Exploitdb Exploits
31,346 exploits tracked across all sources.
Text Exchange Pro - Cross-Site Request Forgery (Add Admin)
by bi0
TenderSystem 0.9.5 - 'main.php' Multiple Local File Inclusions
by Packetdeath
Scriptsez Smart PHP Subscriber - Info Disclosure
Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt.
by Milos Zivanovic
phpfaber Content Management System - Cross-Site Scripting via mod Parameter
Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter.
by bi0
ScriptsEz Mini Hosting Panel - Cross-Site Request Forgery via Admin Panel Action
Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote attackers to hijack the authentication of administrators for requests that alter administrative settings via a cp action.
by Milos Zivanovic
texmedia Million Pixel Script 3 - Cross-Site Scripting via pa Parameter
Cross-site scripting (XSS) vulnerability in index.php in texmedia Million Pixel Script 3 allows remote attackers to inject arbitrary web script or HTML via the pa parameter. NOTE: some of these details are obtained from third party information.
by bi0
Link Up Gold 5.0 - Cross-Site Request Forgery in Administrative Account Creation
Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
by bi0
Ez Poll Hoster - Multiple Cross-Site Scripting Vulnerabilities
by Milos Zivanovic
Scriptsez.net Ez Poll Hoster - CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php, or (3) send arbitrary email to arbitrary users in the email action to admin.php.
by Milos Zivanovic
eocms < 0.9.03 - Remote Code Execution via BBCODE_path Parameter
PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BBCODE_path parameter.
by 1nd0n3s14n l4m3r
Easy Banner Pro - Cross-Site Request Forgery (Add Admin)
by bi0
Automne.ws CMS 4.0.0rc2 - Multiple Remote File Inclusions
by 1nd0n3s14n l4m3r
Ad Manager Pro 3.0 - Cross-Site Request Forgery in Admin User Creation
Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admin_created action. NOTE: some of these details are obtained from third party information.
by bi0
Zabbix < 1.6.8 - Denial of Service via Missing Separators in Request
The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword.
by Nicob
Zabbix Agent <1.6.7 - Command Injection
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.
by Nicob
Oracle E-Business Suite - Multiple Vulnerabilities
by Hacktics
Oracle E-Business Suite 11i - Multiple Remote Vulnerabilities
by Hacktics
By Source