the master

16 exploits Active since Aug 2006
CVE-2006-5506 EXPLOITDB text WORKING POC
WiClear 0.10 - Remote Code Execution via Path Parameter in Multiple PHP Scripts
Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path parameter in (1) inc/prepend.inc.php, (2) inc/lib/boxes.lib.php, (3) inc/lib/tools.lib.php, (4) tools/trackback/index.php, and (5) tools/utf8conversion/index.php in admin/; and (6) prepend.inc.php, (7) lib/boxes.lib.php, and (8) lib/history.lib.php in inc/.
CVE-2006-6716 EXPLOITDB text WORKING POC
Eric GUILLAUME uploader&downloader 3 - SQL Injection
SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote attackers to execute arbitrary SQL commands via the id_user parameter.
CVE-2006-4205 EXPLOITDB text WORKING POC
WebDynamite ProjectButler 0.8.4 - RCE
Multiple PHP remote file inclusion vulnerabilities in WebDynamite ProjectButler 0.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to /classes/ scripts including (1) Cache.class.php, (2) Customer.class.php, (3) Performance.class.php, (4) Project.class.php, (5) Representative.class.php, (6) User.class.php, or (7) common.php.
CVE-2006-6842 EXPLOITDB text WORKING POC
phpBB2 Plus 1.53 - Acronym Mod 0.9.5 - SQL Injection
SQL injection vulnerability in admin/admin_acronyms.php in the Acronym Mod 0.9.5 for phpBB2 Plus 1.53 allows remote attackers to execute arbitrary SQL commands via the id parameter.
EIP-2026-110907 EXPLOITDB text WORKING POC
PHP/Mysql Site Builder 0.0.2 - 'htm2PHP.php' File Disclosure
EIP-2026-111006 EXPLOITDB text WRITEUP
PHPBuilder 0.0.2 - 'HTM2PHP.php' Directory Traversal
CVE-2006-7081 EXPLOITDB text WORKING POC
PhpNews 1.0 - Remote Code Execution
Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3.
EIP-2026-111189 EXPLOITDB text WORKING POC
PHProjekt 6.1 - 'path_pre' Multiple Remote File Inclusions
CVE-2006-4609 EXPLOITDB text WORKING POC
PHProjekt <0.6.1 - Remote Code Execution
Multiple PHP remote file inclusion vulnerabilities in the Content Management module ("Content manager") for PHProjekt 0.6.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the path_pre parameter in (1) cm_lib.inc.php, (2) doc/br.edithelp.php, (3) doc/de.edithelp.php, (4) doc/ct.edithelp.php, (5) userrating.php, and (6) listing.php, a different set of vectors than CVE-2006-4204. NOTE: a third-party researcher has disputed the impact of the cm_lib.inc.php vector, stating that it is limited to local file inclusion. CVE analysis as of 20060905 concurs, although use of ftp URLs is also possible. The remaining five vectors have also been disputed by the same third party, stating that the path_pre variable is initialized before it is used
CVE-2006-4489 EXPLOITDB text WORKING POC
MiniBill < 1.2.2 - Remote File Inclusion via config[include_dir] or config[plugin_dir]
Multiple PHP remote file inclusion vulnerabilities in MiniBill 2006-07-14 (1.2.2) allow remote attackers to execute arbitrary PHP code via (1) a URL in the config[include_dir] parameter in actions/ipn.php or (2) an FTP path in the config[plugin_dir] parameter in include/initPlugins.php.
EIP-2026-107661 EXPLOITDB text WORKING POC
HPE 1.0 - HPEinc Remote File Inclusion (2)
EIP-2026-107564 EXPLOITDB text WORKING POC
Headline Portal Engine 0.x/1.0 - 'HPEInc' Multiple Remote File Inclusions
CVE-2006-6216 EXPLOITDB text WORKING POC
Nivisec Hacks List < 1.21 - SQL Injection via hack_id Parameter
SQL injection vulnerability in admin_hacks_list.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remote attackers to execute arbitrary SQL commands via the hack_id parameter.
CVE-2006-5523 EXPLOITDB text WORKING POC
ez-ticket 0.0.1 - Remote File Inclusion via ezt_root_path Parameter
PHP remote file inclusion vulnerability in common.php in EZ-Ticket 0.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ezt_root_path parameter.
CVE-2006-4123 EXPLOITDB text WORKING POC
Boite de News 4.0.1 - Remote File Inclusion via url_index Parameter
PHP remote file inclusion vulnerability in boitenews4/index.php in Boite de News 4.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the url_index parameter.
EIP-2026-105431 EXPLOITDB text WORKING POC
Beautifier 0.1 - 'Core.php' Remote File Inclusion