Exploitdb Exploits
31,394 exploits tracked across all sources.
TotalCalendar - Remote File Inclusion Code Execution
PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
by VietMafia
ModernBill < 4.3.2 - SQL Injection via User ID or Admin Where/Order Parameters
Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the (1) id parameter in (a) user.php, or (2) where and (3) order parameters to (b) admin.php.
by r0t
CuteNews 1.4.1 - Directory Traversal and Cross-Site Scripting via Editnews Source Parameter
Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.
by LoK-Crew
KRANKIKOM ContentBoxX - Cross-Site Scripting via Login Action Parameter
Cross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter.
by botan
Article Publisher Pro < 1.0.1 - SQL Injection via category.php cname Parameter
SQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cname parameter.
by r0t
Cisco Wireless LAN Solution Engine < 2.13 - Cross-Site Scripting via archiveApplyDisplay.jsp displayMsg Parameter
Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to archiveApplyDisplay.jsp, aka bug ID CSCsc01095.
by Adam Pointon
xFlow < 5.46.11 - SQL Injection via Position or ID Parameter
Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) position and (2) id parameter.
by r0t
xFlow < 5.46.11 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) level, (2) position, (3) id, and (4) action parameters to members_only/index.cgi, and the (5) page parameter to customer_area/index.cgi.
by r0t
visale < 1.0 - Cross-Site Scripting via keyval, catsubno, or listno Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.
by r0t
visale < 1.0 - Cross-Site Scripting via keyval, catsubno, or listno Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.
by r0t
visale < 1.0 - Cross-Site Scripting via keyval, catsubno, or listno Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.
by r0t
IntelliLink Pro <= 5.06 - Cross-Site Scripting via URL Parameter in addlink_lwp.cgi and ID Parameters in edit.cgi
Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in edit.cgi.
by r0t
IntelliLink Pro <= 5.06 - Cross-Site Scripting via URL Parameter in addlink_lwp.cgi and ID Parameters in edit.cgi
Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in edit.cgi.
by r0t
SibSoft CommuniMail < 1.2 - Cross-Site Scripting via list_id and form_id Parameters
Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.
by r0t
SibSoft CommuniMail < 1.2 - Cross-Site Scripting via list_id and form_id Parameters
Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.
by r0t
PerlCoders BannerFarm <= 2.3 - Cross-Site Scripting via aff and cat Parameters
Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters.
by r0t
AWStats < 6.5 - Cross-Site Scripting via Config Parameter
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.
by r0t
RechnungsZentrale V2 1.1.3 - SQL Injection via User Field
SQL injection vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the User field.
by GroundZero Security
phplister 0.4.1 - Cross-Site Scripting via Page Parameter
Cross-site scripting (XSS) vulnerability in index.php in jjgan852 phpLister 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
by botan
phplinks < 2.1.3.1 - Cross-Site Scripting via Term Parameter
Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.
by r0t
xine 0.99.3 - Remote Code Execution via Format String in Playlist EXTINFO Filename
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.
by c0ntexb
TinyPHPForum 3.6 - Multiple Cross-Site Scripting Vulnerabilities (1)
by Hessam-x
phpFaber TopSites - Cross-Site Scripting via Page Parameter
Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary web script or HTML via the page parameter.
by botan
By Source