic webdesign weblog - Multiple Local File Inclusions