Overview 16,449 matches · 98 in Waratek scope · 16 protected · 0 exploited · 0 CISA KEV · 655 EPSS ≥ 0.5
Protected by Waratek
16
0.1%
Rule in development
0
0.0%
Mitigation candidate
82
0.5%
No exploit published
0
0.0%
Outside Waratek scope
61
0.4%
Not applicable
16,261
98.9%
Withdrawn CVE
29
0.2%
blocked by ARMR today
16
0.1%
partly blocked
0
0.0%
not blocked
16,433
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
16,449
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2,591 / year
19881
Not applicable1
High1
not blocked1
Working exploit published1
19890
19901
Not applicable1
Medium1
not blocked1
Working exploit published1
19912
Not applicable2
High2
not blocked2
Working exploit published2
19920
19930
19946
Not applicable6
High3
Medium2
Low1
not blocked6
Working exploit published6
19955
Not applicable5
Critical1
High2
Medium2
not blocked5
Working exploit published5
199618
Not applicable17
Withdrawn CVE1
High12
Medium5
Unknown1
not blocked18
Working exploit published18
199773
Not applicable73
High51
Medium18
Low4
not blocked73
Working exploit published73
199850
Not applicable50
Critical1
High33
Medium11
Low5
not blocked50
Working exploit published50
1999282
Outside Waratek scope1
Not applicable280
Withdrawn CVE1
Critical2
High132
Medium119
Low28
Unknown1
not blocked282
Working exploit published282
2000427
Mitigation candidate6
Outside Waratek scope1
Not applicable420
Critical1
High197
Medium195
Low34
not blocked427
Working exploit published427
2001480
Mitigation candidate2
Outside Waratek scope4
Not applicable474
Critical4
High219
Medium219
Low38
not blocked480
Working exploit published480
2002545
Mitigation candidate8
Outside Waratek scope4
Not applicable531
Withdrawn CVE2
Critical3
High276
Medium246
Low18
Unknown2
not blocked545
Working exploit published545
2003499
Protected by Waratek1
Mitigation candidate7
Outside Waratek scope2
Not applicable488
Withdrawn CVE1
Critical3
High236
Medium243
Low16
Unknown1
blocked by ARMR today1
not blocked498
Working exploit published499
2004755
Mitigation candidate1
Outside Waratek scope1
Not applicable753
Critical3
High302
Medium414
Low36
not blocked755
Working exploit published755
20051,341
Protected by Waratek1
Mitigation candidate4
Outside Waratek scope4
Not applicable1,327
Withdrawn CVE5
Critical4
High658
Medium622
Low52
Unknown5
blocked by ARMR today1
not blocked1,340
Working exploit published1,341
20062,440
Protected by Waratek1
Mitigation candidate4
Outside Waratek scope7
Not applicable2,425
Withdrawn CVE3
Critical4
High1,197
Medium1,137
Low99
Unknown3
blocked by ARMR today1
not blocked2,439
Working exploit published2,440
20072,495
Protected by Waratek1
Mitigation candidate10
Outside Waratek scope11
Not applicable2,470
Withdrawn CVE3
Critical6
High1,405
Medium1,052
Low29
Unknown3
blocked by ARMR today1
not blocked2,494
Working exploit published2,495
20082,518
Protected by Waratek3
Mitigation candidate9
Outside Waratek scope6
Not applicable2,495
Withdrawn CVE5
Critical4
High1,492
Medium987
Low30
Unknown5
blocked by ARMR today3
not blocked2,515
Working exploit published2,518
20092,591
Protected by Waratek4
Mitigation candidate12
Outside Waratek scope9
Not applicable2,560
Withdrawn CVE6
Critical5
High1,424
Medium1,123
Low33
Unknown6
blocked by ARMR today4
not blocked2,587
Working exploit published2,591
20101,313
Protected by Waratek3
Mitigation candidate11
Outside Waratek scope7
Not applicable1,290
Withdrawn CVE2
Critical6
High730
Medium547
Low28
Unknown2
blocked by ARMR today3
not blocked1,310
Working exploit published1,313
2011607
Protected by Waratek2
Mitigation candidate8
Outside Waratek scope4
Not applicable593
Critical1
High337
Medium257
Low12
blocked by ARMR today2
not blocked605
Working exploit published607
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-4542 | High | 2011-11-30 | Not applicable | Working exploit published | Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI. |
| CVE-2011-4317 | Medium | 2011-11-30 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. |
| CVE-2011-4191 | High | 2011-11-30 | Not applicable | Working exploit published | Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets. |
| CVE-2011-3639 | Medium | 2011-11-30 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. |
| CVE-2011-4572 | Medium | 2011-11-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file disclosure vulnerability, but this is likely inaccurate. |
| CVE-2011-4571 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showEO action to index.php. |
| CVE-2011-4570 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a timereturns action to index.php. |
| CVE-2011-4569 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter. |
| CVE-2011-4567 | Medium | 2011-11-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547. |
| CVE-2011-4541 | Medium | 2011-11-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in Hastymail2 2.1.1 before RC2 allows remote attackers to inject arbitrary web script or HTML via the rs parameter in a mailbox Drafts action. |
| CVE-2011-4564 | Medium | 2011-11-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the admin script in Active CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter in a module action. |
| CVE-2011-4561 | Medium | 2011-11-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2011-4559 | High | 2011-11-28 | Not applicable | Working exploit published | SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. |
| CVE-2011-4335 | Medium | 2011-11-28 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action. |
| CVE-2010-5062 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary SQL commands via the c parameter. |
| CVE-2010-5060 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5059 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action. |
| CVE-2010-5058 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the res_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-5057 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the tipodoc_id parameter. |
| CVE-2010-5056 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the face_id parameter in a show_face action to index.php. |
| CVE-2010-5055 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5053 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a prod_desc action to index.php. |
| CVE-2010-5052 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/components.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the val[] parameter. |
| CVE-2010-5051 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php. |
| CVE-2010-5048 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.1.0.0 for Joomla! allows remote authenticated users to inject arbitrary web script or HTML via the name parameter to index.php. |
| CVE-2010-5047 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5046 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin.php in ecoCMS allows remote attackers to inject arbitrary web script or HTML via the p parameter. |
| CVE-2011-4496 | High | 2011-11-21 | Not applicable | Working exploit published | Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file. |
| CVE-2011-4040 | High | 2011-11-21 | Not applicable | Working exploit published | Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet. |
| CVE-2011-4404 | Medium | 2011-11-19 | Not applicable | Working exploit published | The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523. |
| CVE-2011-4122 | Medium | 2011-11-17 | Not applicable | Working exploit published | Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function, as demonstrated by a .. in the -c option to kcheckpass. |
| CVE-2011-4107 | Medium | 2011-11-17 | Not applicable | Working exploit published | The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack. |
| CVE-2011-1516 | High | 2011-11-15 | Not applicable | Working exploit published | The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303. |
| CVE-2011-4431 | Medium | 2011-11-10 | Not applicable | Working exploit published | Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter. |
| CVE-2011-4415 | Low | 2011-11-08 | Not applicable | Working exploit published | The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607. |
| CVE-2011-3607 | Medium | 2011-11-08 | Not applicable | Working exploit published | Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow. |
| CVE-2011-2013 | Critical | 2011-11-08 | Not applicable | Working exploit published | Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port, aka "Reference Counter Overflow Vulnerability." |
| CVE-2011-4066 | High | 2011-11-04 | Not applicable | Working exploit published | SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO. |
| CVE-2011-3171 | Low | 2011-11-04 | Not applicable | Working exploit published | Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled, allows local users to overwrite arbitrary files via unknown vectors. |
| CVE-2011-1513 | High | 2011-11-04 | Not applicable | Working exploit published | Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name. |
| CVE-2011-4273 | Medium | 2011-11-03 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via (1) the group parameter to goform/AddGroup, related to addgroup.asp; (2) the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the (3) user (aka User ID) or (4) group parameter to goform/AddUser, related to adduser.asp. |
| CVE-2011-4074 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command. |
| CVE-2011-3167 | High | 2011-11-02 | Not applicable | Working exploit published | Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210. |
| CVE-2010-5045 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in poll/default.asp in Smart ASP Survey allows remote attackers to inject arbitrary web script or HTML via the catid parameter. |
| CVE-2010-5044 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Public Back-end privileges, to execute arbitrary SQL commands via the search parameter in a log action to administrator/index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5043 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the cid[] parameter in an editItem action to administrator/index.php. |
| CVE-2010-5042 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the cid[] parameter in an editItem action to administrator/index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5041 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in the NP_Gallery plugin 0.94 for Nucleus allows remote attackers to execute arbitrary SQL commands via the id parameter in a plugin action. |
| CVE-2010-5040 | Medium | 2011-11-02 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for Nucleus allows remote attackers to execute arbitrary PHP code via a URL in the DIR_NUCLEUS parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5039 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in control/admin_login.php in ScriptsFeed Recipes Listing Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter (aka the UserName field). NOTE: some of these details are obtained from third party information. |
| CVE-2010-5037 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in article.php in SenseSites CommonSense CMS allows remote attackers to execute arbitrary SQL commands via the article_id parameter. |
| CVE-2010-5036 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. |
| CVE-2010-5035 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field). NOTE: some of these details are obtained from third party information. |
| CVE-2010-5034 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter. |
| CVE-2010-5033 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL commands via the CatDisplay parameter. |
| CVE-2010-5032 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the BF Quiz (com_bfquiztrial) component before 1.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a bfquiztrial action to index.php. |
| CVE-2010-5029 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the show parameter in a web action. |
| CVE-2010-5028 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php. |
| CVE-2010-5027 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5026 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5025 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in manage/main.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote attackers to inject arbitrary web script or HTML via the fld_path parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5024 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in manage/add_user.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote authenticated users, with Read privileges, to execute arbitrary SQL commands via the user_id parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5023 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intDivisionID parameter. |
| CVE-2010-5022 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the JExtensions JE Story Submit (com_jesubmit) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php. |
| CVE-2010-5021 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_group.asp in Digital Interchange Document Library 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intGroupID parameter. |
| CVE-2010-5020 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands via the page parameter. |
| CVE-2010-5019 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arbitrary SQL commands via the alb parameter. |
| CVE-2010-5018 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in products/classified/headersearch.php in 2daybiz Online Classified Script allows remote attackers to inject arbitrary web script or HTML via the sid parameter. |
| CVE-2010-5017 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in stats.php in Elite Gaming Ladders 3.0 allows remote attackers to execute arbitrary SQL commands via the account parameter. |
| CVE-2010-5016 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the match parameter. |
| CVE-2010-5015 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_photo.php in 2daybiz Network Community Script allows remote attackers to execute arbitrary SQL commands via the alb parameter. |
| CVE-2010-5014 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQL commands via the ladder[id] parameter. |
| CVE-2010-5013 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL commands via the Lid parameter. |
| CVE-2010-5012 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5011 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter. |
| CVE-2010-5010 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to inject arbitrary web script or HTML via the session parameter. |
| CVE-2010-5009 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action. |
| CVE-2010-5008 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in pages/contact_list_mail_form.asp in BrightSuite Groupware 5.4 allows remote attackers to execute arbitrary SQL commands via the ContactID parameter. |
| CVE-2010-5007 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers to inject arbitrary web script or HTML via the mid parameter. |
| CVE-2010-5004 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to execute arbitrary SQL commands via the category parameter. |
| CVE-2010-5000 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the myusername parameter (aka Username field) in a do_login action. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4998 | High | 2011-11-02 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the pathForArdeaCore parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4997 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in OlyKit Swoopo Clone 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter in a product action. |
| CVE-2010-4971 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in VideoWhisper PHP 2 Way Video Chat component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the r parameter to index.php. |
| CVE-2011-4222 | High | 2011-11-01 | Not applicable | Working exploit published | Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document. |
| CVE-2011-4221 | High | 2011-11-01 | Not applicable | Working exploit published | Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document. |
| CVE-2011-4220 | High | 2011-11-01 | Not applicable | Working exploit published | Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2010-5003 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the limit parameter in an autartimonial action to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5002 | Medium | 2011-11-01 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS 0.97.0 allows remote attackers to inject arbitrary web script or HTML via the u parameter. |
| CVE-2010-5001 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in view.php in esoftpro Online Contact Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4999 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in esoftpro Online Photo Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the section parameter. |
| CVE-2010-4996 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in ogp_show.php in esoftpro Online Guestbook Pro 5.1 allows remote attackers to execute arbitrary SQL commands via the search parameter. |
| CVE-2010-4995 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the NeoRecruit (com_neorecruit) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in an offer_view action to index.php, a different vector than CVE-2007-4506. |
| CVE-2010-4993 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php. |
| CVE-2010-4992 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the type parameter to add.html. |
| CVE-2010-4991 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the NinjaMonials (com_ninjamonials) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a display action to index.php. |
| CVE-2010-4990 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the Front-edit Address Book (com_addressbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a contact action to index.php. |
| CVE-2010-4989 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in main.asp in Ziggurat Farsi CMS allows remote attackers to execute arbitrary SQL commands via the grp parameter. |
| CVE-2010-4988 | High | 2011-11-01 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in mod_chatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPL[path] parameter. |
| CVE-2010-4987 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in default.asp in KMSoft Guestbook (aka GBook) allows remote attackers to execute arbitrary SQL commands via the p parameter. |