Exploitdb Exploits
31,357 exploits tracked across all sources.
Deonixscripts Templates Management 1.3 - SQL Injection
by d3b4g
Basilic 1.5.13 - SQL Injection via idAuthor Parameter
Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via the idAuthor parameter to (1) index.php and possibly (2) allpubs.php in publications/.
by NoGe
AR Web Content Manager 2.1 - SQL Injection via Username Parameter
SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
by SwEET-DeViL
PHP Melody 1.5.3 - Arbitrary File Upload Injection
by Chip d3 bi0s
Joomla! Component com_Joomlaoads - 'packageId' SQL Injection
by Mr.tro0oqy
Groone GLinks 2.1 - SQL Injection via Cat Parameter
SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
by 599eme Man
AR Web Content Manager 2.1 - Remote File Inclusion via 'a' Parameter
Directory traversal vulnerability in a.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the a parameter.
by SwEET-DeViL
phpDirectorySource 1.x - SQL Injection
SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL commands via the st parameter.
by Moudi
NOS Microsystems getPlus Download Manager - Privilege Escalation
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
by Jeremy Brown
phpDirectorySource 1.x - Cross-Site Scripting via search.php st Parameter
Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbitrary web script or HTML via the st parameter.
by Moudi
PHP Scripts Now Hangman - SQL Injection via index.php n Parameter
SQL injection vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to execute arbitrary SQL commands via the n parameter.
by Moudi
PHP Scripts Now Hangman - Cross-Site Scripting via Letters Parameter
Cross-site scripting (XSS) vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to inject arbitrary web script or HTML via the letters parameter.
by Moudi
MyDLstore Pixel Ad Script - 'payment.php' Cross-Site Scripting
by Moudi
MyDLstore Meta Search Engine Script 1.0 - 'url' Remote File Inclusion
by Moudi
Meta Search Engine Script - 'url' Local File Disclosure
by Moudi
Classified Linktrader Script - SQL Injection
SQL injection vulnerability in addlink.php in Classified Linktrader Script allows remote attackers to execute arbitrary SQL commands via the slctCategories parameter.
by Moudi
CJ Dynamic Poll PRO 2.0 - Cross-Site Scripting via PATH_INFO
Cross-site scripting (XSS) vulnerability in admin/admin_index.php in CJ Dynamic Poll PRO 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
by Moudi
MCshoutbox 1.1 - SQL Injection via Username or Password Parameter
Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
by SirGod
MCshoutbox 1.1 - Cross-Site Scripting via admin_login.php loginerror Parameter
Cross-site scripting (XSS) vulnerability in admin_login.php in MCshoutbox 1.1 allows remote attackers to inject arbitrary web script or HTML via the loginerror parameter.
by SirGod
DD-WRT < 24 - Remote Code Execution via CGI-BIN URI Shell Metacharacters
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.
by gat3way
By Source