CVE-2006-4423: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Bigace 1.8.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSBIGACEDIRadmin parameter in a system/command/admin.cmd.php, b admin/include/uploadform.php, and c admin/include/itemmain.php; and the 2...

CVE-2006-4445: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter to 1 shownews.php or 2 search.php. NOTE: CVE analysis as of 20060829 has not identified any scenarios in which these vectors could result i...

CVE-2006-4425

CVE-2006-4425 affects the phpCOIN 1.2.3 package. Multiple remote file inclusion weaknesses allow an unauthenticated, remote attacker to cause code execution by manipulating the _CCFG[_PKG_PATH_INCL] parameter in seven coin_includes scripts (api.php, common.php, core.php, custom.php, db.php, redir...

CVE-2006-4433

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier PHPSESSID for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session...

CVE-2006-4424: Undefined Security Weakness

PHP remote file inclusion vulnerability in coinincludes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the CCFGPKGPATHINCL parameter...

PHProjekt <= 5.1 Multiple Remote File Inclusions

The remote host is running PHProjekt, an open source groupware suite written in PHP. The version of PHProjekt installed on the remote host fails to sanitize user-supplied input to the 'pathpre' parameter of the 'lib/specialdays.php' script as well as the 'libpath' parameter of the...

CVE-2006-4418

Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng parameter, as demonstrated by inserting PHP code into a log file...

EUVD-2006-4406

Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng parameter, as demonstrated by inserting PHP code into a log file...

CVE-2006-4418

Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng parameter, as demonstrated by inserting PHP code into a log file...

CVE-2006-4363

PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component comcropimage 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter...

CVE-2006-4372

PHP remote file inclusion vulnerability in admin.lurmconstructor.php in the Lurm Constructor component comlurmconstructor 0.6b and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the lmabsolutepath parameter...

CVE-2006-4372

PHP remote file inclusion vulnerability in admin.lurmconstructor.php in the Lurm Constructor component comlurmconstructor 0.6b and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the lmabsolutepath parameter...

CVE-2006-4373

PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the lvcincludedir parameter...

BigACE 1.8.2 - 'item_main.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/19723/info Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver...

BigACE 1.8.2 - 'upload_form.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/19723/info Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver...

Alstrasoft Video Share Enterprise 4.x - 'MyajaxPHP.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/19724/info AlstraSoft Video Share Enterprise is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code an...

Jupiter CMS 1.1.5 - index.php Remote File Inclusion

Jupiter CMS 1.1.5 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/19721/info Jupiter CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote files...

Jetbox CMS 2.1 - Search_function.php Remote File Inclusion

Jetbox CMS 2.1 - Searchfunction.php Remote File Inclusion source: https://www.securityfocus.com/bid/19722/info Jetbox CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote fi...

BigACE 1.8.2 - admin.cmd.php Remote File Inclusion

BigACE 1.8.2 - admin.cmd.php Remote File Inclusion source: https://www.securityfocus.com/bid/19723/info Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote PHP...

BigACE 1.8.2 - download.cmd.php Remote File Inclusion

BigACE 1.8.2 - download.cmd.php Remote File Inclusion source: https://www.securityfocus.com/bid/19723/info Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote PH...