Exploitdb Exploits
31,353 exploits tracked across all sources.
A-LINK WL54AP2 and WL54AP3 - Unauthenticated Admin Access via Blank Default Password
The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access.
by Henri Lindberg
MyPHP Forum < 3.0 - SQL Injection via Member and Post Parameters
Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a confirm action, the (2) user parameter in a newconfirm action, and (3) reqpwd action to member.php; and the (4) quote parameter in a post action and (5) pid parameter in an edit action to post.php, different vectors than CVE-2005-0413.2 and CVE-2007-6667.
by StAkeR
Absolute Poll Manager XE 4.1 - Unauthenticated Authentication Bypass via Cookie Manipulation
Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
by Hakxer
Absolute Podcast .NET 1.0 - Unauthenticated Authentication Bypass via Cookie Manipulation
Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
by Hakxer
Absolute File Send 1.0 - Remote Insecure Cookie Handling
by Hakxer
Dovecot 1.1.4 and 1.1.5 - Denial of Service via Malformed From Address in IMAP FETCH ENVELOPE
The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."
by anonymous
SonicOS Enhanced < 4.0.1.1 - Cross-Site Scripting via CFS Block Page
Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."
by pagvac
Venalsur Booking Centre Booking System for Hotels Group - Stored Cross-Site Scripting via OfertaID Parameter
Cross-site scripting (XSS) vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to inject arbitrary web script or HTML via the OfertaID parameter.
by d3b4g
WebCards < 1.3 - SQL Injection via User Parameter
SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter. NOTE: some of these details are obtained from third party information.
by t0pP8uZz
WebCards < 1.3 - Authenticated Arbitrary File Upload via Add Image Macro
Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file.
by t0pP8uZz
Venalsur Booking Centre Booking System for Hotels Group - SQL Injection via OfertaID Parameter
SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to execute arbitrary SQL commands via the OfertaID parameter.
by d3b4g
Harlandscripts Pro Traffic One - SQL Injection via poll_results.php id Parameter
SQL injection vulnerability in poll_results.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via the id parameter.
by Hussin X
Kmita Gallery - Cross-Site Scripting via Begin and Searchtext Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by cize0f
Harlandscripts Pro Traffic One - SQL Injection via trg Parameter in mypage.php
SQL injection vulnerability in mypage.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via the trg parameter.
by Beenu Arora
Extrakt Framework 0.7 - Cross-Site Scripting via plugins[file][id] Parameter
Cross-site scripting (XSS) vulnerability in index.php in Extrakt Framework 0.7 allows remote attackers to inject arbitrary web script or HTML via the plugins[file][id] parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by ShockShadow
e107 plugin fm pro 1 - File Disclosure / Arbitrary File Upload / Directory Traversal
by GoLd_M
Sepal SPBOARD 4.5 - Remote Command Execution via board.cgi file Parameter
board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a down_file action.
by GoLd_M
Dorsa CMS - 'Default_.aspx' Cross-Site Scripting
by Pouya_Server
Easy-script Tlguesbook - Authentication Bypass
TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.
by x0r
PHP-Nuke League module - Cross-Site Scripting via tid Parameter
Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php.
by Ehsan_Hp200
Graphiks MyForum 1.3 - Unauthenticated Authentication Bypass via Cookie Manipulation
Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.
by Stack
Kmita Catalogue 2.x - Cross-Site Scripting via Search Parameter
Cross-site scripting (XSS) vulnerability in search.php in Kmita Catalogue 2.x allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
by cize0f
H&H WebSoccer 2.80 - SQL Injection via liga.php id Parameter
SQL injection vulnerability in liga.php in H&H WebSoccer 2.80 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by d3v1l
By Source