CVE-2009-3055: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine DLE 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dleconfigapi parameter...

CVE-2008-7151: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Live 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to hijack the authentication of unspecified privileged users for requests that can be leveraged to execute arbitrary PHP code...

CVE-2008-7034: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in kernel/smarty/Smarty.class.php in PHPEcho CMS 2.0 rc3 allows remote attackers to execute arbitrary PHP code via a URL in unspecified vectors that modify the smartycompilepath variable in the fetch function...

CVE-2008-7042: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in url.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the tmpsid parameter...

CVE-2009-2769: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in include/timesheet.php in Ultrize TimeSheet 1.2.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the configincludedir parameter...

CVE-2009-2641: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in appandreadme/navigator/index.php in School Data Navigator allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. dot dot sequences...

CVE-2009-2633: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in toolbarext.php in the VehicleManager comvehiclemanager component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2008-6841: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query comdbquery component 1.4.1.1 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to...

CVE-2009-2218: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the home parameter to 1 ihead.php, 2 inav.php, 3 usernew2.php, or 4 house/myrents.php; or 5 allbooks.php, 6 home.php,...

CVE-2009-2182: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 adpopup.php, 2 camphtml.php, 3 initcontent.php, 4 logout.php, 5 menu.php, and 6 set-author.php in admin-files/; 7...

CVE-2009-2095: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in template/simpledefault/admin/masterlayout.php in Mundi Mail 0.8.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter. NOTE: when allowurlfopen is disabled, directory traversal attacks ar...

CVE-2008-6773: Improper Control of Generation of Code

Static code injection vulnerability in user/internettoolbar/edit.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary PHP code into user/internettoolbar/index.php via the 1 fav1url, 2 fav1name, 3 fav2url, 4 fav2name, 5 fav3url, 6 fav3name, 7 fav4url, 8 fav4nam...

CVE-2009-1450: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the pagecontent parameter...

CVE-2009-1452: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pagecss and 2 pagejavascript parameters. NOTE: the pagecontent vector is already is covered by CVE-2009-1450...

CVE-2009-1248: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the themedirectory parameter to 1 container.php and 2 header.php in themes/...

CVE-2008-6544: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum SMF 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the 1 settingsdefaultthemedir parameter to Sources/Subs-Graphics.php and 2 settingsdefaultthemedir parameter to Sources/Themes.php. NOTE: CVE and...

CVE-2008-6530: Undefined Security Weakness

Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

CVE-2009-1025: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2009-0966: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. dot dot sequences...

CVE-2008-6421: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in socialgameplay.php in Social Site Generator SSG 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...