Perl Exploits
2,849 exploits tracked across all sources.
myAlbum-P < 2.0 - SQL Injection via cid Parameter
SQL injection vulnerability in modules/myalbum/viewcat.php in the myAlbum-P 2.0 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
by ajann
Kshop < 1.17 - SQL Injection via product_details.php id Parameter
SQL injection vulnerability in product_details.php in the Kshop 1.17 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ajann
eCal 2.24 and earlier - SQL Injection via katid Parameter
SQL injection vulnerability in display.php in the eCal 2.24 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the katid parameter.
by ajann
Camportail < 1.1 - SQL Injection via show.php camid Parameter
SQL injection vulnerability in show.php in the Camportail 1.1 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the camid parameter in a showcam action.
by ajann
Tutoriais module for Xoops - SQL Injection via cid Parameter
SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
by ajann
Xoops Library Module - SQL Injection via viewcat.php cid Parameter
SQL injection vulnerability in viewcat.php in the Library module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
by ajann
Xoops Core Module - SQL Injection via viewcat.php cid Parameter
SQL injection vulnerability in viewcat.php in the Core module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-0377.
by ajann
PHP-Fusion Expanded Calendar Module 2.00 - SQL Injection via m_month Parameter
SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the m_month parameter.
by UNIQUE-KEY
Xoops Repository Module - SQL Injection via viewcat.php cid Parameter
SQL injection vulnerability in viewcat.php in the Repository module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
by ajann
Xoops MyAds Module < 2.04 - SQL Injection via cid Parameter
SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, different vectors than CVE-2006-3341.
by ajann
sBLOG 0.7.3 Beta - Directory Traversal and Remote Code Execution via conf_lang_default Parameter
Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
by GoLd_M
Xoops Friendfinder Module < 3.3 - SQL Injection via id Parameter
SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ajann
Xoops Articles Module < 1.02 - SQL Injection via print.php id Parameter
SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ajann
Xoops Articles Module < 1.02 - SQL Injection via print.php id Parameter
SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
by WiLdBoY
IceBB 1.0-rc5 - Authenticated SQL Injection via Avatar Upload Filename
SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.
by Hessam-x
Addressbook 1.2 - Directory Traversal and Arbitrary File Execution via module_name Parameter
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
by bd0rk
IceBB 1.0-rc5 - Authenticated SQL Injection via Avatar Upload Filename
SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.
by Hessam-x
IceBB 1.0-rc5 - Authenticated Arbitrary File Upload via Avatar Function
Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitrary files via the avatar function, which can later be accessed in uploads/.
by Hessam-x
Mambo Flatmenu < 1.7 - Remote File Inclusion via mosConfig_absolute_path Parameter
PHP remote file inclusion vulnerability in mod_flatmenu.php in the Flatmenu 1.07 and earlier Mambo module allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
by Cold Zero
Asterisk < 1.2.17 and 1.4.x < 1.4.2 - Denial of Service via SIP INVITE with Malformed SDP
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
by MADYNES
Mercury/32 4.01a - Authenticated Buffer Overflow via IMAP Command Arguments
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.
by Jacopo Cervini
By Source