Exploitdb Exploits
50,095 exploits tracked across all sources.
TaskFreak! 0.6.4 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext, (2) sort, (3) dir, and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php. NOTE: some of these details are obtained from third party information.
by LiquidWorm
TaskFreak! 0.6.4 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext, (2) sort, (3) dir, and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php. NOTE: some of these details are obtained from third party information.
by LiquidWorm
Pixelpost 1.7.3 - Authenticated SQL Injection via findfid, id, selectfcat, selectfmon, or selectftag Parameter
Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) findfid, (2) id, (3) selectfcat, (4) selectfmon, or (5) selectftag parameter in an images action.
by LiquidWorm
Dokeos 1.8.6 2 - 'style' Cross-Site Scripting
by AutoSec Tools
Horde < 3.2.4 and 3.3.3 and Horde Groupware < 1.1.5 - Remote Code Execution via Image Driver Path Traversal
Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.
by skysbsb
XM Easy Personal FTP Server 5.8.0 - 'TYPE' Denial of Service
by Houssam Sahli
webERP 4.0.1 - 'InputSerialItemsFile.php' Arbitrary File Upload
by AutoSec Tools
RunCMS 2.2.2 - 'register.php' SQL Injection
by High-Tech Bridge SA
ZOHO ManageEngine ADSelfService Plus <4.5 Build 4500 - RCE
accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.
by Core Security
ZOHO ManageEngine ADSelfService Plus <4.5.4500 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.
by Core Security
Dolphin 7.0.4 - Multiple Cross-Site Scripting Vulnerabilities
by AutoSec Tools
LocatePC 1.05 (Ligatt Version + Others) - SQL Injection
by anonymous
xRadio 0.95b - '.xrl' Local Buffer Overflow (SEH)
by b0telh0
WordPress Plugin Enable Media Replace - Multiple Vulnerabilities
by Ulf Harnhammar
Web 2.0 Social Network Freunde Community - SQL Injection
by NoNameMT
By Source