Exploitdb Exploits
31,344 exploits tracked across all sources.
Apache Shiro < 1.0.0 - Path Traversal
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
by Luke Taylor
Libfuse < 2.8.5 - Symlink Following
FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.
by halfdog
Site2nite Vacation Rental Listings - SQL Injection
SQL injection vulnerability in detail.asp in Site2Nite Vacation Rental (VRBO) Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by L0rd CrusAd3r
Site2nite Business E-listings - SQL Injection
SQL injection vulnerability in detail.asp in Site2Nite Business e-Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by L0rd CrusAd3r
Onlinetechtools.com Oasys Professional - SQL Injection
SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: some of these details are obtained from third party information.
by L0rd CrusAd3r
Digger Solutions NewsLetter Open Source - SQL Injection
by L0rd CrusAd3r
Comrie Software Pay Roll Time Sheet & Punch Card - Authentication Bypass
by L0rd CrusAd3r
Yaws - Path Traversal
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences.
by nitr0us
Deliciousdays Cforms - XSS
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
by Wagner Elias
SmartOptimizer - Null Character Remote Information Disclosure
by Francois Harvey
Elastix 2.0.2 - Multiple Cross-Site Scripting Vulnerabilities
by dave b
O-dyn Collabtive - SQL Injection
SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action.
by Anatolia Security
Home File Share Server 0.7.2 32 - Directory Traversal
by John Leitch
douran portal 3.9.7.55 - Multiple Vulnerabilities
by ITSecTeam
Douran Portal 3.9.7.55 - Arbitrary File Upload / Cross-Site Scripting
by ITSecTeam
Pulseinfotech Com Sponsorwall - SQL Injection
SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
by FL0RiX
Pulseinfotech Com Flipwall - SQL Injection
SQL injection vulnerability in the Pulse Infotech Flip Wall (com_flipwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
by FL0RiX
Simpli Easy (AFC Simple) NewsLetter 4.2 - Cross-Site Scripting / Information Leakage
by p0deje
By Source