Exploitdb Exploits
31,351 exploits tracked across all sources.
natterchat 1.12 - Unauthenticated Sensitive Information Exposure via Direct Database File Request
Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for natterchat112.mdb.
by AlpHaNiX
Ikon AdManager <2.1 - Info Disclosure
Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for ikonBAnner_AdManager.mdb.
by Ghost Hacker
aspmanage banners - Arbitrary File Upload / File Disclosure
by ZoRLu
asp talk - SQL Injection / Cross-Site Scripting
by Bl@ckbe@rD
TWiki < 4.2.4 - Cross-Site Scripting via %URLPARAM{}% Variable
Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable.
by Marc Schoenefeld
TWiki < 4.2.4 - Remote Code Execution via SEARCH Variable
Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable.
by Troy Bollinge
phppgadmin <= 4.2.1 - Path Traversal via _language Parameter
Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php.
by dun
ASPPortal - Unauthenticated Sensitive Information Exposure via Direct Database File Access
ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb.
by ZoRLu
ASP AutoDealer - Unauthenticated Sensitive Information Exposure via Direct Database File Access
ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for auto.mdb.
by ZoRLu
Merlix Educate Server - Information Disclosure via Direct Request to config.asp and users.asp
Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information via a direct request to (1) config.asp and (2) users.asp.
by ZoRLu
Merlix Teamworx Server - SQL Injection
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL commands via the password parameter (aka passwd field) in a login action. NOTE: some of these details are obtained from third party information.
by ZoRLu
ASP AutoDealer - SQL Injection via ID Parameter
SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by AlpHaNiX
Nightfall Personal Diary 1.0 - Cross-Site Scripting via login.asp Username Parameter
Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter and possibly other "login fields." NOTE: some of these details are obtained from third party information.
by AlpHaNiX
NULL FTP Server Free and Pro 1.1.0.7 - Authenticated Command Injection via SITE Command
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand) in the middle of an argument.
by Tan Chew Keong
Tizag Countdown Creator 3 - Unauthenticated Arbitrary File Upload via index.php
Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uploaded file via a direct request to the file in pics/. NOTE: some of these details are obtained from third party information.
by ahmadbady
Nightfall Personal Diary 1.0 - Info Disclosure
Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for users-zza21.mdb.
by AlpHaNiX
Multiple Membership Script 2.5 - SQL Injection via id Parameter
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ViRuS_HaCkErS
Merlix Teamworx Server - Info Disclosure
Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for teamworx.mdb.
by ZoRLu
Katy Whitton RankEm - SQL Injection
SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the (1) txtusername parameter (aka username field) or the (2) txtpassword parameter (aka password field). NOTE: some of these details are obtained from third party information.
by AlpHaNiX
Katy Whitton RankEm - SQL Injection
SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter.
by AlpHaNiX
Merlix Educate Server - Unauthenticated Sensitive Information Exposure via Direct Request to db.mdb
Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers to obtain unspecified sensitive information via a direct request.
by ZoRLu
Cold BBS - Unauthenticated Sensitive Information Exposure via Direct Database File Access
Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for db/cforum.mdb.
by ahmadbady
ASPTicker 1.0 - Unauthenticated Sensitive Information Exposure via Direct Database File Access
ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for news.mdb.
by ZoRLu
ASP Portal - SQL Injection
Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp.
by AlpHaNiX
ASP AutoDealer - Unauthenticated Sensitive Information Exposure via Direct Database File Access
ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for auto.mdb.
by AlpHaNiX
By Source