Text Exploits
31,386 exploits tracked across all sources.
Oracle Solaris 10/OpenSolaris - Info Disclosure
Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to affect confidentiality and integrity via unknown vectors related to su.
by prdelka
Ronny CMS 1.1 r935 - Multiple HTML Injection Vulnerabilities
by High-Tech Bridge SA
PluXml 5.0.1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
by High-Tech Bridge SA
Joomla! Jstore Component - Path Traversal via Controller Parameter
Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
by jos_ali_joe
Collabtive 0.6.5 - Cross-Site Scripting via User Profile Parameter
Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user profile feature to manageuser.php, (2) y parameter in a newcal action to manageajax.php, and the (3) pic parameter to thumb.php.
by Anatolia Security
Collabtive 0.6.5 - Cross-Site Request Forgery in Admin User Addition
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action.
by Anatolia Security
Oracle Fusion Middleware <11.1.1.2.0 - Info Disclosure
Unspecified vulnerability in the BPEL Console component in Oracle Fusion Middleware 11.1.1.1.0 and 11.1.1.2.0 allows remote authenticated users to affect integrity via unknown vectors.
by Alexander Polyakov
OrangeHRM 2.6.0.1 - Path Traversal via URI Parameter
Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uri parameter.
by ZonTa
Joomla! / Mambo Component com_trade - 'PID' Cross-Site Scripting
by FL0RiX
baconmap 1.0 - SQL Injection via doadd.php type Parameter
SQL injection vulnerability in doadd.php in BaconMap 1.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.
by John Leitch
baconmap 1.0 - Path Traversal via filepath Parameter
Directory traversal vulnerability in admin/updatelist.php in BaconMap 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filepath parameter.
by John Leitch
MG User-Fotoalbum 1.0.1 - SQL Injection
SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user_fotoalbum_panel) module 1.0.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the album_id parameter.
by Easy Laster
Site2Nite Auto e-Manager - SQL Injection
SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by KnocKout
JoomlaSeller JS Calendar 1.5.1-1.5.4 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in the JoomlaSeller JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in a jscalendar action to index.php. NOTE: some of these details are obtained from third party information.
by Salvatore Fresta
JS Calendar (com_jscalendar) 1.5.1-1.5.4 - SQL Injection
SQL injection vulnerability in the JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ev_id parameter in a details action to index.php. NOTE: some of these details are obtained from third party information.
by Salvatore Fresta
Joomla! com_cbe <1.4.10 - Path Traversal
Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabname parameter in a userProfile action to index.php. NOTE: this can be leveraged to execute arbitrary code by using the file upload feature.
by Delf Tonder
Chipmunk Pwngame 1.0 - SQL Injection
Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to authenticate.php and the (3) ID parameter to pwn.php. NOTE: some of these details are obtained from third party information.
by KnocKout
Lantern CMS - '11-login.asp' Cross-Site Scripting
by High-Tech Bridge SA
Truworth Flex Timesheet - SQL Injection
Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
by KnocKout
Oracle Solaris 8-11 Express - DoS
Unspecified vulnerability in the FTP Server in Oracle Solaris 8, 9, 10, and 11 Express allows remote attackers to affect availability. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable researcher that this is an issue in the glob implementation in libc that allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames.
by Maksymilian Arciemowicz
xWeblog 2.2 - SQL Injection via makale_id Parameter
SQL injection vulnerability in oku.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the makale_id parameter.
by KnocKout
Backbone Technology Expression 18.9.2010 - Cross-Site Scripting
by High-Tech Bridge SA
By Source