Exploitdb Exploits

31,394 exploits tracked across all sources.

Sort: Activity Stars
CVE-2006-5890 EXPLOITDB text VERIFIED
Superfreaker Studios USupport 1.0 - SQL Injection via detail.asp id Parameter
SQL injection vulnerability in detail.asp in Superfreaker Studios USupport 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
by ajann
CVE-2006-5891 EXPLOITDB text VERIFIED
Superfreaker Studios UStore 1.0 - SQL Injection via ID Parameter
SQL injection vulnerability in detail.asp in Superfreaker Studios UStore 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by ajann
CVE-2006-5888 EXPLOITDB text VERIFIED
Superfreaker Studios UPublisher 1.0 - SQL Injection via viewarticle.asp ID Parameter
SQL injection vulnerability in viewarticle.asp in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by ajann
EIP-2026-113495 EXPLOITDB text VERIFIED
WordPress Core 2.0.5 - 'functions.php' Remote File Inclusion
by _ANtrAX_
CVE-2006-5951 EXPLOITDB text VERIFIED
Exophpdesk 1.2 - Remote File Inclusion via lang_file Parameter
PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
by Firewall1954
CVE-2006-5885 EXPLOITDB text VERIFIED
NuStore 1.0 - SQL Injection via Products.asp SubCatagoryID Parameter
SQL injection vulnerability in Products.asp in NuStore 1.0 allows remote attackers to execute arbitrary SQL commands via the SubCatagoryID parameter.
by ajann
CVE-2006-6041 EXPLOITDB text VERIFIED
WORK system e-commerce < 3.0.2 - Remote Code Execution via g_include Parameter
Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the g_include parameter to (1) index.php, (2) module/forum/forum.php, (3) unspecified files under module/, and (4) unspecified files under administration/module/.
by SlimTim10
CVE-2006-5895 EXPLOITDB text VERIFIED
EncapsCMS 0.3.6 - Remote File Inclusion via Root Parameter
PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
by Firewall
CVE-2006-6924 EXPLOITDB text VERIFIED
bitweaver <= 1.3.1 - Information Disclosure via SQL Error in sort_mode Parameter
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error. NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.
by laurent gaffie
CVE-2006-6924 EXPLOITDB text VERIFIED
bitweaver <= 1.3.1 - Information Disclosure via SQL Error in sort_mode Parameter
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error. NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.
by laurent gaffie
CVE-2006-6925 EXPLOITDB text VERIFIED
bitweaver <= 1.3.1 - Stored Cross-Site Scripting via Article Title, Blog Post Title, or Wiki Description
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
by laurent gaffie
CVE-2006-6924 EXPLOITDB text VERIFIED
bitweaver <= 1.3.1 - Information Disclosure via SQL Error in sort_mode Parameter
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error. NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.
by laurent gaffie
CVE-2006-6924 EXPLOITDB text VERIFIED
bitweaver <= 1.3.1 - Information Disclosure via SQL Error in sort_mode Parameter
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error. NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.
by laurent gaffie
EIP-2026-103618 EXPLOITDB text VERIFIED
Oracle Internet Directory 10.1.2.0.2 - 'oidldapd' Remote Memory Corruption
by Intevydis
EIP-2026-110030 EXPLOITDB text VERIFIED
Omnistar Article Manager - Multiple SQL Injections
by Benjamin Moss
CVE-2006-5865 EXPLOITDB text VERIFIED
MyAlbum < 3.02 - Remote Code Execution via Language File Inclusion
PHP remote file inclusion vulnerability in language.inc.php in MyAlbum 3.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the langs_dir parameter.
by Silahsiz Kuvvetler
CVE-2006-5863 EXPLOITDB text VERIFIED
otterware letterit2 - Remote File Inclusion via lang Parameter
PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter.
by v1per-haCker
CVE-2006-5914 EXPLOITDB text VERIFIED
SAMEDIA LandShop - SQL Injection via ls.php infield Parameter
SQL injection vulnerability in ls.php in SAMEDIA LandShop allows remote attackers to execute arbitrary SQL commands via the infield parameter. NOTE: the start, search_order, search_type, and search_area parameters are already covered by CVE-2005-4018.
by laurent gaffie
CVE-2006-5915 EXPLOITDB text VERIFIED
SAMEDIA LandShop - Cross-Site Scripting via ls.php Parameters
Multiple cross-site scripting (XSS) vulnerabilities in ls.php in SAMEDIA LandShop allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) CAT_ID, (3) keyword, (4) search_area, (5) search_type, (6) infield, or (7) search_order parameter.
by laurent gaffie
CVE-2006-5923 EXPLOITDB text VERIFIED
GimeScripts Shopping Catalog < 0.9.1 - Remote File Inclusion via Custom Parameter
PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the custom parameter.
by v1per-haCker
CVE-2006-6923 EXPLOITDB text VERIFIED
bitweaver <= 1.3.1 - SQL Injection via Newsletter Edition tk Parameter
SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tk parameter.
by laurent gaffie
CVE-2006-6586 EXPLOITDB text VERIFIED
vBlog a0.1_nonfunc - Remote File Inclusion via cfgProgDir Parameter
Multiple PHP remote file inclusion vulnerabilities in Vortex Blog (vBlog, aka C12) a0.1_nonfunc allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter in (1) secure.php or (2) checklogin.php in admin/auth/.
by DeltahackingTEAM
EIP-2026-112373 EXPLOITDB text VERIFIED
Speedywiki 2.0/2.1 - Multiple Input Validation Vulnerabilities
by laurent gaffie
EIP-2026-111418 EXPLOITDB text VERIFIED
Portix-PHP 0.4.2 - Multiple SQL Injections
by Benjamin Moss
EIP-2026-111151 EXPLOITDB text VERIFIED
PHPMyChat Plus 1.9 - Multiple Local File Inclusions
by ajann
By Source
All 31,394 Writeup 66,851 Exploitdb 50,095 Nomisec 23,247 Github 5,519 Metasploit 3,327 Vulncheck_xdb 1,154 Gitlab 550 Inthewild 514 Gitee 415 Patchapalooza 346
By Language
text 31,394 python 7,553 ruby 6,021 c 3,837 perl 2,849 html 2,092 php 1,347 bash 462 java 416 c++ 341 shell 289 javascript 248 go 92 typescript 32 powershell 29