CVE-2005-1881

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code...

PT-2005-2825 · I-Man · I-Man

Name of the Vulnerable Software and Affected Versions: I-Man versions 0.9 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension. This can be done by exploiting the file upload functionality, potentially leadin...

CVE-2005-1869: Undefined Security Weakness

PHP remote file inclusion vulnerability in startlobby.php in MWChat 6.x allows remote attackers to execute arbitrary PHP code via the CONFIGMWCHATLibs parameter...

CVE-2005-1821

PHP remote file inclusion vulnerability in pdlheader.inc.php in PowerDownload 3.0.2 and 3.0.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter to downloads.php...

CVE-2005-1821: Undefined Security Weakness

PHP remote file inclusion vulnerability in pdlheader.inc.php in PowerDownload 3.0.2 and 3.0.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter to downloads.php...

CVE-2005-1604: Undefined Security Weakness

PHP Advanced Transfer Manager phpATM 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as demonstrated using a filename ending in "php.ns", which allows execution of arbitrary PHP code...

CVE-2004-1988: Undefined Security Weakness

PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPGMDIR to reference a URL on a remote web server that contains functions.inc.php...

CVE-2003-1148: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences phpMyConference 8.0.2 and possibly other products, allow remote attackers to execute arbitrary PHP code via a URL in the lvcincludedir parameter to 1 config.inc.php or 2...

CVE-2004-1934: Undefined Security Weakness

PHP remote file inclusion vulnerability in affich.php in Gemitel 3.50 allows remote attackers to execute arbitrary PHP code via the base parameter...

CVE-2004-2041: Undefined Security Weakness

PHP remote file inclusion vulnerability in secureimgrender.php in e107 0.615 allows remote attackers to execute arbitrary PHP code by modifying the p parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1989: Undefined Security Weakness

PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEMEDIR parameter to reference a URL on a remote web server that contains userlistinfobox.inc...

osTicket <= 1.2.7 Multiple Vulnerabilities

The version of osTicket installed on the remote host suffers from several vulnerabilities : - A Remote File Include Vulnerability The script 'include/main.php' lets an attacker read arbitrary files on the remote host and possibly even run arbitrary PHP code, subject to the privileges of the web...

CVE-2005-1438

The connected documents confirm a Remote File Include vulnerability in osTicket variants, specifically CVE-2005-1438, via the include_dir parameter in main.php. The issue affects osTicket versions up to 1.2.7 (per Tenable NASL “osTicket &lt;= 1.2.7 Multiple Vulnerabilities”) and is included among...

CVE-2005-1438: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1447: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.php in SitePanel 2.6.1 and earlier SitePanel2 allows remote attackers to execute arbitrary PHP code via the p parameter...

CVE-2005-1377: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary PHP code via unknown vectors...

CVE-2005-1360: Undefined Security Weakness

PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the pathprefix parameter to reference a URL on a remote web server that contains the code...

CVE-2005-1312

PHP remote file inclusion vulnerability in Yappa-NG before 2.3.2 allows remote attackers to execute arbitrary PHP code via unknown vectors...

CVE-2001-1471

CVE-2001-1471 affects phpBB versions 1.4.0 and earlier. The root cause is an invalid language value in prefs.php (and related auth.php handling) that can let a remote authenticated user modify variables (e.g., $l_statsblock, $l_privnotify) and later use them in an eval, enabling arbitrary PHP cod...

CVE-2005-1117: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in All4WWW-Homepagecreator 1.0a allows remote attackers to execute arbitrary PHP code by modifying the site parameter to reference a URL on a remote web server that contains the code...