Exploitdb Exploits
31,394 exploits tracked across all sources.
Orion Application Server 2.0.7 - Code Injection
Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
nginx 0.7.64 - Terminal Emulator Escape Sequence Injection via Log File
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
mini_httpd 1.19 - Remote Command Execution via Terminal Emulator Escape Sequence
mini_httpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
Boa 0.94.14rc21 - Remote Command Execution via Terminal Emulator Escape Sequence
Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
AOLserver 4.5.1 - Terminal Emulator Escape Sequence Injection via HTTP Request
AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
by evilaliv3
JCE-Tech PHP Calendars - Cross-Site Scripting via cat Parameter in product_list.php
Cross-site scripting (XSS) vulnerability in product_list.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows remote attackers to inject arbitrary web script or HTML via the cat parameter. NOTE: this issue is reportedly resultant from a forced SQL error message that occurs from exploitation of CVE-2010-0375.
by LionTurk
JCE-Tech PHP Calendars - SQL Injection via cat Parameter
SQL injection vulnerability in product_list.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by LionTurk
Smart Statistics 1.0 - 'smart_Statistics_admin.php' Cross-Site Scripting
by R3d-D3V!L
Simply Classified 0.2 - Cross-Site Scripting / Cross-Site Request Forgery
by mr_me
ProArcadeScript - SQL Injection via Games ID Parameter
SQL injection vulnerability in games/game.php in ProArcadeScript allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Err0R
phpmdj 1.0.3 - SQL Injection via profil.php id Parameter
SQL injection vulnerability in profil.php in phpMDJ 1.0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by k4cp3r & Ablus
JCE-Tech PHP Calendars - Unauthenticated Settings Modification via Direct install.php Request
install.php in JCE-Tech PHP Calendars, downloaded 20100121, allows remote attackers to bypass intended access restrictions and modify application settings via a direct request. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.
by LionTurk
jVideoDirect (com_jvideodirect) - Path Traversal via Controller Parameter
Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
by FL0RiX
JCollection (com_jcollection) for Joomla! - Path Traversal via Controller Parameter
Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
by FL0RiX
Joomla! JA Showcase (com_jashowcase) - Path Traversal via Controller Parameter
Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php.
by FL0RiX
Joomla! Component com_dashboard - Directory Traversal
by FL0RiX
E-membres 1.0 - Unauthenticated Sensitive Information Exposure via Direct Database Request
E-membres 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/bdEMembres.mdb.
by ViRuSMaN
Visialis ABB Forum 1.1 - Info Disclosure
Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for fpdb/abb.mdb.
by ViRuSMaN
Apple Safari - URL Redirect Target Disclosure via Stylesheet LINK Element
Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value.
by Cesar Cerrudo
By Source