Joomla! / Mambo Component Mod_Forum - 'PHPBB_Root.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/24591/info The 'modforum' component for Joomla and Mambo is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote files containin...

CVE-2007-3359: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in SerWeb 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the SERWEBserwebdir parameter to 1 html/loadapu.php or 2 html/mailprepend.php. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-3353: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myeventpath parameter. NOTE: a reliable third party disputes this issue, saying "the entire file is a class...

CVE-2007-3325

PHP remote file inclusion vulnerability in lib/language.php in LAN Management System LMS 1.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter, a different vector than CVE-2007-1643 and CVE-2007-2205...

Code injection

Unspecified vulnerability in Simple Machines Forum SMF 1.1.2 allows remote attackers to execute arbitrary PHP code during 1 creation or 2 editing of a message...

CVE-2007-3309

Unspecified vulnerability in Simple Machines Forum SMF 1.1.2 allows remote attackers to execute arbitrary PHP code during 1 creation or 2 editing of a message...

CVE-2007-3309

Unspecified vulnerability in Simple Machines Forum SMF 1.1.2 allows remote attackers to execute arbitrary PHP code during 1 creation or 2 editing of a message...

CVE-2007-3309

The CVE-2007-3309 entry concerns Simple Machines Forum (SMF) 1.1.2, where a vulnerability enables remote attackers to execute arbitrary PHP code during (1) message creation or (2) message editing. The available sources identify the affected software/version and the code-execution risk but do not ...

CVE-2007-3315: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in YourFreeScreamer 1.0, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the serverPath parameter to bodyTemplate.php in 1 templates/Classic/, 2 templates/Classic Guestbook/, 3...

CVE-2007-3325: Undefined Security Weakness

PHP remote file inclusion vulnerability in lib/language.php in LAN Management System LMS 1.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter, a different vector than CVE-2007-1643 and CVE-2007-2205...

CVE-2007-3306: Undefined Security Weakness

PHP remote file inclusion vulnerability in crontab/runbilling.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL in the configincludedir parameter, a different vector than CVE-2006-4489...

CVE-2007-3292

Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article...

Unrestricted file upload

Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article...

CVE-2007-3289: Undefined Security Weakness

PHP remote file inclusion vulnerability in spaw/spawcontrol.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

CVE-2007-3297: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSiniarrayEXTLIBPATH parameter to 1 msDb.php, 2 modules/MusooTemplateLite.php, or 3 modules/SoundImporter.php...

Remote file inclusion

PHP remote file inclusion vulnerability in templates/2blue/bodyTemplate.php in YourFreeScreamer 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the serverPath parameter...

PHProjekt: Multiple vulnerabilities

Background PHProjekt is a project management and coordination tool written in PHP. Description Alexios Fakos from n.runs AG has discovered multiple vulnerabilities in PHProjekt, including the execution of arbitrary SQL commands using unknown vectors CVE-2007-1575, the execution of arbitrary PHP...

CVE-2007-3270: Undefined Security Weakness

PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to execute arbitrary PHP code via a URL in the strIncludePrefix parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...

CVE-2007-3240

Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...