Exploitdb Exploits
31,346 exploits tracked across all sources.
Joomla! Component com_tienda - 'categoria' Cross-Site Scripting
by FL0RiX
Hesk Help Desk 2.1 - Cross-Site Request Forgery
by The.Morpheus
CiviCRM 3.1 < Beta 5 - Multiple Cross-Site Scripting Vulnerabilities
by h00die
Bash - Terminal Escape Sequence Injection via LS_OPTIONS
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
by Eric Piel
Asp VevoCart Control System 3.0.4 - Database Disclosure
by indoushka
Simple PHP Blog 0.5.x - 'search.php' Cross-Site Scripting
by Sora
PHPepperShop 2.5 - Cross-Site Scripting via darstellen Parameter
Cross-site scripting (XSS) vulnerability in shop/USER_ARTIKEL_HANDLING_AUFRUF.php in PHPepperShop 2.5 allows remote attackers to inject arbitrary web script or HTML via the darstellen parameter.
by Crux
Layout CMS 1.0 - SQL Injection / Cross-Site Scripting
by Red-D3v1L
Docmint 1.0 and 2.1 - Cross-Site Scripting via id Parameter
Cross-site scripting (XSS) vulnerability in index.php in Docmint 1.0 and 2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information.
by Red-D3v1L
Yaws 1.85 - Terminal Emulator Escape Sequence Injection via HTTP Request
Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
Cherokee < 0.99.31 - Remote Code Execution via Terminal Emulator Escape Sequence
header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
Jamit Job Board 3.0 - Cross-Site Scripting via post_id Parameter
Cross-site scripting (XSS) vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.
by Crux
gridcc script 1.0 - SQL Injection / Cross-Site Scripting
by Red-D3v1L
FAQEngine 4.24.00 - Remote File Inclusion via path_faqe Parameter
Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP code via a URL in the path_faqe parameter to (1) attachs.php, (2) backup.php, (3) badwords.php, (4) categories.php, (5) changepw.php, (6) colorchooser.php, (7) colorwheel.php, (8) dbfiles.php, (9) diraccess.php, (10) faq.php, (11) index.php, (12) kb.php, and (13) stats.php.
by kaMtiEz
DELTAScripts PHP Links 1.0 - 'email' Cross-Site Scripting
by Crux
Active Calendar 1.2 - '$_SERVER['PHP_SELF']' Multiple Cross-Site Scripting Vulnerabilities
by Martin Barbella
@lex Guestbook 5.0 - Multiple Cross-Site Scripting Vulnerabilities
by D3V!L FUCKER
Varnish 2.0.6 - Terminal Emulator Escape Sequence Injection via Log File
Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. NOTE: the vendor disputes the significance of this report, stating that "This is not a security problem in Varnish or any other piece of software which writes a logfile. The real problem is the mistaken belief that you can cat(1) a random logfile to your terminal safely.
by evilaliv3
CVSS 9.8
By Source