Exploitdb Exploits

31,394 exploits tracked across all sources.

Sort: Activity Stars

CVE-2007-6289 EXPLOITDB text VERIFIED

iptel serweb < 2.0.0dev1 - Remote Code Execution via _SERWEB[configdir] Parameter

Multiple PHP remote file inclusion vulnerabilities in SerWeb 2.0.0 dev1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SERWEB[configdir] parameter to load_lang.php, (2) _SERWEB[functionsdir] parameter to main_prepend.php, and the (3) _PHPLIB[libdir] parameter to load_phplib.php, different vectors than CVE-2007-3359 and CVE-2007-3358.

by GoLd_M

View

CVE-2009-4698 EXPLOITDB text VERIFIED

XOOPS Celepar Qas Module - SQL Injection via codigo or cod_categoria Parameter

Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.

by Moudi

View

EIP-2026-113244 EXPLOITDB text VERIFIED

WebAsyst Shop-Script PREMIUM - 'SearchString' Cross-Site Scripting

by u.f.

View

EIP-2026-113154 EXPLOITDB text VERIFIED

VS PANEL 7.5.5 - 'Cat_ID' SQL Injection

by octopos

View

CVE-2009-2895 EXPLOITDB text VERIFIED

Ultimate Regnow Affiliate 3.0 - SQL Injection via RSS cat Parameter

SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

by Chip d3 bi0s

View

CVE-2009-3224 EXPLOITDB text VERIFIED

Super Mod System - SQL Injection via s Parameter

SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remote attackers to execute arbitrary SQL commands via the s parameter.

by MizoZ

View

CVE-2009-4739 EXPLOITDB text VERIFIED

SkaDate Dating - Remote Code Execution via Language ID Parameter

PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the language_id parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.

by Moudi

View

CVE-2009-2773 EXPLOITDB text VERIFIED

PHP Paid 4 Mail Script - Remote Code Execution via home.php page Parameter

PHP remote file inclusion vulnerability in home.php in PHP Paid 4 Mail Script allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

by int_main();

View

EIP-2026-109245 EXPLOITDB text VERIFIED

Magician Blog 1.0 - Authentication Bypass

by Evil-Cod3r

View

EIP-2026-109244 EXPLOITDB text VERIFIED

Magician Blog 1.0 - 'ids' SQL Injection

by Evil-Cod3r

View

CVE-2009-4722 EXPLOITDB text VERIFIED

Limny 1.01 - SQL Injection via Username Parameter

SQL injection vulnerability in the CheckLogin function in includes/functions.php in Limny 1.01, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

by SirGod

View

CVE-2009-3215 EXPLOITDB text VERIFIED

ixxo_cart < 3.9.6.1 - SQL Injection via Parent Parameter

SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.

by sm0k3

View

CVE-2009-3155 EXPLOITDB text VERIFIED

Almond Classifieds (com_aclassf) 7.5 - Cross-Site Scripting via addr Parameter

Cross-site scripting (XSS) vulnerability in gmap.php in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.

by Moudi

View

CVE-2009-3217 EXPLOITDB text VERIFIED

iWiccle 1.01 - SQL Injection via member_id Parameter

SQL injection vulnerability in the admin module in iWiccle 1.01 allows remote attackers to execute arbitrary SQL commands via the member_id parameter in an edit_user action to index.php.

by SirGod

View

CVE-2009-3223 EXPLOITDB text VERIFIED

inout_adserver - Authenticated SQL Injection via id Parameter

SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

by boom3rang

View

CVE-2009-2778 EXPLOITDB text VERIFIED

GarageSales Script - Cross-Site Scripting via Key Parameter

Cross-site scripting (XSS) vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arbitrary web script or HTML via the key parameter. NOTE: some of these details are obtained from third party information.

by Moudi

View

EIP-2026-105408 EXPLOITDB text VERIFIED

Basilic 1.5.13 - 'index.php' Cross-Site Scripting

by PLATEN

View

EIP-2026-105117 EXPLOITDB text VERIFIED

almond Classifieds ads - Blind SQL Injection / Cross-Site Scripting

by Moudi

View