Exploitdb Exploits
31,348 exploits tracked across all sources.
Graugon Gallery 1.0 - Cross-Site Scripting / SQL Injection / Cookie Bypass
by x0r
dacio's CMS 1.08 - Cross-Site Scripting / SQL Injection / File Disclosure
by Mehmet Ince
ProFTPD Server <1.3.2rc2 - SQL Injection
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
by gat3way
Thyme 1.3 - Path Traversal via Export Parameter
Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when register_globals is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the export_to parameter.
by cheverok
Potato News 1.0.0 - Unauthenticated Path Traversal via User Cookie Parameter
Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the user cookie parameter.
by x0r
Papoo CMS 3.6 - Path Traversal via pfadhier Parameter
Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the pfadhier parameter. NOTE: some of these details are obtained from third party information.
by SirGod
MyNews 0.10 - SQL Injection via Username or Passwd Parameter
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
by x0r
BlueBird Prelease - SQL Injection via Username or Passwd Parameter
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
by x0r
Auth Php 1.0 - SQL Injection via Username or Passwd Parameter
SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
by x0r
ProFTPD Server <1.3.1 - Auth Bypass
ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
by gat3way
Swann DVR4-SecuraNet - Path Traversal
Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.
by Terry Froy
Craft Silicon Banking@Home <2.1 - SQL Injection
SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter.
by Francesco Bianchino
FlexCMS - SQL Injection via catId Parameter
SQL injection vulnerability in FlexCMS allows remote attackers to execute arbitrary SQL commands via the catId parameter.
by MisterRichard
SnippetMaster Webpage Editor 2.2.2 - XSS
Cross-site scripting (XSS) vulnerability in index.php in SnippetMaster Webpage Editor 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
by RoMaNcYxHaCkEr
AdaptCMS Lite 1.4 - Cross-Site Scripting via URL and acuparam Parameters
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) url and (2) acuparam parameters, and (3) the URI.
by RoMaNcYxHaCkEr
WebFrame 0.76 - Remote Code Execution via classFiles Parameter
Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code via a URL in the classFiles parameter to (1) admin/doc/index.php, (2) index.php, and (3) base/menu.php in mod/.
by ahmadbady
ZeroBoardXE 1.1.5 (09.01.22) - Cross-Site Scripting
by make0day
yanocc < 0.1.0 - Remote File Inclusion via Lang Parameter Path Traversal
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
by Kacper
WebFrame 0.76 - Path Traversal and Arbitrary File Execution via currentmod and LANG Parameters
Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) currentmod and (2) LANG parameters to mod/index.php.
by ahmadbady
WB News 2.0.1 - Remote Code Execution
Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) search.php, (2) archive.php, (3) comments.php, and (4) news.php; (5) News.php, (6) SendFriend.php, (7) Archive.php, and (8) Comments.php in base/; and possibly other components, different vectors than CVE-2007-1288.
by ahmadbady
SnippetMaster 2.2.2 - Remote Code Execution via PHP File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SnippetMaster 2.2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SCRIPT_PATH] parameter to includes/vars.inc.php and the (2) g_pcltar_lib_dir parameter to includes/tar_lib/pcltar.lib.php.
by RoMaNcYxHaCkEr
Php4scripte Gastebuch - Path Traversal
Directory traversal vulnerability in gastbuch.php in Gästebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.
by bd0rk
FotoWeb 6.0 Build 273 - Cross-Site Scripting via Login and Grid Search Parameters
Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to cmdrequest/Login.fwx and the (2) search parameter to Grid.fwx.
by Stelios Tigkas
By Source