Exploitdb Exploits
31,344 exploits tracked across all sources.
Apple Cups < 1.4.3 - Memory Corruption
The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.
by Luca Carettoni
Smart ASP Survey - XSS
Cross-site scripting (XSS) vulnerability in poll/default.asp in Smart ASP Survey allows remote attackers to inject arbitrary web script or HTML via the catid parameter.
by L0rd CrusAd3r
SAS Hotel Management System - 'notfound' SQL Injection
by L0rd CrusAd3r
Restaurant Listing with Online Ordering - SQL Injection
by L0rd CrusAd3r
IISWorks FileMan - fileman.mdb Remote User Database Disclosure
by j0fer
Business Classified Listing - SQL Injection
by L0rd CrusAd3r
Xnview - Memory Corruption
Heap-based buffer overflow in XnView 1.97.4 and possibly earlier allows remote attackers to execute arbitrary code via a MultiBitMap (MBM) file with a Paint Data Section that contains a malformed Encoding field.
by Mauro Olea
Python < 2.5.6 - Out-of-Bounds Write
The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634.
by haypo
VideoWhisper PHP - XSS
Cross-site scripting (XSS) vulnerability in VideoWhisper PHP 2 Way Video Chat component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the r parameter to index.php.
by Sid3^effects
MODx 1.0.3 - 'index.php' Multiple SQL Injections
by High-Tech Bridge SA
Lyrics Script - SQL Injection / Cross-Site Scripting
by Valentin
Joke Website Script - SQL Injection / Cross-Site Scripting
by Valentin
Daily Inspirational Quotes Script - SQL Injection
by Valentin
LibTIFF 3.9.0 - DoS
LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.
by Tom Lane
Trend Micro Interscan Web Security Virtual Appliance - Multiple Vulnerabilities
by Ivan Huertas
UTStats Beta <4 - XSS
Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers to inject arbitrary web script or HTML via the mid parameter.
by LuM Member
Yamamah - Path Traversal
Directory traversal vulnerability in themes/default/download.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to read arbitrary files via a .. (dot dot) in the download parameter.
by mat
Yamamah (Dove Photo Album) 1.00 - SQL Injection
SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calbums parameter.
by CoBRa_21
UTStats Beta <4 - SQL Injection
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action.
by LuM Member
By Source