Exploitdb Exploits
31,346 exploits tracked across all sources.
Kasseler CMS 1.3.4 - Cross-Site Scripting via do id or uname Parameters
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kasseler CMS 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) do, (2) id, and (3) uname parameters.
by Gamoscu
Angelo-Emlak 1.0 - Unauthenticated Database Download via Direct Request
Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for veribaze/angelo.mdb.
by LionTurk
PHPSimplicity Simplicity oF Upload 1.3.2 - Unrestricted File Upload via Double Extension Bypass
Unrestricted file upload vulnerability in upload.php in PHPSimplicity Simplicity oF Upload 1.3.2 allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif.
by Master Mind
phphq phUploader 1.2 - Unrestricted File Upload and Remote Code Execution
Unrestricted file upload vulnerability in phUploader.php in phphq.Net phUploader 1.2 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by wlhaan-hacker
Pandora FMS Monitoring Application 2.1.x /3.x - SQL Injection
by Global-Evolution
PacketFence Network Access Controller - Cross-Site Scripting
by K053
JBC Explorer 7.20 - 'arbre.php' Cross-Site Scripting
by Metropolis
Ignition 1.2 - Remote File Inclusion via Blog Parameter
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the blog parameter to (1) comment.php and (2) view.php.
by cOndemned
Advance Biz Limited 1.0 - Authentication Bypass
by PaL-D3v1L
4images 1.7.x - Authenticated SQL Injection via search_user Parameter
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.
by Master Mind
8pixel simple_blog - Unauthenticated Database Download via Direct Request
8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for App_Data/sb.mdb.
by LionTurk
Lizard Cart CMS 1.04 - SQL Injection via id Parameter
SQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by cr4wl3r
Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 - SQL Injection
SQL injection vulnerability in right.php in Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 allows remote attackers to execute arbitrary SQL commands via the title parameter.
by cr4wl3r
Barracuda Web Firewall 660 Firmware 7.3.1.007 - Multiple Vulnerabilities
by Global-Evolution
Barracuda Web Application Firewall 660 - '/cgi-mod/index.cgi' Multiple HTML Injection Vulnerabilities
by Global-Evolution
Pyrmont plugin 2 for WordPress - SQL Injection via id Parameter
SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Gamoscu
By Source