Exploitdb Exploits
31,346 exploits tracked across all sources.
Dojo 1.0.x-1.0.2, 1.1.x-1.1.1, 1.2.x-1.2.3, 1.3.x-1.3.2, 1.4.x-1.4.1 - Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
by Adam Bixby
Dojo Toolkit SDK < 1.4.2 - Cross-Site Scripting via Theme Parameter
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.
by Adam Bixby
(Multiple Products) - 'banner.swf' Cross-Site Scripting
by MustLive
Zigurrat Farsi CMS - '/manager/textbox.asp' SQL Injection
by Isfahan
ParsCMS - SQL Injection via RP Parameter
Multiple SQL injection vulnerabilities in ParsCMS allow remote attackers to execute arbitrary SQL commands via the RP parameter to (1) fa_default.asp and (2) en_default.asp.
by Isfahan
phppool media Domain Verkaus and Auktions Portal - SQL Injection
SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Easy Laster
PhpMyLogon 2 - SQL Injection via Username Parameter
SQL injection vulnerability in phpmylogon.php in PhpMyLogon 2 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.
by blake
Joomla! Component com_nfnaddressbook - SQL Injection
by snakespc
DirectAdmin 1.33.6 - 'CMD_DB_VIEW' Cross-Site Scripting
by r0t
Geekhelps ADMP 1.01 - Path Traversal
Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to (1) colorvoid/footer.php, (2) default-green/footer.php, (3) default-orange/footer.php, and (4) default/footer.php in themes/. NOTE: some of these details are obtained from third party information.
by ITSecTeam
Systemsoftware Community Black Forum - SQL Injection
SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbitrary SQL commands via the s_flaeche parameter.
by Easy Laster
Joomla! Component com_seek - 'id' SQL Injection
by DevilZ TM
Joomla! Component com_sbsfile - Local File Inclusion
by DevilZ TM
Joomla! Component com_d-greinar - 'maintree' Cross-Site Scripting
by DevilZ TM
Geekhelps ADMP 1.01 - SQL Injection
SQL injection vulnerability in bannershow.php in Geekhelps ADMP 1.01 allows remote attackers to execute arbitrary SQL commands via the click parameter.
by ITSecTeam
Phpkobo AdFreely <1.01 - Path Traversal
Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a ..// (dot dot slash slash) in the LANG_CODE parameter to common.inc.php in (1) codelib/cfg/, (2) codelib/sys/, (3) staff/, and (4) staff/app/; and (5) staff/file.php. NOTE: some of these details are obtained from third party information.
by ITSecTeam
By Source