Text Exploits
31,394 exploits tracked across all sources.
Gurur haber 2.0 - SQL Injection via id Parameter
SQL injection vulnerability in uyeler2.php in Gurur haber 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by dumenci
PHP <includes/class/class_tpl.php - RCE
PHP remote file inclusion vulnerability in includes/class/class_tpl.php in Firesoft allows remote attackers to execute arbitrary PHP code via a URL in the cache_file parameter.
by DarKdewiL
Dalai Forum 1.1 - Path Traversal via Chemin Parameter
Directory traversal vulnerability in forumreply.php in Dalai Forum 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the chemin parameter.
by DarKdewiL
Unreal Engine - Denial of Service via Long GIF Filename Request
Stack-based buffer overflow in the logging function in the Unreal engine, possibly 2003 and 2004, as used in the internal web server, allows remote attackers to cause a denial of service (application crash) via a request for a long .gif filename in the images/ directory, related to conversion from Unicode to ASCII.
by Luigi Auriemma
Squirrelcart < 1.6.3 - Remote File Inclusion via site_isp_root Parameter
PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the site_isp_root parameter, probably related to cart.php.
by ShaiMagal
Php Hosting Biller 1.0 - Cross-Site Scripting via PATH_INFO
Cross-site scripting (XSS) vulnerability in index.php in Php Hosting Biller 1.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
by Serapis.net
Toribash < 2.71 - Remote Code Execution via NICK Command Format String
Format string vulnerability in the server in Toribash 2.71 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the NICK command (client nickname) when entering a game.
by Luigi Auriemma
Image Space rFactor <1.250 - Buffer Overflow
Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote attackers to execute arbitrary code via a packet with ID (1) 0x80 or (2) 0x88 to UDP port 34297, related to the buffer containing the server version number.
by Luigi Auriemma
Cisco IOS 12.0-12.4 - Denial of Service via 'show ip bgp regexp' Command
Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows context-dependent attackers to cause a denial of service (device restart and BGP routing table rebuild) via certain regular expressions in a "show ip bgp regexp" command. NOTE: unauthenticated remote attacks are possible in environments with anonymous telnet and Looking Glass access.
by anonymous
Text File Search ASP - Cross-Site Scripting via Query Parameter
Cross-site scripting (XSS) vulnerability in textfilesearch.asp in the Text File Search ASP (Classic) edition allows remote attackers to inject arbitrary web script or HTML via the query parameter.
by GeFORC3
GetMyOwnArcade - SQL Injection via Search Query Parameter
SQL injection vulnerability in search.php in GetMyOwnArcade allows remote attackers to execute arbitrary SQL commands via the query parameter.
by RoXur777
BlueCat Networks Adonis DNS/DHCP <5.0.2.8 - Privilege Escalation
The Command Line Interface (CLI), aka Adonis Administration Console, on the BlueCat Networks Adonis DNS/DHCP appliance 5.0.2.8 allows local admin users to gain root privileges on the underlying operating system via shell metacharacters in a command.
by forloop
Yahoo! Messenger 8.1.0.413 - Buffer Overflow
Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the attacker's peer Yahoo! Messenger application when this request is accepted.
by team509
Sun JDK < 1.5.0 and JRE < 1.4.2 and SDK < 1.4.2_14 - Unauthenticated Privilege Escalation via Font Parsing
Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.
by John Heasman
RndLabs Babo Violent 2 - Multiple Vulnerabilities
by Luigi Auriemma
Apache Tomcat Session ID Exposure via Cookie Delimiter Mishandling
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
by Tomasz Kuczynski
Live For Speed S1/S2 - Multiple Vulnerabilities
by Luigi Auriemma
IBM Rational ClearQuest <7.0.0.2 - SQL Injection
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attackers to execute arbitrary SQL commands via the username parameter in a GenerateMainFrame command.
by s4squatch
WordPress Pool 1.0.7 - Cross-Site Scripting via PATH_INFO
Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
by MustLive
SOTEeSKLEP < 4.0 - Directory Traversal via File Parameter
Directory traversal vulnerability in go/_files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
by dun
Prozilla Webring - SQL Injection via Category Parameter
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL commands via the cat parameter.
by t0pP8uZz
php-stats 0.1.9.2 - Cross-Site Scripting via IP Parameter
Cross-site scripting (XSS) vulnerability in whois.php in Php-stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the IP parameter.
by vasodipandora
Openads (PHPAdsNew) < 2.0.8 - 'lib-remotehost.inc.php' Remote File Inclusion
by Ma$tEr-0F-De$a$t0r
Omnistar Lib2 PHP 0.2 - Remote File Inclusion via DOCUMENT_ROOT Parameter
PHP remote file inclusion vulnerability in adm/my_statistics.php in Omnistar Lib2 PHP 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.
by ilker Kandemir
Pixlie 1.7 - Denial of Service via Remote Directory Tree Processing
pixlie.php in Pixlie 1.7 allows remote attackers to trigger the reading and JPEG image processing of files in a remote directory tree via a URL in the root parameter. NOTE: this can be leveraged for traffic amplification or other denial of service.
by Rizgar
By Source