Siemens Gigaset SE361 WLAN - Remote Reboot (Denial of Service)

Siemens Gigaset SE361 WLAN - Remote Reboot Denial of Service Attacking port 1723flood, it restarts the device almost instantly, here's the code in PHP. It takes a few bytes for the AP to automatically restart \n"; else $trash = strrepeat"\x90","261"; fwrite$con, $trash; while !feof$con echo "$tra...

CVE-2009-3065

PHP remote file inclusion vulnerability in editor/edithtmlarea.php in Ve-EDIT 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the highlighter parameter...

SA-CONTRIB-2009-054 - Go - url redirects - Multiple vulnerabilities

The Go - url redirects gotwo module adds the option to add redirected URLs. This module was found to have multiple vulnerabilities. Arbitrary PHP code execution Due to improper use of the PCRE regular expression engine, users with permission to use the input filter provided by the module are able...

CVE-2008-7067

The CVE-2008-7067 issue affects PageTree CMS 0.0.2 BETA 0001, where a PHP remote file inclusion is possible through the parameter GLOBALS[PT_Config][dir][data] in admin/plugins/Online_Users/main.php. This allows an attacker to execute arbitrary PHP code on the server. The vulnerability is evidenc...

GLSA-200908-09 : DokuWiki: Local file inclusion

The remote host is affected by the vulnerability described in GLSA-200908-09 DokuWiki: Local file inclusion girex reported that data from the 'configcascade' parameter in inc/init.php is not properly sanitized before being used. Impact : A remote attacker could exploit this vulnerability to execu...

Code injection

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

CVE-2009-2852

WP-Syntax plugin 0.9.1 and earlier for Wordpress, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via the testfilterwphead array parameter to test/index.php, which is used in a call to the calluserfuncarray function...

Gazelle CMS 1.0 - Multiple Vulnerabilities Remote Code Execution

Gazelle CMS 1.0 - Multiple Vulnerabilities Remote Code Execution !/bin/bash Gazelle CMS 1.0 Multiple Vulnerabilities Script Download: http://www.anantasoft.com/index.php?Gazelle%20CMS/Download Found by whitesheep on 11/08/2009 Contact: [email protected] - https://www.ihteam.net Need...

CVE-2009-2218

Multiple PHP remote file inclusion vulnerabilities affect phpCollegeExchange 0.1.5c when register_globals is enabled. The flaws allow an attacker to trigger arbitrary PHP code execution by supplying a URL in the home parameter to several PHP scripts (i_head.php, i_nav.php, user_new_2.php, house/m...

CVE-2009-2182

Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 adpopup.php, 2 camphtml.php, 3 initcontent.php, 4 logout.php, 5 menu.php, and 6 set-author.php in admin-files/; 7...

Acajoom Component for Joomla! <= 3.2.6 Backdoor Detection

Acajoom, a third-party component for Joomla! for managing mailing lists, newsletters, auto-responders, and other communications, is running on the remote host. This version of Acajoom is equal or prior to 3.2.6. It is, therefore, affected by a backdoor in the self.acajoom.php script. An...

eliteCMS multiple Vulnerabilities

eliteCMS is prone to a vulnerability that lets attackers upload and execute arbitrary PHP code. The application is also prone to a cross-site scripting issue and to a SQL Injection Vulnerability. These issues occur because the application fails to sufficiently sanitize user-supplied input...

CVE-2009-1936

functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrar...

CVE-2009-1936

The CVE-2009-1936 entry concerns cpCommerce 1.2.x (possibly including 1.2.9) and related variants. The root cause is in _functions.php: when called directly, a redirect is issued but not exited, allowing bypass of a protection mechanism that enables remote file inclusion and directory traversal v...

Movie PHP Script 2.0 Code Execution

Movie PHP Script v2.0 Remote PHP Code Execution + Discovered By SirGod + www.mortal-team.org + Remote PHP Code Execution - Vulnerable code in system/services/init.php : --------------------------------------------------------------------------------- Line 84 : @evalstripslashes$REQUEST'anticode';...

ECShop PHP Code Execution

Securitylab.ir Application Info: Name: ecshop Version: 2.6.2 Website: http://www.ecshop.com Discoverd By: Securitylab.ir Website: http://securitylab.ir Contacts: info@securitylabdotir & [email protected] =========================================================== :: integrate.php :: if...

TinyWebGallery lang Parameter Local File Inclusion

The remote host is running TinyWebGallery, a web-based photo gallery application written in PHP. The version of TinyWebGallery installed on the remote host fails to filter user-supplied input to the 'lang' parameter of the 'admin/include/init.php' script before using it to include PHP code...

CVE-2009-1779

PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the formincludetemplate parameter...

CVE-2008-6807

PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL in the xmldir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the libdir...

CVE-2008-6773

The CVE-2008-6773 entry concerns YourPlace 1.0.2 and earlier, where a static code injection flaw in user/internettoolbar/edit.php allows remote authenticated users to execute arbitrary PHP via 10 fav parameters, resulting in partial impact to confidentiality, integrity, and availability. The root...