Exploitdb Exploits
31,346 exploits tracked across all sources.
Katalog Stron Hurricane 1.3.5 - Remote Code Execution via includes_directory Parameter
PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includes_directory parameter.
by kaMtiEz
JTL-Shop 2 - SQL Injection via Druckansicht s Parameter
SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands via the s parameter.
by Lo$T
JoomlaWorks AllVideos <3.2 - Path Traversal
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
by Pouya Daneshmand
ZeusCMS 0.2 - Path Traversal via Page Parameter
Directory traversal vulnerability in index.php in ZeusCMS 0.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
by ViRuSMaN
StatCounteX 3.0 and 3.1 - Unauthenticated Sensitive Information Disclosure and Configuration Manipulation via admin.asp
StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a direct request to admin.asp.
by Phenom
Mozilla Firefox 3.6 - Denial of Service (1)
by Asheesh kumar Mani Tripathi
Microsoft Internet Explorer 8 - Denial of Service
by Asheesh kumar Mani Tripathi
ZeusCMS 0.2 - Information Disclosure via Direct Request for admin/backup.sql
ZeusCMS 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request for admin/backup.sql.
by ViRuSMaN
WSN Guest 1.02 - SQL Injection via Orderlinks Parameter
SQL injection vulnerability in index.php in WSN Guest 1.02 allows remote attackers to execute arbitrary SQL commands via the orderlinks parameter.
by Gamoscu
WordPress 2.9 - Authenticated Information Disclosure via Trash Post Access
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.
by tmacuk
StatCounteX 3.1 - Unauthenticated Sensitive Information Exposure via Direct Database Request
StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for path/stats.mdb.
by Phenom
southburn Web - 'products.php' SQL Injection
by AtT4CKxT3rR0r1ST
Izumi 1.1.0 - Multiple Local File Inclusion / Remote File Inclusions
by cr4wl3r
CMS Made Simple 1.6.6 - Multiple Vulnerabilities
by Beenu Arora
CMS Made Simple 1.6.6 - Local File Inclusion / Cross-Site Scripting
by Beenu Arora
basic-cms - Cross-Site Scripting via nav_id Parameter
Cross-site scripting (XSS) vulnerability in pages/index.php in BASIC-CMS allows remote attackers to inject arbitrary web script or HTML via the nav_id parameter.
by Red-D3v1L
By Source