Exploitdb Exploits

31,394 exploits tracked across all sources.

Sort: Activity Stars

CVE-2006-4596 EXPLOITDB text VERIFIED

mybace_light - Remote File Inclusion via hauptverzeichniss or template_back Parameter

PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.

by Philipp Niedziela

View

CVE-2006-4597 EXPLOITDB text VERIFIED

icblogger < 2.0 - SQL Injection via YID Parameter

SQL injection vulnerability in devam.asp in ICBlogger 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the YID parameter.

by Chironex Fleckeri

View

CVE-2006-4532 EXPLOITDB text VERIFIED

YACS CMS <6.6.1 - Remote Code Execution

PHP remote file inclusion vulnerability in articles/article.php in Yet Another Community System (YACS) CMS 6.6.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the context[path_to_root] parameter.

by MATASANOS

View

CVE-2006-4559 EXPLOITDB text VERIFIED

YACS CMS 6.6.1 - Remote Code Execution

Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System (YACS) CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the context[path_to_root] parameter in (1) articles/populate.php, (2) categories/category.php, (3) categories/populate.php, (4) comments/populate.php, (5) files/file.php, (6) sections/section.php, (7) sections/populate.php, (8) tables/populate.php, (9) users/user.php, and (10) users/populate.php. The articles/article.php vector is covered by CVE-2006-4532.

by MATASANOS

View

EIP-2026-106956 EXPLOITDB text VERIFIED

ExBB 1.9.1 - 'Home_Path' Multiple Remote File Inclusions

by Matdhule

View

CVE-2006-4594 EXPLOITDB text VERIFIED

PHP Advanced Transfer Manager <1.21 - RCE

Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the include_location parameter in (1) confirm.php or (2) login.php. NOTE: the include_location parameter to index.php is already covered by CVE-2005-1681.

by KinSize

View

CVE-2006-4479 EXPLOITDB text VERIFIED

Visual Shapers ezContents 2.0.3 - Cross-Site Scripting via subgroupname Parameter

Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the subgroupname parameter.

by DarkFig

View

CVE-2006-4478 EXPLOITDB text VERIFIED

Visual Shapers ezContents 2.0.3 - SQL Injection via Groupname Parameter

SQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL commands via the groupname parameter.

by DarkFig

View

CVE-2006-4749 EXPLOITDB text VERIFIED

PHP Advanced Transfer Manager <1.20 - RCE

Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code via the include_location parameter in (1) activate.php, (2) configure.php, (3) fileop.php, (4) getimg.php, (5) ipblocked.php, (6) register.php, (7) showrecent.php, (8) showtophits.php, (9) usrmanag.php, (10) viewer_bottom.php, (11) viewer_content.php, and (12) viewer_top.php. NOTE: The login.php and confirm.php vectors are already covered by CVE-2006-4594.

by KinSize

View

CVE-2006-4540 EXPLOITDB text VERIFIED

Learn.com LearnCenter - Cross-Site Scripting via id Parameter

Cross-site scripting (XSS) vulnerability in learncenter.asp in Learn.com LearnCenter allows remote attackers to inject arbitrary web script or HTML via the id parameter.

by Crack_MaN

View

CVE-2006-4497 EXPLOITDB text VERIFIED

IwebNegar 1.1 - SQL Injection via Comments.php id Parameter

SQL injection vulnerability in comments.php in IwebNegar 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

by Hessam-x

View

CVE-2006-4543 EXPLOITDB text VERIFIED

HLStats 1.34 - Cross-Site Scripting via Multiple Parameters

Cross-site scripting (XSS) vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the (1) game parameter in players mode, the (2) weapon parameter in weaponinfo mode, the (3) st parameter in search mode, the (4) action parameter in actioninfo mode, and the (5) map parameter in mapinfo mode.

by MC.Iglo

View

CVE-2006-4477 EXPLOITDB text VERIFIED