Perl Exploits
2,849 exploits tracked across all sources.
Red Hat Enterprise Linux 5 and Fedora 6-8 - Denial of Service via CWD Command Memory Leak
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands, as demonstrated by an attack on a daemon with the deny_file configuration option.
by Praveen Darshanam
IBM Lotus Sametime < 7.5.1 CF1 and 8.x < 8.0.1 - Remote Code Execution via Crafted URL
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.
by Manuel Santamarina Suarez
EntertainmentScript 1.4.0 - Path Traversal via Page Parameter
Directory traversal vulnerability in page.php in EntertainmentScript 1.4.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
by Stack
AlkalinePHP < 0.80.00 - SQL Injection via Thread ID Parameter
SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Stack
PHP-AGTC Membership System 1.1a - Unauthenticated Account Creation via adduser.php
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin (userlevel 4) privileges.
by t0pP8uZz
MyPicGallery 1.0 - Unauthenticated Authentication Bypass via userID Parameter
MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php.
by t0pP8uZz
MeltingIce File System 1.0 - Unauthenticated Authentication Bypass and Privilege Escalation via Direct Request
MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php.
by t0pP8uZz
FicHive 1.0 - SQL Injection via Category Parameter
SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter in a Fiction action, possibly related to sources/fiction.class.php.
by His0k4
FicHive 1.0 - SQL Injection via Search Letter Parameter
SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the letter parameter in a Search action, a different vector than CVE-2008-2416. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by His0k4
Archangel Weblog < 0.90.02 - SQL Injection via post_id Parameter
SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands via the post_id parameter.
by Stack
Turnkey Web Tools SunShop Shopping Cart 3.5.1 - SQL Injection via index.php id Parameter
SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action, a different vector than CVE-2008-2038, CVE-2007-4597, and CVE-2007-2549.
by irvian
Pet Grooming Management System 2.0 - Privilege Escalation via Direct Request to useradded.php
Pet Grooming Management System 2.0 allows remote attackers to gain privileges via a direct request to useradded.php with a modified user name for "admin."
by t0pP8uZz
Battle.net Clan Script < 1.5.3 - SQL Injection via showmember Parameter
SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showmember parameter in a members action.
by Stack
YABSoft Advanced Image Hosting Script < 2.1 - SQL Injection via out.php t Parameter
SQL injection vulnerability in out.php in YABSoft Advanced Image Hosting (AIH) Script 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the t parameter.
by Stack
Joomla com_xsstream-dm 0.01 Beta - SQL Injection via Movie Parameter
SQL injection vulnerability in the xsstream-dm (com_xsstream-dm) component 0.01 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the movie parameter to index.php.
by Houssamix
rdesktop 1.5.0 - Remote Code Execution via RDP Redirect Request Length Fields
Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol (RDP) redirect request with modified length fields.
by Guido Landi
SazCart < 1.5 - SQL Injection via prodid Parameter
SQL injection vulnerability in index.php in SazCart 1.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a details action.
by JosS
TFTP Server SP 1.4 and 1.5 - Remote Code Execution via Long TFTP Error Packet
Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a long TFTP error packet. NOTE: some of these details are obtained from third party information.
by tixxDZ
orenosv_http_ftp_server < 0.8.1 - Authenticated Buffer Overflow via Long FTP Command Arguments
Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, which are processed by the (1) ftp_xlate_path, (2) ftp_is_canonical, or (3) os_fn_nativize functions, or (4) a long SSI command that is processed by the parse_cmd function in cgissi.exe.
by Samsta
vShare YouTube Clone 2.6 - SQL Injection via tid Parameter
SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
by Saime
rdesktop 1.5.0 - Integer Underflow in iso_recv_msg Function
Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.
by Guido Landi
OneCMS 2.5 - SQL Injection via sitename Parameter
SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the sitename parameter.
by Cod3rZ
iGaming CMS 1.5 - SQL Injection via poll_vote.php id Parameter
SQL injection vulnerability in poll_vote.php in iGaming CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Cod3rZ
Scout Portal Toolkit <= 1.3.1 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php. NOTE: it was later reported that vector 1 is also present in 1.4.0.
by JosS
By Source