CVE-2006-6527

PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6511

dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain 1 feature, 2 editor, 3 newswire, 4 otherpress, 5 admin, 6 pbook, 7 media, or 8 mod, which are...

CVE-2006-6549: Undefined Security Weakness

PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the savepath parameter. NOTE: CVE disputes this vulnerability because savepath is originally defined as "" before use, and the nearby instructions say "SET T...

CVE-2006-6511

The CVE-2006-6511 entry concerns the product dadaIMC .99.3, where an insufficiently restrictive FilesMatch directive in the installed .htaccess allows remote attackers to execute arbitrary PHP code. Specifically, uploaded files whose names contain any of the words: feature, editor, newswire, othe...

GenesisTrader 1.0 - form.php Arbitrary File Source Disclosure

GenesisTrader 1.0 - form.php Arbitrary File Source Disclosure source: https://www.securityfocus.com/bid/21595/info GenesisTrader is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues include multiple...

CVE-2006-6546: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork CN:AJ 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter...

CVE-2006-6541: Undefined Security Weakness

PHP remote file inclusion vulnerability in signer/final.php in warez distributions of Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter. NOTE: the vendor disputes this issue, stating that only Warez versions of Animated Smiley...

GenesisTrader 1.0 - form.php Multiple Cross-Site Scripting Vulnerabilities

GenesisTrader 1.0 - form.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/21595/info GenesisTrader is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues include...

CVE-2006-6552: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/plugins/NPUserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIRADMIN parameter...

CVE-2006-6545: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB mxerrordocs allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

CVE-2006-6553: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/newssuiteconstants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2006-6526: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter...

CVE-2006-6462

PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter...

Invisionix Roaming System Remote Pageheaderdefault.Inc.PHP远程文件包含漏洞

Invisionix Roaming System是一款基于PHP的WEB应用程序。 Invisionix Roaming System不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'Pageheaderdefault.Inc.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Invisionix Systems Invisionix Roaming System Remote 0.2 http://www.invisionix.org/...

CVE-2006-6453

PHP remote file inclusion vulnerability in JOWAMPShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter...

CVE-2006-6426: Undefined Security Weakness

PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the templatefile parameter...

CVE-2006-6416: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PhpLeague - Univert PhpLeague 0.81 allow remote attackers to execute arbitrary PHP code via a URL in the cheminmini parameter to 1 consult/miniseul.php or 2 config.php. NOTE: The provenance of this information is unknown; the details are...

JCE Admin Component for Joomla! 'plugin' Parameter Local File Include

The version of the JCE Admin component for Joomla! running on the remote host is affected by a local file include vulnerability due to improper sanitization of user-supplied input to the 'plugin' parameter before using it in the components/comjce/jce.php script to include PHP code. Regardless of...

CVE-2006-6338

Unrestricted file upload vulnerability in upload/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/...

CVE-2006-6360: Undefined Security Weakness

PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the footerpage parameter...