Text Exploits
31,337 exploits tracked across all sources.
XODA 0.4.5 - RCE
XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.
by Shai rod
JPM Article Blog Script 6 - 'tid' Cross-Site Scripting
by Mr.0c3aN
IOServer <1.0.19.0 - Path Traversal
Directory traversal vulnerability in the XML Server in IOServer before 1.0.19.0, when the Root Directory pathname lacks a trailing \ (backslash) character, allows remote attackers to read arbitrary files or list arbitrary directories via a .. (dot dot) in a URI.
by hinge
T-dah Webmail - Cross-Site Request Forgery / Persistent Cross-Site Scripting
by Yakir Wizman
Alpha Networks ADSL2/2+ Wireless Router ASL-26555 - Password Disclosure
by Alberto Ortega
ManageEngine OpUtils 6.0 - Persistent Cross-Site Scripting
by loneferret
SaltOS - 'download.php' Cross-Site Scripting
by Stefan Schurtz
ManageEngine OpStor 7.4 - Multiple Vulnerabilities
by Vulnerability-Lab
LISTSERV 16 - 'SHOWTPL' Cross-Site Scripting
by Jose Carlos de Arriba
Microsoft Internet Explorer - Use of Uninitialized Resource
The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability."
by Ciph3r
Cyclope Employee Surveillance Solution 6.0 6.1.0 6.2.0 - Multiple Vulnerabilities
by loneferret
xt:Commerce 3.04 SP2.1 - Blind SQL Injection
by stoffline.com
IBM Websphere MQ - Access Control
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
by Nir Valtman
By Source