Exploitdb Exploits
31,394 exploits tracked across all sources.
Theeta CMS - SQL Injection via Forum Start Parameter
Multiple SQL injection vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to execute arbitrary SQL commands via the start parameter to (1) forum.php and (2) thread.php in community/, and (3) blog/index.php.
by c0dy
PHP < 5.2.10 - Memory Disclosure and Denial of Service via ini_set and ini_restore
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
by Maksymilian Arciemowicz
Huawei MT882 V100R002B020 ARG-T - Info Disclosure
rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 contains a form that does not disable the autocomplete setting for the password parameter, which makes it easier for local users or physically proximate attackers to obtain the password from web browsers that support autocomplete.
by DecodeX01
Simple Machines Forum <= 2.0.3 - Authenticated File Disclosure via Admin Interface
File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.
by SimpleAudit Team
CVSS 4.9
Kide Shoutbox 0.4.6 - Cross-Site Scripting / AXFR
by andresg888
Robert Zimmerman PHP / MySQL Scripts - Authentication Bypass
by DUNDEE
phpMyFAQ < 2.5.5 - Cross-Site Scripting via Multiple Index.php Parameters
Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by Amol Naik
Joomla! com_proofreader <1.0 RC9 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages.
by MustLive
MojoBlog RC 0.15 - Remote Code Execution via mosConfig_absolute_path Parameter
Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) wp-comments-post.php and (2) wp-trackback.php.
by kaMtiEz
Joaktree com_joaktree 1.0 - SQL Injection via treeId Parameter
SQL injection vulnerability in the Joaktree (com_joaktree) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the treeId parameter to index.php.
by Don Tukulesto
Ciamos CMS < 0.9.5 - Remote Code Execution via module_path Parameter
PHP remote file inclusion vulnerability in modules/pms/index.php in Ciamos CMS 0.9.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_path parameter.
by cr4wl3r
Apache Tomcat 3.2.1 - 404 Error Page Cross-Site Scripting
by MustLive
Oracle - SYS.LT.REMOVEWORKSPACE Evil Cursor
by Andrea Purificato
Oracle - SYS.LT.MERGEWORKSPACE Evil Cursor
by Andrea Purificato
Oracle - SYS.LT.COMPRESSWORKSPACETREE Evil Cursor
by Andrea Purificato
Oracle - ctxsys.drvxtabc.create_tables Evil Cursor
by Andrea Purificato
WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter
by Jbyte
SmartMedia 0.85 Beta - Cross-Site Scripting via CategoryID Parameter
Cross-site scripting (XSS) vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the categoryid parameter.
by SoldierOfAllah
By Source