CVE-2008-5989: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in defs.php in PHPcounter 1.3.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the l parameter...

CVE-2008-2494: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to inject arbitrary web script or HTML via the l parameter...

CVE-2008-2280: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-2073: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in include/global.inc.php in Virtual Design Studio vlbook 1.21 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the l parameter...

CVE-2008-2072: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to inject arbitrary web script or HTML via the l parameter, a different vector than CVE-2006-3260...

CVE-2008-0289: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in viewfunc.php in Member Area System MAS 1.7 and possibly others allows remote attackers to execute arbitrary PHP code via a URL in the i parameter. NOTE: a second vector might exist via the l parameter. NOTE: as of 20080118, the vendor has disputed the se...

sing pinging utility privilege escalation

-L parameter allow to ovewrite files...

CVE-2007-2547: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter...

CVE-2006-7001: Undefined Security Weakness

Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the L parameter, a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-6769

CVE-2006-6769 applies to PHP Live! 3.2.2 and earlier, with multiple XSS flaws. Vulnerable components/files include transcripts.php (search_string parameter), index.php (l parameter), phplive/index.php (login field), and phplive/message_box.php (deptid and x parameters). Exploits describe arbitrar...

CVE-2006-5897: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in PhpMyChat Plus 1.9 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the ChatPath parameter to 1 avatar.php, 2 colorhelppopup.php, 3 colorpopup.php, 4 index.php, 5 index1.php, 6 lib/connectedusers.lib.php, 7...

CVE-2006-4746: Undefined Security Weakness

PHP remote file inclusion vulnerability in news/include/customize.php in Web Server Creator 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter...

CVE-2006-4504: Undefined Security Weakness

SQL injection vulnerability in NX5Linx 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 c and 2 l parameters...

CVE-2006-2744: Undefined Security Weakness

PHP remote file inclusion vulnerability in p-popupgallery.php in F@cile Interactive Web 0.8.41 through 0.8.5 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter...

CVE-2005-2952: Undefined Security Weakness

Directory traversal vulnerability in s.pl in Subscribe Me Pro 2.044.09P and earlier allows remote attackers to read arbitrary files via a .. dot dot in the l parameter...

CVE-2005-2951: Undefined Security Weakness

Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" trailing null byte characters in the l parameter, which is used in an includeonce statement...

CVE-2002-2084: Undefined Security Weakness

Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. dot dot in the 1 l and 2 topic parameters...

CVE-2002-1887: Undefined Security Weakness

PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter...

CVE-2004-1992: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Serv-U FTP server before 5.0.0.6 allows remote attackers to cause a denial of service crash via a long -l parameter, which triggers an out-of-bounds read...

CVE-2004-1911: Undefined Security Weakness

Cross-site scripting XSS vulnerability in AzDGDatingLite 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the 1 l parameter aka language variable to index.php or 2 id parameter to view.php...