Exploitdb Exploits
31,394 exploits tracked across all sources.
Mybulletinboard - SQL Injection
MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting (XSS) or SQL injection attacks.
by imei
Circle R Monster Top List < 1.4.2 - Remote Code Execution via Root Path Parameter
PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: It was later reported that 1.4.2 and earlier are affected.
by r0t
Manila 9.0.1 - Multiple Cross-Site Scripting Vulnerabilities
by Aaron Kaplan
jax_guestbook < 3.50 - Cross-Site Scripting via Page Parameter
Cross-site scripting (XSS) vulnerability in jax_guestbook.php in Jax Guestbook 3.1, 3.31, and 3.50 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
by ALMOKANN3
dbbs < 2.0-alpha - Cross-Site Scripting via ulocation or uhobbies Parameters
Multiple cross-site scripting (XSS) vulnerabilities in profile.php in DbbS 2.0-alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ulocation or (2) uhobbies parameters.
by rgod
Coppermine Photo Gallery 1.4.4 - Directory Traversal via Modified Dot Dot Slash in File Parameter
Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.
by imei
Calendarix - Cross-Site Scripting via ycyear Parameter
Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitrary web script or HTML via the ycyear parameter.
by botan
Blursoft Blur6ex 0.3.462 - 'index.php' Local File Inclusion
by Hamid Ebadi
TinyWebGallery 1.3 and 1.4 - Cross-Site Scripting via twg_album Parameter
Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.
by Qex
papoo 2.1.5 - Cross-Site Scripting via menuid or reporeid_print Parameter
Multiple cross-site scripting (XSS) vulnerabilities in Papoo 2.1.5 allow remote attackers to inject arbitrary web script or HTML via the menuid parameter to (1) index.php or (2) forum.php, or the (3) reporeid_print parameter to print.php.
by Rusydi Hasan
Modxcms - Path Traversal
Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.
by Rusydi Hasan
Modxcms - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be resultant from the directory traversal vulnerability.
by Rusydi Hasan
FarsiNews 2.5.3 Pro - Cross-Site Scripting via selected_search_arch Parameter
Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.
by amin emami
ar-blog 5.2 - Cross-Site Scripting via Print.php ID Parameter
Cross-site scripting (XSS) vulnerability in print.php in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
by ALMOKANN3
PowerClan 1.14 - SQL Injection via Member ID Parameter
SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.
by d4igoro
planetSearch+ < 2005-10-26 - Cross-Site Scripting via search_exp Parameter
Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via the search_exp parameter.
by d4igoro
Lifetype 1.0.3 - Cross-Site Scripting via Show Parameter in Template Operation
Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.
by Rusydi Hasan
Adobe Document Server for Reader Extensions 6.0 - XSS
Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via (1) the actionID parameter in ads-readerext and (2) the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses this issue.
by Tan Chew Keong
Adobe Document Server for Reader Extensions 6.0 - XSS
Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via (1) the actionID parameter in ads-readerext and (2) the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses this issue.
by Tan Chew Keong
W3C Amaya 9.4 - Buffer Overflow via Long Attribute Values
Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the TEXTAREA element, and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of "dozens of possible snippets."
by Thomas Waldegger
W3C Amaya 9.4 - Buffer Overflow via Long Attribute Values
Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the TEXTAREA element, and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of "dozens of possible snippets."
by Thomas Waldegger
Opera < 8.54 - Remote Code Execution via Stylesheet Attribute Length Check Bypass
Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings.
by SEC Consult
Mozilla Firefox 1.0.x/1.5 - HTML Parsing Null Pointer Dereference Denial of Service
by Thomas Waldegger
By Source