PHProjekt authform.inc.php path_pre Parameter Remote File Inclusion

The remote host is running PHProjekt, an open source groupware suite written in PHP. The version of PHProjekt installed on the remote host fails to sanitize user-supplied input to the 'pathpre' parameter of the 'lib/authform.inc.php' script before using it in a PHP 'includeonce' function. Provide...

AngelineCMS loadkernel.php installPath Parameter Remote File Inclusion

The remote host is running AngelineCMS, an open source content management system written in PHP. The version of AngelineCMS installed on the remote host fails to sanitize user-supplied input to the 'installPath' parameter of the '/kernel/loadkernel.php' script before using it in a PHP 'includeonc...

gCards < 1.46 Multiple Vulnerabilities

The remote host is running gCards, a free electronic greeting card system written in PHP. The installed version of gCards fails to sanitize user input to the 'setLang' parameter in the 'inc/setLang.php' script which is called by 'index.php'. An unauthenticated attacker may be able to exploit this...

Claroline Multiple RemoteVulnerabilities (RFI, Traversal, XSS)

The remote host is running Claroline, an open source, web-based, collaborative learning environment written in PHP. The version of Claroline installed on the remote host fails to sanitize input to the 'includePath' parameter before using it in the 'claroline/learnPath/include/scormExport.inc.php'...

PHP Live Helper Multiple Remote File Inclusions

The remote host is running PHP Help Live, a commercial web-based real-time help tool written using PHP and MySQL. The version of PHP Help Live installed on the remote host fails to sanitize input to the 'abspath' parameter before using it in various scripts to include files with PHP code. An...

Mambo Open Source Multiple Vulnerabilities

The remote installation of Mambo Open Source fails to sanitize input to the 'mosusertemplate' cookie before using it to include PHP code from a local file. An unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute arbitrary PHP code on the affected host. ...

Free Articles Directory index.php page Parameter Remote File Inclusion

The remote host is running Free Articles Directory, a CMS written in PHP. The installed version of Free Articles Directory fails to sanitize user input to the 'page' parameter in index.php. An unauthenticated attacker may be able to read arbitrary local files or include a file from a remote host...

PostNuke PNphpBB2 includes/functions_admin.php phpbb_root_path Parameter Remote File Inclusion

The installation of PostNuke on the remote host includes a version of the PNphpBB2 module that fails to sanitize input to the 'phpbbrootpath' parameter of the 'includes/functionsadmin.php' script before using it in a PHP 'includeonce' function. Provided PHP's 'registerglobals' setting is enabled,...

RCBlog post Parameter Directory Traversal Vulnerability

The remote web server contains a PHP script that is prone to directory traversal attacks. Description : The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacke...

Plume CMS <= 1.0.2 Remote File Inclusion Vulnerability

The remote host is running a PHP application that is prone to local and remote file inclusion attacks. Description : The system is running Plume CMS a simple but powerful content management system. The version installed does not sanitize user input in the 'PXconfigmanagerpath' parameter in the...

phpWebThings forum Parameter SQL Injection Vulnerabilities

The remote web server contains a PHP script that is prone to SQL injection attacks. Description : The remote host is running the phpWebThings application framework. The version of phpWebThings installed on the remote host does not properly sanitize user input in the 'forum' and 'msg' parameters o...

SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability

The remote web server contains a PHP script that is prone to multiple flaws. Description : SugarCRM is a Customer Relationship Manager written in PHP. The version of SugarCRM installed on the remote host does not properly sanitize user input in the 'beanFiles' parameter in the 'acceptDecline.php'...

Edgewall Software Trac SQL injection flaw

The remote web server contains a CGI script that is affected by a SQL injection flaw. Description: The remote host is running Trac, an enhanced wiki and issue tracking system for software development projects written in python. The remote version of this software is prone to a SQL injection flaw...

Plume CMS <= 1.0.2 Remote File Inclusion Vulnerability

Plume CMS is prone to local and remote file inclusion vulnerabilities. SPDX-FileCopyrightText: 2006 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

phpWebThings forum Parameter SQL Injection Vulnerabilities

The version of phpWebThings installed on the remote host does not properly sanitize user input in the SPDX-FileCopyrightText: 2005 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CuteNews 1.4.1 Directory Traversal Vulnerability - Active Check

CuteNews is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only Ref: retrogod at aliceposta.it CPE ...

SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability

The version of SugarCRM installed on the remote host does not properly sanitize user input in the SPDX-FileCopyrightText: 2005 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

W-Agora 'site' Parameter Directory Traversal Vulnerability

W-Agora is prone to directory traversal attacks. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:w-agora:w-agora"; ifdescriptio...

Edgewall Software Trac SQL injection flaw

The remote version of Trac is prone to a SQL injection flaw through the ticket query module due to SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Help Center Live module.php local file include flaw

The remote web server contains a PHP script that is affected by a local file file include vulnerability. Description : The remote host is running Help Center Live, a help desk tool written in PHP. The remote version of Help Center Live fails to sanitize input to the SPDX-FileCopyrightText: 2005...