Exploitdb Exploits
31,344 exploits tracked across all sources.
DaLogin <2.2.5 - SQL Injection
SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.
by hc0
ardeaCore PHP Framework <2.2 - RCE
PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the pathForArdeaCore parameter. NOTE: some of these details are obtained from third party information.
by cr4wl3r
Anecms Blog < 1.3 - SQL Injection
SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
by High-Tech Bridge SA
Anecms Blog < 1.3 - XSS
Cross-site scripting (XSS) vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the comment variable to modules/blog/index.php.
by High-Tech Bridge SA
Savy Soda Documents - Mobile Office Suite '.XLS' Denial of Service
by Matthew Bergin
GoodiWare GoodReader iPhone - '.XLS' Denial of Service
by Matthew Bergin
SchoolMation 2.3 - XSS
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to inject arbitrary web script or HTML via the session parameter.
by Sid3^effects
Microsoft Windows 2003 Server - OS Command Injection
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
by Tavis Ormandy
Microsoft Windows 2003 Server - XSS
Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.
by Tavis Ormandy
SchoolMation 2.3 - SQL Injection
SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter.
by Sid3^effects
Miniweb 2.0 Business Portal and Social Networking Platform - SQL Injection
by L0rd CrusAd3r
Arabportal Arab Portal - SQL Injection
SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the by parameter in the msearch action.
by SwEET-DeViL
Science Fair In A Box <2.0.6, 2.2.0 - SQL Injection
SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. NOTE: some of these details are obtained from third party information.
by L0rd CrusAd3r
Pilotgroup Elms Pro - SQL Injection
SQL injection vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to execute arbitrary SQL commands via the course_id parameter.
by Sid3^effects
Science Fair In A Box <2.0.6, 2.2.0 - XSS
Cross-site scripting (XSS) vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter. NOTE: some of these details are obtained from third party information.
by L0rd CrusAd3r
Eicrasoft Eicra Realestate Script - SQL Injection
SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the p_id parameter. NOTE: some of these details are obtained from third party information.
by L0rd CrusAd3r
PHP Property Rental Script - SQL Injection / Cross-Site Scripting
by L0rd CrusAd3r
PGAUTOPro - SQL Injection / Cross-Site Scripting (2)
by Sid3^effects
PGAUTOPro - SQL Injection / Cross-Site Scripting (1)
by Sid3^effects
By Source