W-Agora 4.2.1 - Multiple Arbitrary File Upload Vulnerabilities

source: https://www.securityfocus.com/bid/23055/info w-Agora is prone to multiple arbitrary file-upload vulnerabilities. An attacker can exploit these vulnerabilities to upload PHP script code and execute it in the context of the webserver process. w-Agora 4.2.1 is vulnerable. ?php / Title...

CVE-2007-1472

Variable overwrite vulnerability in groupit/base/groupit.start.inc in Groupit 2.00b5 allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via arguments that are written to $GLOBALS, as demonstrated using a URL in the cbasepath parameter to 1 content.php,...

CVE-2006-7156

PHP remote file inclusion vulnerability in addonkeywords.php in Keyword Replacer keywordreplacer 1.0 and earlier, a module for miniBB, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter...

CVE-2006-7120

PHP remote file inclusion vulnerability in lib/php/phphtmllib-2.5.4/examples/example6.php for maintain 3.0.0-RC2 allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter. NOTE: this issue might be in phpHtmlLib. NOTE: CVE disputes this issue for proper...

Unrestricted file upload

Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later...

CVE-2007-1255

Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later...

Remote file inclusion

PHP remote file inclusion vulnerability in actions/del.php in Admin Phorum 3.3.1a allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter...

CVE-2007-1153

Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: issue might overlap...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in ZPanel 2.0 allow remote attackers to execute arbitrary PHP code via a URL in 1 the body parameter to templates/ZPanelV2/template.php or 2 the page parameter to zpanel.php. NOTE: the zpanel.php vector may overlap CVE-2005-0793.2. NOTE: the...

Unrestricted file upload

Unrestricted file upload vulnerability in the onAttachFiles function in the upload tool inc/lib/attachment.lib.php in Wiclear before 0.11.1 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to filename validation. NOTE: some details were obtained fro...

CVE-2007-1097

CVE-2007-1097 affects Wiclear prior to 0.11.1. The onAttachFiles function in inc/lib/attachment.lib.php allows unrestricted file uploads, enabling remote attackers to upload and execute arbitrary PHP code due to filename validation weaknesses. Impact is remote code execution with full compromise ...

Magic News Plus 1.0.2 - preview.php?PHP_script_path Remote File Inclusion

Magic News Plus 1.0.2 - preview.php?PHPscriptpath Remote File Inclusion source: https://www.securityfocus.com/bid/22661/info Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote...

Magic News Plus 1.0.2 - 'preview.php?PHP_script_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/22661/info Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities. An...

CedStat 1.31 - index.php?hier Cross-Site Scripting

CedStat 1.31 - index.php?hier Cross-Site Scripting source: https://www.securityfocus.com/bid/22588/info CedStat is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code in the...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in TagIt! Tagboard 2.1.B Build 2 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 configpath parameter to a tagviewer.php, b tagprocess.php, and c CONFIG/errmsg.inc.php; and d...

CVE-2007-0839

Multiple PHP remote file inclusion vulnerabilities in index/indexalbum.php in Valarsoft WebMatic 2.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 PLIB and 2 PINDEX parameters...

Remote file inclusion

PHP remote file inclusion vulnerability in inhalt.php in LightRO CMS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dateiennews parameter...

CVE-2007-0704

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter, a different vector than CVE-2006-4669. NOTE: the documentation says to remove install.php after installation...

EUVD-2007-0680

PHP remote file inclusion vulnerability in includes/functions.php in Omegaboard 1.0beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in EncapsCMS 0.3.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 configpath parameter to a commonfoot.php or b blogs.php, or 2 the configtheme parameter to c admin/galleryhead.php...