CVE-2007-2167

The CVE-2007-2167 issue affects AimStats 3.2 and is caused by a vulnerability in process.php where the number parameter in an update action allows remote attackers to inject PHP code into config.php. This is a static code injection scenario that could enable arbitrary code execution in the PHP en...

CVE-2007-2166: Undefined Security Weakness

PHP remote file inclusion vulnerability in administration/user/lib/group.inc.php in OpenSurveyPilot osp 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfgPathToProjectAdmin parameter...

CVE-2007-2167: Undefined Security Weakness

Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action...

Code injection

The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/CAltInstaller.php in the JoomlaPack comjpack 1.0.4a2 RE component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

Code injection

Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shouts.php via the shout parameter...

CVE-2007-2145

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the GJGALLincpath parameter...

CVE-2007-2140

PHP remote file inclusion vulnerability in everything.php in Franklin Huang Flip aka Flip-search-add-on 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the incpath parameter...

CVE-2007-2148

Direct static code injection vulnerability in admin/save.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed...

CVE-2007-2143

PHP remote file inclusion vulnerability in index.php in the Be2004-2 template for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2007-2144

PHP remote file inclusion vulnerability in includes/CAltInstaller.php in the JoomlaPack comjpack 1.0.4a2 RE component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2007-2141

Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shouts.php via the shout parameter...

CVE-2007-2146

The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

EUVD-2007-2151

Multiple PHP remote file inclusion vulnerabilities in Rezervi Generic 0.9 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to 1 datumVonDatumBis.inc.php, 2 footer.inc.php, 3 header.inc.php, and 4 stylesheets.php in templates/; and 5 wochenuebersicht.inc.php, 6...

CVE-2007-2148

Direct static code injection vulnerability in admin/save.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed...

CVE-2007-2141

CVE-2007-2141 affects ShoutPro 1.5.2 and is a Direct static code injection vulnerability in shoutbox.php. An attacker can inject arbitrary PHP code into shouts.php via the shout parameter, enabling remote code execution. The underlying root cause is unsanitized input handling in shoutbox.php, lea...

CVE-2007-2148

CVE-2007-2148 affects Stephen Craton (WiredPHP) Chatness 2.5.3 and earlier, with a vulnerability in admin/save.php. The issue allows remote authenticated administrators to inject PHP code into .html files via the html parameter; the injected code is then executed when index.php is requested (demo...

CVE-2007-2140: Undefined Security Weakness

PHP remote file inclusion vulnerability in everything.php in Franklin Huang Flip aka Flip-search-add-on 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the incpath parameter...

CVE-2007-2156: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Rezervi Generic 0.9 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to 1 datumVonDatumBis.inc.php, 2 footer.inc.php, 3 header.inc.php, and 4 stylesheets.php in templates/; and 5 wochenuebersicht.inc.php, 6...