Exploitdb Exploits
31,348 exploits tracked across all sources.
Simple PHP Newsletter <1.5 - Path Traversal
Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the olang parameter to (1) mail.php and (2) mailbar.php.
by ahmadbady
Katy Whitton RankEm - Info Disclosure
Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb.
by Pouya_Server
Katy Whitton BlogIt! - SQL Injection
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by Pouya_Server
BibCiter 1.4 - SQL Injection via idp, idc, or idu Parameter
Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the (1) idp parameter to reports/projects.php, the (2) idc parameter to reports/contacts.php, and the (3) idu parameter to reports/users.php.
by nuclear
Aj Classifieds Real Estate 3.0 - Arbitrary File Upload
by ZoRLu
Aj Classifieds Personals 3.0 - Arbitrary File Upload
by ZoRLu
Aj Classifieds For Sale 3.0 - Arbitrary File Upload
by ZoRLu
LemonLDAP:NG 0.9.3.1 - User Enumeration / Cross-Site Scripting
by clément Oudot
WarHound Walking Club - SQL Injection
SQL injection vulnerability in login.aspx in WarHound Walking Club allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
by ByALBAYX
Enthrallweb eReservations - SQL Injection
Multiple SQL injection vulnerabilities in default.asp in Enthrallweb eReservations allow remote attackers to execute arbitrary SQL commands via the (1) Login parameter (aka username field) or the (2) Password parameter (aka password field). NOTE: some of these details are obtained from third party information.
by ByALBAYX
DMXReady Blog Manager - SQL Injection
SQL injection vulnerability in inc_webblogmanager.asp in DMXReady Blog Manager allows remote attackers to execute arbitrary SQL commands via the itemID parameter in a view action.
by Pouya_Server
DMXReady Blog Manager - Cross-Site Scripting via CategoryID Parameter
Cross-site scripting (XSS) vulnerability in inc_webblogmanager.asp in DMXReady Blog Manager allows remote attackers to inject arbitrary web script or HTML via the CategoryID parameter in a refer action.
by Pouya_Server
MKPortal 1.2.1 - '/modules/rss/handler_image.php?i' Cross-Site Scripting
by waraxe
MKPortal 1.2.1 - '/modules/blog/index.php' Home Template Textarea SQL Injection
by waraxe
Masir Camp 3.0 - 'SearchKeywords' SQL Injection
by Pouya_Server
RD-Autos 1.5.5 Stable - SQL Injection via id Parameter
SQL injection vulnerability in the RD-Autos (com_rdautos) 1.5.5 Stable component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
by H!tm@N
SIR GNUBoard 4.31.03 - Path Traversal
Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments, this can be leveraged for remote code execution via a data: URI or a UNC share pathname.
by flyh4t
Free Bible Search PHP Script 1.0 - SQL Injection
SQL injection vulnerability in readbible.php in Free Bible Search PHP Script 1.0 allows remote attackers to execute arbitrary SQL commands via the version parameter.
by nuclear
Ganglia 3.1.1 - Stack-based Buffer Overflow via Long Pathname in process_path
Stack-based buffer overflow in the process_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of service (crash) via a request to the gmetad service with a long pathname.
by Spike Spiegel
LinksPro Standard Edition - SQL Injection
SQL injection vulnerability in Default.asp in LinksPro Standard Edition allows remote attackers to execute arbitrary SQL commands via the OrderDirection parameter.
by Pouya_Server
By Source