Text Exploits
31,337 exploits tracked across all sources.
XAMPP 1.8.1 - XSS
XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp and execute cross-site scripting (XSS) attacks via the WriteIntoLocalDisk method.
by Manuel García Cárdenas
Simplerisk < 20130915-001 - CSRF
Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an add_project action.
by Ryan Dewhurst
Simone Tellini Mod Accounting < 0.5 - SQL Injection
SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote attackers to execute arbitrary SQL commands via a Host header.
by Wireghoul
FreeSMS - '/pages/crc_handler.php?scheduleid' SQL Injection
by Sarahma Security
FreeSMS - '/pages/crc_handler.php' Multiple Cross-Site Scripting Vulnerabilities
by Sarahma Security
Posnic Stock Management System 1.02 - Multiple Vulnerabilities
by Sarahma Security
HP 2620-24-poe+ Switch - CSRF
Cross-site request forgery (CSRF) vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method.
by Hubert Gradek
X2engine X2crm < 3.4.1 - Path Traversal
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php/admin/translationManager.
by High-Tech Bridge SA
X2engine X2crm < 3.4.1 - XSS
Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor.
by High-Tech Bridge SA
Good for Enterprise <2.2.4.1659 - XSS
Cross-site scripting (XSS) vulnerability in the Good for Enterprise app before 2.2.4.1659 for iOS allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail message.
by Mario
Rodrigo Coimbra Nospam Pti - SQL Injection
SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the comment_post_ID parameter.
by Alexandro Silva
SilverStripe CMS - Multiple HTML Injection Vulnerabilities
by Benjamin Kunz Mejri
Blue Coat ProxySG 5.x and Security Gateway OS - Denial of Service
by anonymous
Danny Morris Lazy Seo - Unrestricted File Upload
Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in lazy-seo/.
by Ashiyane Digital Security Team
Joomla! Component JVideoClip 1.5.1 - 'uid' SQL Injection
by SixP4ck3r
vTiger CRM <5.4.0 - SQL Injection
SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.
by High-Tech Bridge SA
WordPress Plugin RokMicroNews - 'thumb.php' Multiple Vulnerabilities
by MustLive
By Source