CVE-2007-3160

PHP remote file inclusion vulnerability in admin/header.php in PHP Real Estate Classifieds Premium Plus allows remote attackers to execute arbitrary PHP code via a URL in the loc parameter...

CVE-2007-3141

PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the editorinserttop parameter. NOTE: the editorinsertbottom vector is already covered by CVE-2006-6042...

CVE-2007-3141: Undefined Security Weakness

PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the editorinserttop parameter. NOTE: the editorinsertbottom vector is already covered by CVE-2006-6042...

CVE-2007-3130: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the OpenWiki formerly JD-Wiki component comjd-wiki 1.0.2, and possibly earlier, for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 dwpage.php or 2 wantedpages.php, different...

CVE-2007-3136: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/nukeinclude.php in newsSync 1.5.0rc6 allows remote attackers to execute arbitrary PHP code via a URL in the newsSyncNUKEPATH parameter...

CVE-2007-3118: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Kravchuk letter K-letter 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the scdir parameter to 1 action.php, 2 subs.php, or 3 unsubs.php...

CVE-2007-3084

PHP remote file inclusion vulnerability in sampleblogger.php in Comdev Web Blogger 4.1 allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter, a different vector than CVE-2006-5441...

CVE-2007-3058: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSbasedir parameter to 1 calendar.php, 2 compose.php, and 3 index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this informati...

CVE-2007-3066: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in phpReactor 1.2.7 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to 1 view.inc.php, 2 users.inc.php, 3 updatecms.inc.php, and 4 polls.inc.php in inc/; and other unspecified files,...

CVE-2007-3085: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PBSite allow remote attackers to execute arbitrary PHP code via a URL in the 1 dbpath parameter to a useronline.php, b ucp.php, c setcookie.php, d sendpm.php, e search.php, f register.php, g profile.php, h post.php, i pmpshow.php, j pm.php, k...

Joomla! Component JD-Wiki 1.0.2 - wantedpages.php?MosConfig_absolute_path Remote File Inclusion

Joomla! Component JD-Wiki 1.0.2 - wantedpages.php?MosConfigabsolutepath Remote File Inclusion source: https://www.securityfocus.com/bid/24342/info JD-Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit...

Joomla! Component JD-Wiki 1.0.2 - 'dwpage.php?MosConfig_absolute_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/24342/info JD-Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in t...

Joomla! Component JD-Wiki 1.0.2 - 'wantedpages.php?MosConfig_absolute_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/24342/info JD-Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in t...

RevokeBB <= 1.0 RC4 Blind SQL Injection / Hash Retrieve Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo " ------------------------------------------------------------- RevokeBB = 1.0 RC4 Blind SQL Injection / Hash Retrieve Exploit Site: http://www.revokesoft.net by BlackHawk [email protected]...

Design/Logic Flaw

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...

Authentication flaw

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheaplogin cookie value to the administrator's username, which can be used to 1 obtain sensitive information, including the administrator password, via settings.php or 2 upload and execute arbitrary PHP code via an updatedoc...

CVE-2007-2986

PHP remote file inclusion vulnerability in lib/livestatus.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter...

CVE-2007-2988

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...

CVE-2007-2985

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheaplogin cookie value to the administrator's username, which can be used to 1 obtain sensitive information, including the administrator password, via settings.php or 2 upload and execute arbitrary PHP code via an updatedoc...

CVE-2007-2988

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...