Information disclosure

include/auth/auth.php in Simple Invoices before 2007 03 05 does not use the login system to protect print preview pages for invoices, which might allow attackers to obtain sensitive information...

CVE-2007-1341

include/auth/auth.php in Simple Invoices before 2007 03 05 does not use the login system to protect print preview pages for invoices, which might allow attackers to obtain sensitive information...

CVE-2007-1341

include/auth/auth.php in Simple Invoices before 2007 03 05 does not use the login system to protect print preview pages for invoices, which might allow attackers to obtain sensitive information...

CVE-2007-1341

The CVE-2007-1341 entry concerns Simple Invoices prior to 2007-03-05, where include/auth/auth.php does not enforce login protection on invoice print preview pages, potentially allowing an attacker to access sensitive information. Affected component: the auth print-preview workflow in Simple Invoi...

PT-2007-2302 · Local · Local Calendar System

Name of the Vulnerable Software and Affected Versions: local Calendar System version 1.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the TEMPLATE DIR parameter to files such as showinvoices.php, showmonth.php, showevents.php, retrieveinvoice.php,...

Remote file inclusion

PHP remote file inclusion vulnerability in controller.php in Simple Invoices before 20070202 allows remote attackers to execute arbitrary PHP code via a URL in the 1 module or 2 view parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-0787

PHP remote file inclusion vulnerability in controller.php in Simple Invoices before 20070202 allows remote attackers to execute arbitrary PHP code via a URL in the 1 module or 2 view parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-0787

CVE-2007-0787 describes a PHP remote file inclusion vulnerability in controller.php of the Simple Invoices application, before version 20070202. The flaw allows an attacker to execute arbitrary PHP code by supplying a URL in the module or view parameter. The underlying issue is improper handling ...

CVE-2005-1932

Lpanel 1.59 and earlier, and other versions before 1.597, allows remote authenticated users to modify certain critical variables and 1 modify DNS settings for arbitrary domains via the domain parameter to diagnose.php, 2 close, open, or respond to arbitrary support tickets via the close, open, or...