Text Exploits
31,394 exploits tracked across all sources.
Thyme 1.3 - Path Traversal via Export Parameter
Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when register_globals is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the export_to parameter.
by cheverok
Potato News 1.0.0 - Unauthenticated Path Traversal via User Cookie Parameter
Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the user cookie parameter.
by x0r
Papoo CMS 3.6 - Path Traversal via pfadhier Parameter
Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the pfadhier parameter. NOTE: some of these details are obtained from third party information.
by SirGod
MyNews 0.10 - SQL Injection via Username or Passwd Parameter
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
by x0r
BlueBird Prelease - SQL Injection via Username or Passwd Parameter
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
by x0r
Auth Php 1.0 - SQL Injection via Username or Passwd Parameter
SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
by x0r
ProFTPD Server <1.3.1 - Auth Bypass
ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
by gat3way
Swann DVR4-SecuraNet - Path Traversal
Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.
by Terry Froy
Craft Silicon Banking@Home <2.1 - SQL Injection
SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter.
by Francesco Bianchino
FlexCMS - SQL Injection via catId Parameter
SQL injection vulnerability in FlexCMS allows remote attackers to execute arbitrary SQL commands via the catId parameter.
by MisterRichard
SnippetMaster Webpage Editor 2.2.2 - XSS
Cross-site scripting (XSS) vulnerability in index.php in SnippetMaster Webpage Editor 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
by RoMaNcYxHaCkEr
AdaptCMS Lite 1.4 - Cross-Site Scripting via URL and acuparam Parameters
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) url and (2) acuparam parameters, and (3) the URI.
by RoMaNcYxHaCkEr
WebFrame 0.76 - Remote Code Execution via classFiles Parameter
Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code via a URL in the classFiles parameter to (1) admin/doc/index.php, (2) index.php, and (3) base/menu.php in mod/.
by ahmadbady
ZeroBoardXE 1.1.5 (09.01.22) - Cross-Site Scripting
by make0day
yanocc < 0.1.0 - Remote File Inclusion via Lang Parameter Path Traversal
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
by Kacper
WebFrame 0.76 - Path Traversal and Arbitrary File Execution via currentmod and LANG Parameters
Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) currentmod and (2) LANG parameters to mod/index.php.
by ahmadbady
WB News 2.0.1 - Remote Code Execution
Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) search.php, (2) archive.php, (3) comments.php, and (4) news.php; (5) News.php, (6) SendFriend.php, (7) Archive.php, and (8) Comments.php in base/; and possibly other components, different vectors than CVE-2007-1288.
by ahmadbady
SnippetMaster 2.2.2 - Remote Code Execution via PHP File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SnippetMaster 2.2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SCRIPT_PATH] parameter to includes/vars.inc.php and the (2) g_pcltar_lib_dir parameter to includes/tar_lib/pcltar.lib.php.
by RoMaNcYxHaCkEr
Php4scripte Gastebuch - Path Traversal
Directory traversal vulnerability in gastbuch.php in Gästebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.
by bd0rk
FotoWeb 6.0 Build 273 - Cross-Site Scripting via Login and Grid Search Parameters
Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to cmdrequest/Login.fwx and the (2) search parameter to Grid.fwx.
by Stelios Tigkas
FotoWeb 6.0 Build 273 - Cross-Site Scripting via Login and Grid Search Parameters
Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to cmdrequest/Login.fwx and the (2) search parameter to Grid.fwx.
by Stelios Tigkas
FlexCMS 2.5 - SQL Injection via ItemId Parameter
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId parameter. NOTE: some of these details are obtained from third party information.
by MisterRichard
eZoneScripts (Multiple Scripts) - Insecure Cookie Authentication Bypass
by JIKO
BusinessSpace < 1.2 - SQL Injection via Classified Page id Parameter
SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
by K-159
By Source