Exploitdb Exploits
50,095 exploits tracked across all sources.
phpmoneybooks 1.0.4 - Path Traversal via File Parameter
Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2012-1669. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might have been fixed in 1.0.3.
by Mark Stanislav
PHP Grade Book < 1.9.5 BETA - Unauthenticated Database Exposure via SaveSQL Action
admin/index.php in PHP Grade Book before 1.9.5 BETA allows remote attackers to read the database via a SaveSQL action.
by Mark Stanislav
FreePBX < 2.9 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATH_INFO to admin/views/freepbx_reload.php; or (6) login parameter to recordings/index.php.
by Martin Tschirsich
phplist < 2.10.18 - SQL Injection via sortby Parameter
SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.
by LiquidWorm
Dell Webcam CrazyTalk - ActiveX BackImage (Metasploit)
by Metasploit
Oreans WinLicense 2.1.8.0 - Memory Corruption, DoS
Oreans WinLicense 2.1.8.0 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted xml file.
by LiquidWorm
Oreans Themida 2.1.8.0 - Buffer Overflow via Crafted .TMD File
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.
by LiquidWorm
phplist < 2.10.18 - Cross-Site Scripting via Num Parameter in Reconcileusers Action
Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.
by LiquidWorm
Open Journal Systems < 2.3.7 - Authenticated Remote Code Execution via Executable File Upload
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.
by High-Tech Bridge
Open Journal Systems < 2.3.6 - Authenticated Path Traversal via iBrowser Plugin rfiles.php param Parameter
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.
by High-Tech Bridge
Open Journal Systems < 2.3.7 - Cross-Site Scripting via iBrowser Plugin Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
by High-Tech Bridge
Open Journal Systems < 2.3.7 - Cross-Site Scripting via iBrowser Plugin Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
by High-Tech Bridge
CMSimple 3.3 - 'index.php' Cross-Site Scripting
by Stefan Schurtz
Adobe Photoshop CS5 < 12.0.5 and CS5.1 < 12.1.1 - Use-After-Free via Crafted TIFF File
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a crafted TIFF (aka .TIF) file.
by Francis Provencher
OneFileCMS - Failure to Restrict URL Access
by Abhi M Balakrishnan
GNUBoard < 4.34 - Cross-Site Scripting via File Download Filename Parameter
Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
by wh1ant
WebGlimpse 2.14.1/2.18.8 - 'webglimpse.cgi' Remote Command Injection
by Kevin Perry
By Source