Exploitdb Exploits
31,394 exploits tracked across all sources.
rp_world 1.0.2 - Remote File Inclusion via sql_language Parameter
PHP remote file inclusion vulnerability in config.php in RPW 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the sql_language parameter.
by 3l3ctric-Cracker
GTK < 2.4.13 - Denial of Service via Malformed Image File
The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.
by Lubomir Kundrak
ASP NEWS < 3 - SQL Injection via id Parameter
SQL injection vulnerability in news_detail.asp in ASP NEWS 3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ajann
ASP EDGE 1.2b - SQL Injection via User Parameter
SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
by ajann
phpXMLDOM 0.3 - Remote File Inclusion via Path Parameter
Multiple PHP remote file inclusion vulnerabilities in phpXMLDOM (phpXD) 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) dom.php, (2) dtd.php, or (3) parser.php in include/.
by 3l3ctric-Cracker
BBClone 0.31 - Remote File Inclusion via BBC_LANGUAGE_PATH Parameter
PHP remote file inclusion vulnerability in lib/selectlang.php in BBClone 0.31 allows remote attackers to execute arbitrary PHP code via a URL in the BBC_LANGUAGE_PATH parameter.
by 3l3ctric-Cracker
Apple QuickTime - Remote Code Execution via Malformed PICT Image ARGB Record
The _GetSrcBits32ARGB function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT image with a malformed Alpha RGB (ARGB) record, which triggers memory corruption.
by LMH
Oracle Database 10.1.0.5 - SQL Injection in Change Data Capture and Data Pump Metadata API
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER.
by Joxean Koret
Oracle 10g Release 1 - SQL Injection via Multiple Parameters in SYS.KUPV$FT and SYS.KUPV$FT_INT Packages
Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACH_JOB, (2) HAS_PRIVS, and (3) OPEN_JOB functions in the SYS.KUPV$FT package; and (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK, and (16) VALID_HANDLE functions in the SYS.KUPV$FT_INT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues.
by Joxean Koret
Oracle 10g - SYS.DBMS_CDC_IMPDP.BUMP_SEQUENCE PL / SQL Injection
by Joxean Koret
Bitweaver 1.3.1 Articles and Blogs - Multiple Cross-Site Scripting Vulnerabilities
by CorryL
212Cafe Guestbook 4.00 - 'show.php' Cross-Site Scripting
by Linux_Drox
212Cafe Board 0.08 Beta / 6.30 Beta - Multiple Cross-Site Scripting Vulnerabilities
by Linux_Drox
WebChat 0.77 - Remote File Inclusion via WEBCHATPATH Parameter
PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP code via a URL in the WEBCHATPATH parameter.
by v1per-haCker
Upload-Service 1.0 - Remote File Inclusion via maindir Parameter
PHP remote file inclusion vulnerability in upload/top.php in Upload-Service 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the maindir parameter.
by y3dips
Simple Machines Forum 1.1 RC3 - Authenticated Cross-Site Scripting via PM Recipient or BCC Field
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or (2) BCC field when selecting send in a pm action.
by Aria-Security Team
PhpSherpa - Remote File Inclusion via racine Parameter
PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitrary PHP code via a URL in the racine parameter.
by 3l3ctric-Cracker
Neon Labs Website < 3.2 - Remote File Inclusion via g_strRootDir Parameter
PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website (nlws) 3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the g_strRootDir parameter.
by 3l3ctric-Cracker
MySpeach 2.1 beta - Remote File Inclusion via my[root] Parameter
PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the my[root] parameter.
by 3l3ctric-Cracker
Easebay Resources Paypal Subscription - Manager Multiple Input Validation Vulnerabilities
by Doz
Easebay Resources Login Manager - Multiple Input Validation Vulnerabilities
by Doz
Bradabra < 2.0.5 - Remote File Inclusion via include_path Parameter
PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
by GoLd_M
ComVironment 4.0 - Remote File Inclusion via inc_dir Parameter
PHP remote file inclusion vulnerability in libraries/grab_globals.lib.php in ComVironment 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
by GoLd_M
ArsDigita Community System <3.4.10 & Education Solution 1.1 - Directory Traversal
Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier, and ArsDigita Community Education Solution (ACES) 1.1, allows remote attackers to read arbitrary files via .%252e/ (double-encoded dot dot slash) sequences in the URI.
by Elliot Kendall
By Source