Exploitdb Exploits

31,394 exploits tracked across all sources.

Sort: Activity Stars

CVE-2007-1021 EXPLOITDB text VERIFIED

CodeAvalanche News 1.x - SQL Injection

SQL injection vulnerability in inc_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CAT_ID parameter.

by beks

View

CVE-2007-1016 EXPLOITDB text VERIFIED

Aktueldownload Haber script - SQL Injection

SQL injection vulnerability in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via certain vectors related to the HaberDetay.asp and rss.asp components, and the id and kid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the combination of the HaberDetay.asp component and the id parameter is already covered by another February 2007 CVE candidate.

by Mehmet Ince

View

CVE-2007-0986 EXPLOITDB text VERIFIED

Jupiter CMS 1.1.5 - Remote Code Execution via FTP URL in Index.php

PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5, when PHP 5.0.0 or later is used, allows remote attackers to execute arbitrary PHP code via an ftp URL in the n parameter.

by DarkFig

View

CVE-2007-0970 EXPLOITDB text VERIFIED

WebTester <5.0.20060927 - SQL Injection

Multiple SQL injection vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to execute arbitrary SQL commands via the testID parameter to directions.php, and unspecified parameters to other files that accept GET or POST input.

by Moran Zavdi

View

CVE-2007-0987 EXPLOITDB text VERIFIED

Jupiter CMS <1.1.5 - Path Traversal

Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot), or an absolute pathname, in the n parameter.

by DarkFig

View

CVE-2007-0982 EXPLOITDB text VERIFIED

TaskFreak! 0.5.5 - Cross-Site Scripting via tznMessage Parameter

Cross-site scripting (XSS) vulnerability in error.php in TaskFreak! 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the tznMessage parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

by Spiked

View

CVE-2007-0873 EXPLOITDB text VERIFIED

nabopoll 1.1.2 - Unauthenticated Administrative Function Access via Direct Request

nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for (1) config_edit.php, (2) template_edit.php, or (3) survey_edit.php in admin/.

by sn0oPy

View

CVE-2007-0984 EXPLOITDB text VERIFIED

PollMentor 2.0 - SQL Injection via id Parameter

SQL injection vulnerability in admin_poll.asp in PollMentor 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to pollmentorres.asp.

by SaO

View

CVE-2007-0951 EXPLOITDB text VERIFIED

Fullaspsite ASP Hosting Site - SQL Injection

SQL injection vulnerability in listmain.asp in Fullaspsite ASP Hosting Site allows remote attackers to execute arbitrary SQL commands via the cat parameter.

by ShaFuck31

View

CVE-2007-0950 EXPLOITDB text VERIFIED

Fullaspsite ASP Hosting Site - Cross-Site Scripting via cat Parameter

Cross-site scripting (XSS) vulnerability in listmain.asp in Fullaspsite ASP Hosting Site allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

by ShaFuck31

View

CVE-2007-1049 EXPLOITDB text VERIFIED

WordPress 2.0-2.0.8 and 2.1 - Cross-Site Scripting via wp_explain_nonce Function

Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

by PsychoGun

View

CVE-2007-0900 EXPLOITDB text VERIFIED