Exploits

    Dashboard / Exploits

    7.5
    High

    CVE-2010-4963

    Last Modified: 26 Aug 2014

    SQL injection vulnerability in folder/list in Hulihan BXR 0.6.8 allows remote attackers to execute arbitrary SQL commands via the order_by parameter.

    Source:High-Tech Bridge SA
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4959

    Last Modified: 16 Jul 2010

    SQL injection vulnerability in the login feature in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the password parameter.

    Source:D4rk357
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4955

    Last Modified: 5 Aug 2010

    SQL injection vulnerability in board/board.php in APBoard Developers APBoard 2.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-3078.

    Source:secret
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4954

    Last Modified: 21 Sept 2016

    SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.

    Source:secret
    Published:9 Oct 2011
    4.3
    Medium

    CVE-2010-4949

    Last Modified: 20 Dec 2016

    Cross-site scripting (XSS) vulnerability in the (1) FreiChat component before 2.1.2 for Joomla! and the (2) FreiChatPure component before 1.2.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML by entering it in an unspecified window.

    Source:nag_sunny
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4948

    Last Modified: 27 Sept 2017

    PHP remote file inclusion vulnerability in libs/adodb/adodb.inc.php in PHP Free Photo Gallery script allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

    Source:ViRuS Qalaa
    Published:9 Oct 2011
    4.3
    Medium

    CVE-2010-4947

    Last Modified: 27 Sept 2010

    Cross-site scripting (XSS) vulnerability in advanced_search_result.php in ALLPC 2.5 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.

    Source:**RoAd_KiLlEr**
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4946

    Last Modified: 27 Sept 2010

    SQL injection vulnerability in product_info.php in ALLPC 2.5 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.

    Source:**RoAd_KiLlEr**
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4945

    Last Modified: 15 Dec 2016

    SQL injection vulnerability in the CamelcityDB (com_camelcitydb2) component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

    Source:Amine_92
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4944

    Last Modified: 5 Dec 2016

    SQL injection vulnerability in the Elite Experts (com_elite_experts) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showExpertProfileDetailed action to index.php.

    Source:**RoAd_KiLlEr**
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4943

    Last Modified: 11 Aug 2010

    Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the class_path parameter to (1) file.php or (2) com_del.php.

    Source:LoSt.HaCkEr
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4942

    Last Modified: 25 Sept 2010

    SQL injection vulnerability in location.php in the eCal module in E-Xoopport Samsara 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the lid parameter.

    Source:_mRkZ_
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4941

    Last Modified: 20 Dec 2016

    SQL injection vulnerability in the Teams (com_teams) component 1_1028_100809_1711 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to index.php.

    Source:Salvatore Fresta
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4940

    Last Modified: 23 Sept 2010

    SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:BrOx-Dz
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4939

    Last Modified: 12 Jul 2015

    PHP remote file inclusion vulnerability in index.php in MailForm 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.

    Source:LoSt.HaCkEr
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4938

    Last Modified: 20 Dec 2016

    SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a categories action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

    Source:ViRuS Qalaa
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4937

    Last Modified: 15 Dec 2016

    Multiple SQL injection vulnerabilities in the Amblog (com_amblog) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) articleid or (2) catid parameter to index.php.

    Source:Salvatore Fresta
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4935

    Last Modified: 3 Oct 2010

    SQL injection vulnerability in poll.php in Entrans 0.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sid parameter.

    Source:keracker
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4934

    Last Modified: 12 Jul 2015

    SQL injection vulnerability in video.php in Get Tube 4.51 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:Mr.P3rfekT
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4933

    Last Modified: 12 Jul 2015

    SQL injection vulnerability in filemgmt/singlefile.php in Geeklog 1.3.8 allows remote attackers to execute arbitrary SQL commands via the lid parameter.

    Source:Gamoscu
    Published:9 Oct 2011
    10
    Critical

    CVE-2010-4931

    Last Modified: 8 Sept 2010

    Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder_level parameter. NOTE: this issue has been disputed by a reliable third party

    Source:MoDaMeR
    Published:9 Oct 2011
    4.3
    Medium

    CVE-2010-4930

    Last Modified: 18 Sept 2014

    Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailType parameter in a mail/auth/processlogin action.

    Source:Vicente Aguilera Diaz
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4929

    Last Modified: 19 Dec 2016

    SQL injection vulnerability in the Joostina (com_ezautos) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the firstCode parameter in a helpers action to index.php.

    Source:Gamoscu
    Published:9 Oct 2011
    4.3
    Medium

    CVE-2010-4928

    Last Modified: 20 Dec 2016

    Cross-site scripting (XSS) vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML by placing it after a > (greater than) character.

    Source:Valentin
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4927

    Last Modified: 20 Dec 2016

    SQL injection vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a country action to index.php.

    Source:Valentin
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4926

    Last Modified: 20 Dec 2016

    SQL injection vulnerability in the TimeTrack (com_timetrack) component 1.2.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ct_id parameter in a timetrack action to index.php.

    Source:Salvatore Fresta
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4925

    Last Modified: 5 Aug 2010

    SQL injection vulnerability in clic.php in the Partenaires module 1.5 for Nuked-Klan allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:Metropolis
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4924

    Last Modified: 11 Aug 2010

    PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to execute arbitrary PHP code via a URL in the actionPath parameter. NOTE: this issue has been disputed by a reliable third party

    Source:Offensive
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4922

    Last Modified: 27 Aug 2014

    Multiple SQL injection vulnerabilities in Allinta CMS 22.07.2010 allow remote attackers to execute arbitrary SQL commands via the i parameter in an edit action to (1) contentAE.asp or (2) templatesAE.asp.

    Source:High-Tech Bridge SA
    Published:9 Oct 2011
    7.5
    High

    CVE-2010-4921

    Last Modified: 5 Sept 2010

    SQL injection vulnerability in inc_pollingboothmanager.asp in DMXReady Polling Booth Manager allows remote attackers to execute arbitrary SQL commands via the QuestionID parameter in a results action.

    Source:L0rd CrusAd3r
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4920

    Last Modified: 6 Sept 2010

    SQL injection vulnerability in detail.asp in Micronetsoft Rental Property Management Website 1.0 allows remote attackers to execute arbitrary SQL commands via the ad_ID parameter.

    Source:L0rd CrusAd3r
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4919

    Last Modified: 6 Sept 2010

    SQL injection vulnerability in detail.asp in Micronetsoft RV Dealer Website 1.0 allows remote attackers to execute arbitrary SQL commands via the vehicletypeID parameter.

    Source:L0rd CrusAd3r
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4918

    Last Modified: 19 Dec 2016

    PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the config parameter to magazine.functions.php.

    Source:LoSt.HaCkEr
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4917

    Last Modified: 5 Sept 2010

    SQL injection vulnerability in sources/search.php in A-Blog 2.0 allows remote attackers to execute arbitrary SQL commands via the words parameter.

    Source:Ptrace Security
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4916

    Last Modified: 7 Sept 2010

    Multiple SQL injection vulnerabilities in index.cfm in ColdGen ColdUserGroup 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) ArticleID or (2) LibraryID parameter.

    Source:mr_me
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4915

    Last Modified: 7 Sept 2010

    SQL injection vulnerability in index.cfm in ColdGen ColdBookmarks 1.22 allows remote attackers to execute arbitrary SQL commands via the BookmarkID parameter in an EditBookmark action.

    Source:mr_me
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4914

    Last Modified: 4 Sept 2010

    PHP remote file inclusion vulnerability in tools/phpmailer/class.phpmailer.php in PHP Classifieds 7.3 allows remote attackers to execute arbitrary PHP code via a URL in the lang_path parameter.

    Source:alsa7r
    Published:8 Oct 2011
    4.3
    Medium

    CVE-2010-4913

    Last Modified: 7 Sept 2010

    Cross-site scripting (XSS) vulnerability in the search feature in ColdGen ColdUserGroup 1.06 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some of these details are obtained from third party information.

    Source:mr_me
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4912

    Last Modified: 13 Sept 2010

    SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands via the shopid parameter in a view action.

    Source:KnocKout
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4911

    Last Modified: 4 Sept 2010

    SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL commands via the sid parameter.

    Source:h4ck3r
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4910

    Last Modified: 6 Nov 2010

    SQL injection vulnerability in index.cfm in ColdGen ColdCalendar 2.06 allows remote attackers to execute arbitrary SQL commands via the EventID parameter in a ViewEventDetails action.

    Source:mr_me
    Published:8 Oct 2011
    4.3
    Medium

    CVE-2010-4909

    Last Modified: 22 Dec 2016

    Multiple cross-site scripting (XSS) vulnerabilities in PaysiteReviewCMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or the (2) image parameter to image.php.

    Source:Valentin Hoebel
    Published:8 Oct 2011
    4.3
    Medium

    CVE-2010-4907

    Last Modified: 10 Sept 2014

    Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562.

    Source:Bogdan Calin
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4906

    Last Modified: 10 Sept 2014

    SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information.

    Source:Bogdan Calin
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4905

    Last Modified: 5 Sept 2010

    SQL injection vulnerability in article_details.php in Softbiz Article Directory Script allows remote attackers to execute arbitrary SQL commands via the sbiz_id parameter.

    Source:h4ck3r
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4904

    Last Modified: 15 Dec 2016

    SQL injection vulnerability in the Aardvertiser (com_aardvertiser) component 2.1 and 2.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_name parameter in a view action to index.php. NOTE: some of these details are obtained from third party information.

    Source:Stephan Sattler
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4902

    Last Modified: 15 Dec 2016

    Multiple SQL injection vulnerabilities in the Clantools (com_clantools) component 1.2.3 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) squad or (2) showgame parameter to index.php.

    Source:Solidmedia
    Published:8 Oct 2011
    4.3
    Medium

    CVE-2010-4901

    Last Modified: 10 Sept 2014

    Multiple cross-site scripting (XSS) vulnerabilities in char_map.php in MySource Matrix 3.28.3 allow remote attackers to inject arbitrary web script or HTML via the (1) height or (2) width parameter.

    Source:Gjoko Krstic
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4899

    Last Modified: 8 Sept 2014

    SQL injection vulnerability in c.php in CMS WebManager-Pro before 8.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:MustLive
    Published:8 Oct 2011
    7.5
    High

    CVE-2010-4898

    Last Modified: 19 Dec 2016

    SQL injection vulnerability in the Gantry (com_gantry) component 3.0.10 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter to index.php.

    Source:jdc
    Published:8 Oct 2011
    Items Per Page