Text Exploits
31,386 exploits tracked across all sources.
dynpg < 4.1.0 - Remote Code Execution via PHP File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) DefineRootToTool parameter to counter.php, (2) PathToRoot parameter to plugins/DPGguestbook/guestbookaction.php and (3) get_popUpResource parameter to backendpopup/popup.php. NOTE: some of these details are obtained from third party information.
by eidelweiss
68KB Knowledge Base 1.0.0rc3 - Cross-Site Request Forgery (Edit Main Settings)
by Jelmer de Hen
68kb 68KB Base 1.0.0rc3 - Cross-Site Request Forgery (Admin)
by Jelmer de Hen
Simple Calculator by Peter Rekdal Sunde - Arbitrary File Upload
by indoushka
Profi Einzelgebots Auktions System - Blind SQL Injection
by Easy Laster
onepound Shop / CMS - Cross-Site Scripting / SQL Injection
by Valentin
com_weberpcustomer 1.2.1 and 1.x before 1.06.02 - Path Traversal via Controller Parameter
Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
by Chip d3 bi0s
Joomla! com_userstatus <1.21.16 - Path Traversal
Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
by Chip d3 bi0s
com_jvehicles 1.0, 2.0, and 2.1111 - SQL Injection via aid Parameter
SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an agentlisting action to index.php. NOTE: some of these details are obtained from third party information.
by Chip d3 bi0s
Joomla! Component EContent - Local File Inclusion
by Chip d3 bi0s
Joomla! Component com_trading - Blind SQL Injection
by DevilZ TM
dynpg < 4.1.0 - Remote Code Execution via PHP File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) DefineRootToTool parameter to counter.php, (2) PathToRoot parameter to plugins/DPGguestbook/guestbookaction.php and (3) get_popUpResource parameter to backendpopup/popup.php. NOTE: some of these details are obtained from third party information.
by eidelweiss
Adobe PDF Embedded EXE Social Engineering
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.
by Didier Stevens
Matomo 0.1.6-0.5.5 - Cross-Site Scripting via Login Form form_url Parameter
Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.
by garwga
OSSIM 2.2.1 - '$_SERVER['PHP_SELF']' Cross-Site Scripting
by CONIX Security
Joomla! com_dwgraphs 1.0 - Path Traversal
Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
by Chip d3 bi0s
Easy-Clanpage 2.2 - Multiple SQL Injections /
by Easy Laster
By Source