Exploitdb Exploits
31,394 exploits tracked across all sources.
Cyclope Employee Surveillance Solution 6.0 6.1.0 6.2.0 - Multiple Vulnerabilities
by loneferret
xt:Commerce 3.04 SP2.1 - Blind SQL Injection
by stoffline.com
IBM WebSphere MQ File Transfer Edition <= 7.0.4 - Authenticated Arbitrary File Read via Web Gateway URI
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
by Nir Valtman
IBM WebSphere MQ File Transfer Edition < 7.0.4 and WebSphere MQ Managed File Transfer 7.5 - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI, (2) modify permissions via the /wmqfteconsole/FileSpacePermisssions URI, or (3) add MQ Message Descriptor (MQMD) user accounts via the /wmqfteconsole/UploadUsers URI.
by Nir Valtman
WordPress Plugin RSVPMaker 2.5.4 - Persistent Cross-Site Scripting
by Chris Kellum
Total Shop UK eCommerce < 2.1.2_p1 - Cross-Site Scripting via PATH_INFO
Cross-site scripting (XSS) vulnerability in the refresh_page function in application/modules/_main/views/_top.php in Total Shop UK eCommerce Open Source before 2.1.2_p1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
by Chris Cooper
Hotel Booking Portal 0.1 - Multiple Vulnerabilities
by Yakir Wizman
Oracle Solaris - Arbitrary File Write via Symlink Attack on /tmp/CLEANUP
Certain patch-installation scripts in Oracle Solaris allow local users to append data to arbitrary files via a symlink attack on the /tmp/CLEANUP temporary file, related to use of Update Manager.
by Larry Cashdollar
MindTouch DekiWiki - Multiple Local/Remote File Inclusions
by L0n3ly-H34rT
Flynax General Classifieds CMS 4.0 - Multiple Vulnerabilities
by Vulnerability-Lab
FileContral - Local File Inclusion / Local File Disclosure
by Ashiyane Digital Security Team
MobileCartly 1.0 - Unauthenticated Arbitrary File Creation via savepage.php
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to savepage.php, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote code execution.
by Yakir Wizman
GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host - Local File Inclusion
by L0n3ly-H34rT
Hotel Booking Portal 0.1 - Multiple SQL Injections / Cross-Site Scripting
by Yakir Wizman
phplist < 2.10.19 - Cross-Site Scripting via Unconfirmed Parameter
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
by High-Tech Bridge SA
phplist < 2.10.19 - Authenticated SQL Injection via Edit Attributes Delete Parameter
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.
by High-Tech Bridge SA
By Source