PT-2014-2477

Name of the Vulnerable Software and Affected Versions DataLife Engine DLE version 9.7 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the catlist parameter to "engine/preview.php". The vulnerability is exploited through a preg replace function cal...

CVE-2013-1412: Improper Control of Generation of Code

DataLife Engine DLE 9.7 allows remote attackers to execute arbitrary PHP code via the catlist parameter to engine/preview.php, which is used in a pregreplace function call with an e modifier...

PT-2014-3411

Name of the Vulnerable Software and Affected Versions DataLife Engine DLE versions 9.7 and earlier Description A session fixation issue allows remote attackers to hijack web sessions via the PHPSESSID cookie. Recommendations For DataLife Engine DLE versions 9.7 and earlier, at the moment, there i...

CVE-2010-2005: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in DataLife Engine DLE 8.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the selectedlanguage parameter to engine/inc/include/init.php, 2 the configlangs parameter to engine/inc/help.php, 3 the configlang parameter to...

CVE-2009-3055: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine DLE 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dleconfigapi parameter...

CVE-2008-6406: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in DataLife Engine DLE 7.2 allows remote attackers to inject arbitrary web script or HTML via the query string...