CVE-2007-2774: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to 1 connect.php or 2 modules/startup.php...

tomcat directory traversal

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules modproxy, modrewrite, modjk, allows remote attackers to read arbitrary files via a .. dot dot sequence with combinations of 1 "/" slash, 2 "" backslash, and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to inject arbitrary web script or HTML via 1 the formmail parameter to contact/contact/index.php; the 2 formmods or 3 formsearchterm parameter to search/list/actionsearch/index.php; 4 the id parameter to...

CVE-2007-2572: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in modules/noevents/templates/mfatheme.php in NoAh aka PHP Content Architect, phparch 0.9 pre 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tpls1 parameter...

CVE-2007-2545: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the systempath parameter to 1 blocks/headerfile.php, 2 files/blocks/latestfiles.php, 3 filters/headerfile.php, 4 forums/blocks/latestposts.php, 5...

miniwebshop2-xss.txt

-=--------------------ADVISORY-------------------=- Mini Web Shop V.2 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Mini Web Shop -=+ Version: 2 -=+ Vendor's URL: http://obiewebsite.sourceforge.net/o.php?MiniWebShop -=+ Platform:...

PMECMS 1.0 - config[pathMod] Remote File Inclusion

PMECMS = 1.0 Multiple Remote File Inclusion Vulnerabilities D.Script: http://www.pmecms.com/export/maj/PMECMSStandardos1.0.zip Discovered by: GolDM = Mahmoodali Homepage: http://www.Tryag.cc Exploit:Path/mod/image/index.php?configpathMod=Shell Exploit:Path/mod/liens/index.php?configpathMod=Shell...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow remote attackers to execute arbitrary PHP code via a URL in the docroot parameter to 1 localize.php or 2 config.php in modules/admin/include/...

CVE-2007-2422

Multiple PHP remote file inclusion vulnerabilities in Modules Builder modbuild 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter to 1 config-bak.php or 2 config.php. NOTE: CVE disputes this vulnerability because the unmodified...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Modules Builder modbuild 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter to 1 config-bak.php or 2 config.php. NOTE: CVE disputes this vulnerability because the unmodified...

PT-2007-3754 · Comdev · Comdev One Admin Modules Builder

Name of the Vulnerable Software and Affected Versions: Comdev One Admin Modules Builder modbuild version 4.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter to 1 "config-bak.php" or 2 "config.php" endpoints. However, it's noted...

CVE-2007-2422

Multiple PHP remote file inclusion vulnerabilities in Modules Builder modbuild 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter to 1 config-bak.php or 2 config.php. NOTE: CVE disputes this vulnerability because the unmodified...

CVE-2007-2460: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/admin/include/config.php in FireFly 1.1.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2007-2456: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow remote attackers to execute arbitrary PHP code via a URL in the docroot parameter to 1 localize.php or 2 config.php in modules/admin/include/...

CVE-2007-2422: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Modules Builder modbuild 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter to 1 config-bak.php or 2 config.php. NOTE: CVE disputes this vulnerability because the unmodified...

CVE-2007-2422

The Modules Builder (modbuild) software, version 4.1 for Comdev One Admin , contains multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code by providing a URL in the path[docroot] parameter targeting either the config-bak.php or config.php endpoints. While ...

CVE-2007-2412: Undefined Security Weakness

Directory traversal vulnerability in modules/file.php in Seir Anphin allows remote attackers to obtain sensitive information via a .. dot dot in the afilepath parameter. NOTE: a third party has disputed this issue because the a array is populated by a database query before use...

phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit

No description provided by source. !-- phpMySpace Gold v8.10 - Blind SQL/XPath Injection Exploit Vulnerable Variable: itemid Vulnerable File: modules/news/article.php Vulnerable: phpMySpace Gold v8.10 other versions should also be vulnerable Google d0rk: "Powered by phpMySpace Gold 8.10" John...

Firefly 1.1.01 - 'doc_root' Remote File Inclusion

firefly 1.1.01 = Remote File Include Vulnerablitiy D.Script: http://fresh.t-systems-sfr.com/unix/src/privat2/firefly-1.1.01.tar.gz Discovered by: Alkomandoz Hacker Homepage: asb-may.net & mohandko.com & sniper-sa.com & Tryag.com ====================================...

CVE-2007-2247: Undefined Security Weakness

SQL injection vulnerability in modules/news/article.php in phpMySpace Gold 8.10 allows remote attackers to execute arbitrary SQL commands via the itemid parameter...