Text Exploits
31,394 exploits tracked across all sources.
Acc Autos 4.0 - Unauthenticated Authentication Bypass via Cookie Manipulation
Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) username_cookie to "admin," (2) right_cookie to "1," and (3) id_cookie to "1."
by x0r
Dragan Mitic Apoll 0.7 beta and 0.7.5 - SQL Injection via User Parameter
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the user parameter.
by ZoRLu
pppblog < 0.3.8 - Directory Traversal via File Array Parameter
Directory traversal vulnerability in randompic.php in pppBLOG 0.3.8 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an index of the "file" array parameter, as demonstrated by file[0].
by JosS
MatPo Link 1.2 Beta - SQL Injection via id Parameter
SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ZoRLu
MatPo Link 1.2 Beta - Cross-Site Scripting via Thema Parameter
Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML via the thema parameter.
by Hakxer
BosDev BosClassifieds - SQL Injection via cat_id Parameter
SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2008-1838.
by ZoRLu
Dragan Mitic Apoll 0.7 beta and 0.7.5 - SQL Injection via Admin Index Pass Parameter
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the pass parameter.
by ZoRLu
Acc Statistics 1.1 - Unauthenticated Authentication Bypass via username_cookie
admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie cookie to "admin."
by Hakxer
Acc Statistics 1.1 - Unauthenticated Authentication Bypass via username_cookie
admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie cookie to "admin."
by Hakxer
Acc PHP eMail 1.1 - Unauthenticated Authentication Bypass via NEWSLETTERLOGIN Cookie
Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to "admin".
by Hakxer
Acc Statistics 1.1 - Unauthenticated Authentication Bypass via username_cookie
admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie cookie to "admin."
by x0r
lynx < 2.8.6rel.4 - Unauthenticated Remote Code Execution via Malicious .mailcap or mime.types Files
Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current working directory.
by Piotr Engelking
Apartment Search Script - Unauthenticated Arbitrary File Upload via editimage.php GIF Header Bypass
Unrestricted file upload vulnerability in editimage.php in Apartment Search Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a GIF header, then accessing this file via a direct request to a renamed file in Member_Admin/logo/.
by ZoRLu
NetRisk < 2.0 - SQL Injection via id Parameter
SQL injection vulnerability in index.php in NetRisk 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) profile page (profile.php) or (2) game page (game.php). NOTE: some of these details are obtained from third party information.
by StAkeR
YourFreeWorld Shopping Cart Script - SQL Injection via index.php c Parameter
SQL injection vulnerability in index.php in YourFreeWorld Shopping Cart Script allows remote attackers to execute arbitrary SQL commands via the c parameter.
by Hussin X
YourFreeWorld Downline Builder - SQL Injection via tr.php id Parameter
SQL injection vulnerability in tr.php in YourFreeWorld Downline Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Hussin X
netrisk < 2.0 - Cross-Site Scripting via Error Parameter
Cross-site scripting (XSS) vulnerability in error.php in NetRisk 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter to index.php. NOTE: some of these details are obtained from third party information.
by StAkeR
Maran PHP Shop - SQL Injection via prodshow.php id Parameter
SQL injection vulnerability in prodshow.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-4879.
by d3v1l
Maran PHP Shop - SQL Injection via prod.php cat Parameter
SQL injection vulnerability in prod.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2008-4880.
by JosS
Maran PHP Shop - Unauthenticated Authentication Bypass via User Cookie
admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to "demo."
by JosS
Joovili 3.1.4 - Unauthenticated Authentication Bypass via Cookie Manipulation
Joovili 3.1.4 allows remote attackers to bypass authentication and gain privileges as other users, including the administrator, by setting the (1) session_id, session_logged_in, and session_username cookies for user privileges; (2) session_admin_id, session_admin_username, and session_admin cookies for admin privileges; and (3) session_staff_id, session_staff_username, and session_staff cookies for staff users.
by ZoRLu
Downline Goldmine Builder and Addons - SQL Injection via id Parameter
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.
by Hussin X
Downline Goldmine Builder and Addons - SQL Injection via id Parameter
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.
by Hussin X
Apartment Search Script - Cross-Site Scripting via r Parameter
Cross-site scripting (XSS) vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject arbitrary web script or HTML via the r parameter.
by ZoRLu
1st News 4 Professional - SQL Injection via products.php id Parameter
SQL injection vulnerability in products.php in 1st News 4 Professional (PR 1) allows remote attackers to execute arbitrary SQL commands via the id parameter.
by TR-ShaRk
By Source