Exploitdb Exploits
31,351 exploits tracked across all sources.
FlexPHPic <0.0.4 - FlexPHPic Pro <0.0.3 - SQL Injection
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPic 0.0.4 and FlexPHPic Pro 0.0.3, and other 0.0.x versions, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
by S.W.A.T.
CMScout 2.06 - Path Traversal via Bit Parameter
Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.
by SirGod
audiofile 0.2.6 - Heap-Based Buffer Overflow via Crafted WAV File
Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.
by Anton Khirnov
Symbian S60 - Malformed SMS/MMS Remote Denial of Service
by Tobias Engel
Jay Patel Pixel8 Web Photo Album 3.0 - SQL Injection via AlbumID Parameter
SQL injection vulnerability in Photo.asp in Jay Patel Pixel8 Web Photo Album 3.0 allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
by AlpHaNiX
FlexPHPDirectory 0.0.1 - SQL Injection via checkuser or checkpass Parameters
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) checkuser and (2) checkpass parameters.
by x0r
SepCity Classified Ads - SQL Injection via ID Parameter
SQL injection vulnerability in classdis.asp in SepCity Classified Ads allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by S.W.A.T.
FlexCustomer <= 0.0.6 - SQL Injection via checkuser/checkpass or username/password Parameters
SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php, and (3) username and (4) password parameters to (b) index.php. NOTE: it was later reported that 0.0.6 is also affected.
by Osirys
Web Scribble Solutions webClassifieds 2005 - SQL Injection
Multiple SQL injection vulnerabilities in index.php in Web Scribble Solutions webClassifieds 2005 allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) password fields in a sign_in action.
by AnGeL25dZ
ViArt Shop 3.5 - Cross-Site Scripting via Manuals Search Parameter
Cross-site scripting (XSS) vulnerability in manuals_search.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to inject arbitrary web script or HTML via the manuals_search parameter.
by Xia Shing Zee
ThePortal2 2.2 - Unauthenticated Arbitrary File Upload and Remote Code Execution via Galeria Admin Endpoint
Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in galeria/.
by siurek22
phpAlumni - SQL Injection via Acomment.php id Parameter
SQL injection vulnerability in Acomment.php in phpAlumni allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Mr.SQL
Joomla! Component com_na_content 1.0 - Blind SQL Injection
by Mehmet Ince
FubarForum 1.6 - Authentication Bypass Change User Password
by R31P0l
FlexPHPSite 0.0.1 and 0.0.7 - SQL Injection via User Check Parameters
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
by x0r
FlexPHPLink Pro 0.0.6 and 0.0.7 - SQL Injection via Usercheck Parameters
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPLink Pro 0.0.6 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
by x0r
FlexPHPDirectory 0.0.1 - Unauthenticated Arbitrary File Upload via add.php
Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photo/.
by x0r
Flexcustomer 0.0.6 - Remote Code Execution via Database Name Parameter
Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject arbitrary PHP code into const.inc.php via the installdbname parameter (aka the Database Name field). NOTE: the installation instructions specify deleting admin/install.php.
by Osirys
eDreamers eDNews 2 - SQL Injection via newsid Parameter
SQL injection vulnerability in eDNews_view.php in eDreamers eDNews 2 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
by Virangar Security
eDreamers eDNews <2 - Path Traversal
Directory traversal vulnerability in eDNews_archive.php in eDreamers eDNews 2, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lg parameter. NOTE: some of these details are obtained from third party information.
by GoLd_M
eDreamers eDContainer <2.22 - Path Traversal
Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lg parameter. NOTE: some of these details are obtained from third party information.
by GoLd_M
xterm - Remote Code Execution via Escape Sequences
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
by Paul Szabo
SepCity Shopping Mall - SQL Injection via shpdetails.asp ID Parameter
SQL injection vulnerability in shpdetails.asp in SepCity Shopping Mall allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by Osmanizim
SepCity Faculty Portal - SQL Injection via deptdisplay.asp ID Parameter
SQL injection vulnerability in deptdisplay.asp in SepCity Faculty Portal allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: this was originally reported for Lawyer Portal, which does not have a deptdisplay.asp file.
by Osmanizim
SepCity Classified Ads - Cleartext Storage of Sensitive Information in data/classifieds.mdb
SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information.
by S.W.A.T.
CVSS 7.5
By Source