Exploitdb Exploits
31,394 exploits tracked across all sources.
phpfaber Content Management System < 1.3.36 - Cross-Site Scripting in htmlarea.php
Cross-site scripting (XSS) vulnerability in cms_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on 20061026 allows remote attackers to inject arbitrary web script or HTML, probably via arbitrary parameters in the query string, as demonstrated with a vigilon parameter. NOTE: earlier downloads of 1.3.36 have the vulnerability; the software was updated without changing the version number.
by Vigilon
PHP Advanced Transfer Manager 1.30 - Remote Unauthorized Access
by Zeelock
MiniGal 2 (MG2) <0.5.1 - Info Disclosure
MiniGal 2 (MG2) 0.5.1 allows remote attackers to list password protected images via a request to index.php with the list parameter set to * (wildcard) and the page parameter set to all.
by Preben Nylokken
PBLang 4.65 - Multiple Cross-Site Scripting Vulnerabilities
by abducter
ATutor 1.4.1-1.5.1-pl1 - Remote File Inclusion via Section Parameter Null Byte Injection
Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte (%00) in (1) body_header.inc.php and (2) print.php.
by Andreas Sandblad
ATutor 1.4.1-1.5.1-pl1 - Remote Code Execution via Forum Parameter Injection
ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter with either the (1) asc or (2) desc parameters set, possibly due to an eval injection vulnerability.
by Andreas Sandblad
ATutor 1.4.1-1.5.1-pl1 - Remote File Inclusion via Section Parameter Null Byte Injection
Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte (%00) in (1) body_header.inc.php and (2) print.php.
by Andreas Sandblad
Novell ZENworks Patch Management < 6.2.2.181 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL commands via the (1) Direction parameter to computers/default.asp, and the (2) SearchText, (3) StatusFilter, and (4) computerFilter parameters to reports/default.asp.
by Dennis Rand
Novell ZENworks Patch Management < 6.2.2.181 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL commands via the (1) Direction parameter to computers/default.asp, and the (2) SearchText, (3) StatusFilter, and (4) computerFilter parameters to reports/default.asp.
by Dennis Rand
ASP Fast Forum - Cross-Site Scripting via Error Parameter
Cross-site scripting (XSS) vulnerability in error.asp in ASP Fast Forum allows remote attackers to inject arbitrary web script or HTML via the error parameter.
by syst3m_f4ult
Snoopy 1.2 - Remote Code Execution via HTTPS URL Shell Metacharacters
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
by D. Fabian
Saphp Lesson - SQL Injection via ForumID Parameter
SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to execute arbitrary SQL commands via the forumid parameter in (1) showcat.php and (2) add.php.
by almaster
Mantis Bug Tracker 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
by Andreas Sandblad
IPBProArcade 2.5.2 - SQL Injection via GameID Parameter
SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via the gameid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, the demonstration code as used by third parties suggests that this might be a different type of vulnerability related to shell metacharacters. Finally, this could be a rediscovery of CVE-2004-1430.
by almaster
gCards 1.43 - SQL Injection via News.php Limit Parameter
SQL injection vulnerability in news.php in gCards version 1.43 allows remote attackers to execute arbitrary SQL commands via the limit parameter.
by svsecurity
Flyspray 0.9.7-0.9.8 - Cross-Site Scripting via Multiple Parameters
Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID, (2) task, (3) string, (4) type, (5) serv, (6) due, (7) dev, and (8) sort2 parameters.
by Lostmon
FlatNuke 2.5.x - 'index.php' Cross-Site Scripting
by alex@aleksanet.com
Belchior Foundry vCard 2.9 - Remote File Inclusion via match Parameter
PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.
by X
RSA Authentication Agent for Web < 5.3 - Cross-Site Scripting via Image Parameter in GetPic Operation
Cross-site scripting (XSS) vulnerability in RSA Authentication Agent for Web 5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter in a GetPic operation.
by Bernhard Mueller
Analysis Console for Intrusion Databases and Basic Analysis and Security Engine - SQL Injection via sig Parameter
Multiple SQL injection vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers to execute arbitrary SQL commands via the sig[1] parameter and possibly other parameters.
by Remco Verhoef
Nuked Klan 1.7 - SQL Injection via Forum, Links, Sections, or Download Parameters
Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id parameter in the Download file.
by papipsycho
Nuked Klan 1.7 - SQL Injection via Forum, Links, Sections, or Download Parameters
Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id parameter in the Download file.
by papipsycho
Nuked Klan 1.7 - SQL Injection via Forum, Links, Sections, or Download Parameters
Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id parameter in the Download file.
by papipsycho
Zomplog 3.4 - Cross-Site Scripting via Name, Comment, Username, or Search Parameter
Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) comment parameter in detail.php, (3) the username parameter in get.php, and (4) the search parameter in index.php.
by sikikmail
FlatNuke 2.5.6 - Directory Traversal via User or Quale Parameter
Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the (1) user parameter in a profile operation or (2) quale parameter in a newtopic operation.
by abducter_minds@yahoo.com
By Source