Exploitdb Exploits
31,394 exploits tracked across all sources.
XOOPS Celepar Qas Module - SQL Injection via codigo or cod_categoria Parameter
Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.
by s4r4d0
XOOPS Celepar Quiz Module - Cross-Site Scripting via PATH_INFO to cadastro_usuario.php
Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.
by s4r4d0
WebShop Hun 1.062s - '/index.php' Local File Inclusion / Cross-Site Scripting
by u.f.
TurnkeySetup Net Marketing 6.0 - 'faqs.php' Cross-Site Scripting
by Moudi
SkaLinks 1.5 - 'cat' Multiple Cross-Site Scripting Vulnerabilities
by Moudi
Scripteen Free Image Hosting Script 2.3 - SQL Injection via cookid or cookgid Cookie
Multiple SQL injection vulnerabilities in header.php in Scripteen Free Image Hosting Script 2.3 allow remote attackers to execute arbitrary SQL commands via a (1) cookid or (2) cookgid cookie.
by Coksnuss
Scripteen Free Image Hosting Script 2.3 - Unauthenticated Authentication Bypass via cookgid Cookie
admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211.
by Qabandi
SaphpLesson 4.0 - SQL Injection via cp_username Parameter
SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.
by SwEET-DeViL
OSI Codes Inc. PHP Live! 3.2.2 - SQL Injection via questid Parameter
SQL injection vulnerability in admin/traffic/knowledge_searchm.php in OSI Codes Inc. PHP Live! 3.2.2 allows remote attackers to execute arbitrary SQL commands via the questid parameter in an expand_question action.
by skys
Million-Dollar Pixel Ads Platinum - SQL Injection / Cross-Site Scripting
by Moudi
Million Dollar Pixel Ads - Cross-Site Scripting / SQL Injection
by Moudi
Joomla! Extension UIajaxIM 1.1 - JavaScript Execution
by 599eme Man
Deonixscripts Templates Management 1.3 - SQL Injection
by d3b4g
Basilic 1.5.13 - SQL Injection via idAuthor Parameter
Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via the idAuthor parameter to (1) index.php and possibly (2) allpubs.php in publications/.
by NoGe
AR Web Content Manager 2.1 - SQL Injection via Username Parameter
SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
by SwEET-DeViL
PHP Melody 1.5.3 - Arbitrary File Upload Injection
by Chip d3 bi0s
Joomla! Component com_Joomlaoads - 'packageId' SQL Injection
by Mr.tro0oqy
Groone GLinks 2.1 - SQL Injection via Cat Parameter
SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
by 599eme Man
AR Web Content Manager 2.1 - Remote File Inclusion via 'a' Parameter
Directory traversal vulnerability in a.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the a parameter.
by SwEET-DeViL
phpDirectorySource 1.x - SQL Injection
SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL commands via the st parameter.
by Moudi
NOS Microsystems getPlus Download Manager - Privilege Escalation
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
by Jeremy Brown
phpDirectorySource 1.x - Cross-Site Scripting via search.php st Parameter
Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbitrary web script or HTML via the st parameter.
by Moudi
By Source