Exploitdb Exploits
31,348 exploits tracked across all sources.
ClearBudget 0.6.1 - Insecure Database Disclosure
by Room-Hacker
ClearBudget 0.6.1 - Insecure Cookie Handling / Local File Inclusion
by SirGod
Barracuda Load Balancer - 'realm' Cross-Site Scripting
by Jan Skovgren
Team Board 1.x and 2.x - Unauthenticated Sensitive Information Exposure via Direct Database Access
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for data/team.mdb.
by Pouya_Server
Syntax Desktop 2.7 - Path Traversal
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the synTarget parameter.
by ahmadbady
rgboard 4 5p1 (07.07.27) - Multiple Vulnerabilities
by make0day
Jaws 0.8.8 - Authenticated Path Traversal via Language, Introduction_complete, or use_log Parameters
Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) language, (2) Introduction_complete, and (3) use_log parameters, different vectors than CVE-2004-2445.
by fuzion
GRBoard 1.8 - Remote Code Execution via Theme Path or GRBoard Parameter
Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) theme parameter to (a) 179_squarebox_pds_list/view.php, (b) 179_squarebox_minishop_expand/view.php, (c) 179_squarebox_gallery_list_pds/view.php, (d) 179_squarebox_gallery_list/view.php, (e) 179_squarebox_gallery/view.php, (f) 179_squarebox_board_swfupload/view.php, (g) 179_squarebox_board_expand/view.php, (h) 179_squarebox_board_basic_with_grcode/view.php, (i) 179_squarebox_board_basic/view.php, (j) 179_simplebar_pds_list/view.php, (k) 179_simplebar_notice/view.php, (l) 179_simplebar_gallery_list_pds/view.php, (m) 179_simplebar_gallery/view.php, and (n) 179_simplebar_basic/view.php in theme/; the (2) path parameter to (o) latest/sirini_gallery_latest/list.php; and the (3) grboard parameter to (p) include.php and (q) form_mail.php.
by make0day
gr blog 1.1.4 - Arbitrary File Upload / Authentication Bypass
by JosS
QIP 2005 build 8082 - Denial of Service via Crafted RTF ICQ Message
QIP 2005 build 8082 allows remote attackers to cause a denial of service (CPU consumption and application hang) via a crafted Rich Text Format (RTF) ICQ message, as demonstrated by an {\rtf\pict\&&} message. NOTE: the vulnerability may be in Sergey Tkachenko TRichView. If so, then this should not be treated as a vulnerability in QIP.
by ShineShadow
Cisco IOS 12.4(23) - Cross-Site Scripting via PATH_INFO to Default URI
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.
by Zloss
Team Board 1.x - Cross-Site Scripting via lookname Parameter
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web script or HTML via the lookname parameter.
by Pouya_Server
Power System Of Article Management 3.0 - File Disclosure / Cross-Site Scripting
by Pouya_Server
GR Note 0.94 Beta - (Authentication Bypass) Remote Database Backup
by JosS
Whole Hog Ware Support 1.x - Auth Bypass
Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
by Stack
Online Grades 3.2.4 - Info Disclosure
Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
by x0r
Online Grades 3.2.4 - SQL Injection
Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameter.
by x0r
NaviCOPA Web Server 3.0.1 - Remote Buffer Overflow / Script Source Disclosure
by e.wiZz!
Whole Hog Password Protect: Enhanced 1.x - Auth Bypass
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
by Stack
Whole Hog Password Protect: Enhanced 1.x - Auth Bypass
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
by Stack
TECHNOTE 7.2 - Remote Code Execution via shop_this_skin_path Parameter
PHP remote file inclusion vulnerability in skin_shop/standard/2_view_body/body_default.php in TECHNOTE 7.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter, a different vector than CVE-2008-4138.
by make0day
Simple Machines Forum (SMF) 1.1.7 - '[url]' Tag HTML Injection
by Xianur0
Simple Machines Forum (SMF) - 'BBCode' Cookie Stealing
by Xianur0
Online Grades 3.2.4 - SQL Injection
Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by x0r
Groone GBook 2.0 - Remote Code Execution via abspath Parameter
PHP remote file inclusion vulnerability in includes/header.php in Groone GBook 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
by k3vin mitnick
By Source