Exploitdb Exploits

31,394 exploits tracked across all sources.

Sort: Activity Stars
CVE-2006-6284 EXPLOITDB text VERIFIED
Vikingboard 0.1.2 - Authenticated Directory Traversal via Admin.php Act Parameter
Directory traversal vulnerability in admin.php in Vikingboard 0.1.2 allows remote authenticated administrators to include arbitrary files via a .. (dot dot) sequence in the act parameter.
by laurent gaffie
EIP-2026-105594 EXPLOITDB text VERIFIED
Boonex 2.0 Dolphin - 'index.php' Remote File Inclusion
by S.W.A.T.
CVE-2006-6211 EXPLOITDB text VERIFIED
BirdBlog 1.4.0 - Stored Cross-Site Scripting via msg, month, or page Parameters
Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page parameter to (d) admin/logs.php, different vectors than CVE-2006-5064.
by the_Edit0r
CVE-2006-6211 EXPLOITDB text VERIFIED
BirdBlog 1.4.0 - Stored Cross-Site Scripting via msg, month, or page Parameters
Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page parameter to (d) admin/logs.php, different vectors than CVE-2006-5064.
by the_Edit0r
CVE-2006-6211 EXPLOITDB text VERIFIED
BirdBlog 1.4.0 - Stored Cross-Site Scripting via msg, month, or page Parameters
Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page parameter to (d) admin/logs.php, different vectors than CVE-2006-5064.
by the_Edit0r
CVE-2006-6211 EXPLOITDB text VERIFIED
BirdBlog 1.4.0 - Stored Cross-Site Scripting via msg, month, or page Parameters
Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page parameter to (d) admin/logs.php, different vectors than CVE-2006-5064.
by the_Edit0r
CVE-2006-6062 EXPLOITDB text VERIFIED
Apple Mac OS X 10.4.8 - Denial of Service via Malformed UDTO HFS+ Disk Image
Unspecified vulnerability in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a malformed UDTO HFS+ disk image, such as with "bad sectors," which triggers memory corruption.
by LMH
CVE-2006-6153 EXPLOITDB text VERIFIED
vSpin.net Classified System 2004 - Cross-Site Scripting via catname or minprice Parameter
Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via (1) catname parameter to cat.asp or the (2) minprice parameter to search.asp.
by laurent gaffie
CVE-2006-6152 EXPLOITDB text VERIFIED
vSpin.net Classified System 2004 - SQL Injection via cat Parameter or search.asp Parameters
Multiple SQL injection vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to (a) cat.asp, or the (2) keyword, (3) order, (4) sort, (5) menuSelect, or (6) state parameter to (b) search.asp.
by laurent gaffie
CVE-2006-6153 EXPLOITDB text VERIFIED
vSpin.net Classified System 2004 - Cross-Site Scripting via catname or minprice Parameter
Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via (1) catname parameter to cat.asp or the (2) minprice parameter to search.asp.
by laurent gaffie
CVE-2006-6152 EXPLOITDB text VERIFIED
vSpin.net Classified System 2004 - SQL Injection via cat Parameter or search.asp Parameters
Multiple SQL injection vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to (a) cat.asp, or the (2) keyword, (3) order, (4) sort, (5) menuSelect, or (6) state parameter to (b) search.asp.
by laurent gaffie
CVE-2006-6768 EXPLOITDB text VERIFIED
PWP Technologies The Classified Ad System - XSS
Multiple cross-site scripting (XSS) vulnerabilities in default.asp in PWP Technologies The Classified Ad System allow remote attackers to inject arbitrary web script or HTML via the (1) cat or (2) main parameter.
by laurent gaffie
CVE-2006-6929 EXPLOITDB text VERIFIED
Rapid Classified 3.1 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) reply.asp or (b) view_print.asp, the (2) SH1 parameter to (c) search.asp, the (3) name parameter to reply.asp, or the (4) dosearch parameter to (d) advsearch.asp.
by laurent gaffie
CVE-2006-6930 EXPLOITDB text VERIFIED
Rapid Classified 3.1 - SQL Injection via viewad.asp id Parameter
SQL injection vulnerability in viewad.asp in Rapid Classified 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by laurent gaffie
CVE-2006-6929 EXPLOITDB text VERIFIED
Rapid Classified 3.1 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) reply.asp or (b) view_print.asp, the (2) SH1 parameter to (c) search.asp, the (3) name parameter to reply.asp, or the (4) dosearch parameter to (d) advsearch.asp.
by laurent gaffie
CVE-2006-6929 EXPLOITDB text VERIFIED
Rapid Classified 3.1 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) reply.asp or (b) view_print.asp, the (2) SH1 parameter to (c) search.asp, the (3) name parameter to reply.asp, or the (4) dosearch parameter to (d) advsearch.asp.
by laurent gaffie
CVE-2006-6929 EXPLOITDB text VERIFIED
Rapid Classified 3.1 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) reply.asp or (b) view_print.asp, the (2) SH1 parameter to (c) search.asp, the (3) name parameter to reply.asp, or the (4) dosearch parameter to (d) advsearch.asp.
by laurent gaffie
CVE-2006-6342 EXPLOITDB text VERIFIED
KLF-REALTY - SQL Injection via Category, Agent, or Property ID Parameters
Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
by laurent gaffie
CVE-2006-6342 EXPLOITDB text VERIFIED
KLF-REALTY - SQL Injection via Category, Agent, or Property ID Parameters
Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
by laurent gaffie
CVE-2006-6927 EXPLOITDB text VERIFIED
Rialto 1.6 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter to (d) listmain.asp, (e) searchoption.asp, or (f) searchmain.asp; the (5) Keyword parameter to (g) searchkey.asp; the (6) area parameter to searchmain.asp or searchoption.asp; the (7) searchin parameter to searchkey.asp; or the (8) cost1, (9) cost2, (10) acreage1, or (11) squarefeet1 parameters to searchoption.asp. NOTE: some of these details are obtained from third party information.
by laurent gaffie
CVE-2006-6928 EXPLOITDB text VERIFIED
Rialto 1.6 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) listmain.asp or (b) searchmain.asp, the (2) the Keyword parameter to (c) searchkey.asp, or the (3) refno parameter to (d) forminfo.asp.
by laurent gaffie
CVE-2006-6927 EXPLOITDB text VERIFIED
Rialto 1.6 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter to (d) listmain.asp, (e) searchoption.asp, or (f) searchmain.asp; the (5) Keyword parameter to (g) searchkey.asp; the (6) area parameter to searchmain.asp or searchoption.asp; the (7) searchin parameter to searchkey.asp; or the (8) cost1, (9) cost2, (10) acreage1, or (11) squarefeet1 parameters to searchoption.asp. NOTE: some of these details are obtained from third party information.
by laurent gaffie
CVE-2006-6928 EXPLOITDB text VERIFIED
Rialto 1.6 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) listmain.asp or (b) searchmain.asp, the (2) the Keyword parameter to (c) searchkey.asp, or the (3) refno parameter to (d) forminfo.asp.
by laurent gaffie
CVE-2006-6927 EXPLOITDB text VERIFIED
Rialto 1.6 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter to (d) listmain.asp, (e) searchoption.asp, or (f) searchmain.asp; the (5) Keyword parameter to (g) searchkey.asp; the (6) area parameter to searchmain.asp or searchoption.asp; the (7) searchin parameter to searchkey.asp; or the (8) cost1, (9) cost2, (10) acreage1, or (11) squarefeet1 parameters to searchoption.asp. NOTE: some of these details are obtained from third party information.
by laurent gaffie
CVE-2006-6927 EXPLOITDB text VERIFIED
Rialto 1.6 - SQL Injection via Multiple Parameters
Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter to (d) listmain.asp, (e) searchoption.asp, or (f) searchmain.asp; the (5) Keyword parameter to (g) searchkey.asp; the (6) area parameter to searchmain.asp or searchoption.asp; the (7) searchin parameter to searchkey.asp; or the (8) cost1, (9) cost2, (10) acreage1, or (11) squarefeet1 parameters to searchoption.asp. NOTE: some of these details are obtained from third party information.
by laurent gaffie
By Source
All 31,394 Writeup 66,850 Exploitdb 50,095 Nomisec 23,247 Github 5,489 Metasploit 3,327 Vulncheck_xdb 1,154 Gitlab 550 Inthewild 514 Gitee 415 Patchapalooza 346
By Language
text 31,394 python 7,552 ruby 6,021 c 3,831 perl 2,849 html 2,092 php 1,347 bash 462 java 416 c++ 341 shell 289 javascript 248 go 92 typescript 32 powershell 29