Text Exploits
31,386 exploits tracked across all sources.
Douran Portal 3.9.7.8 - Info Disclosure
download.aspx in Douran Portal 3.9.7.8 allows remote attackers to obtain source code of arbitrary files under the web root via (1) a trailing ".", (2) a trailing space, or (3) mixed case in the FileNameAttach parameter.
by AJAX Security Team
XOOPS 2.x - Multiple Cross-Site Scripting Vulnerabilities
by Aung Khant
PHP < 5.3.6 - Denial of Service via Empty ZIP Archive in Zip Extension
The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.
by Maksymilian Arciemowicz
Microsoft Source Code Analyzer for SQL Injection 1.3 - Improper Permissions
by LiquidWorm
WordPress Plugin Sodahead Polls 2.0.2 - Multiple Cross-Site Scripting Vulnerabilities
by High-Tech Bridge SA
WordPress Plugin Rating-Widget 1.3.1 - Multiple Cross-Site Scripting Vulnerabilities
by Todor Donev
WikiWig 5.01 - Cross-Site Scripting via SpellChecker Module Parameters
Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as used in WikiWig 5.01 and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) to_p_dict or (2) to_r_list parameter. NOTE: this issue might be related to the htmlarea plugin and CVE-2013-5670.
by AutoSec Tools
pointter PHP content management system 1.2 - Multiple Vulnerabilities
by LiquidWorm
LotusCMS 3.0.3 - Multiple Vulnerabilities
by High-Tech Bridge SA
SugarCRM < 6.1.3 - Authenticated Information Disclosure via ShowDuplicates Action
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
by RedTeam Pentesting GmbH
BoutikOne - 'search.php' Multiple SQL Injections
by cdx.security
By Source