Exploitdb Exploits
1,269 exploits tracked across all sources.
DokuWiki 2006-03-09b - 'dwpage.php' System Disclosure
by rgod
DokuWiki 2006-03-09b - 'dwpage.php' Remote Code Execution
by rgod
SZEWO PhpCommander <3.0 - Path Traversal
Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
by Kacper
SoftBB 0.1 - Code Injection
Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a direct request.
by Kacper
pHNews alpha 1 - 'templates_dir' Remote Code Execution
by Kacper
PmWiki 2.1.19 - 'Zend_Hash_Del_Key_Or_Index' Remote Command Execution
by rgod
Tikiwiki Cms/groupware - Unrestricted File Upload
Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.
by rgod
osCommerce 2.1/2.2 - 'product_info.php' SQL Injection
by GulfTech Security
Phpgroupware - Path Traversal
Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the GLOBALS[phpgw_info][user][preferences][common][country] parameter.
by Kacper
e107 < 0.75 - GLOBALS Overwrite Remote Code Execution
by rgod
Cms Frogss - SQL Injection
SQL injection vulnerability in module/rejestracja.php in CMS Frogss 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the podpis parameter.
by Kacper
Phaos - Path Traversal
Directory traversal vulnerability in include_lang.php in Phaos 0.9.2 allows remote attackers to include arbitrary local files via ".." sequences in the lang parameter.
by Kacper
Simple Machines Forum (SMF) 1.1 rc2 (Windows) - 'lngfile' Local File Inclusion
by rgod
Joomla! Component Poll 1.0.10 - Arbitrary Add Votes
by trueend5
Devellion Cubecart - SQL Injection
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
by rgod
PHP <5.1.4 & <4.4.3 - Buffer Overflow
scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.
by Andi
XMB Software Extreme Message Board < 1.9.6 - Path Traversal
Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by header.php.
by rgod
myWebland myBloggie <2.1.4 - Info Disclosure
index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode, which reveals the table prefix in a SQL error message.
by rgod
Xchat < 2.6.7 - Denial of Service
Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via unspecified vectors involving the PRIVMSG command. NOTE: the vendor has disputed this vulnerability, stating that it does not affect 2.6.7 "or any recent version"
by ratboy
Mywebland Mybloggie < 2.1.4 - SQL Injection
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name parameters.
by rgod
By Source