CVE-2006-3162: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/incfoot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2006-3136: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIRLIBS parameter in 1 path/action.php, and to files in path/nucleus including 2 media.php, 3 /xmlrpc/server.php, and 4 /xmlrpc/apimetaweblog.inc.php. NOTE: this i...

CVE-2006-3158: Undefined Security Weakness

index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypass security checks and upload or execute arbitrary php code via the add action...

Code injection

CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files...

CVE-2006-2931: Undefined Security Weakness

CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files...

CVE-2006-3107: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 GLOBALSwhereframework to a admin/modules/news/newsclass.php and b admin/modules/content/contentclass.php, and 2...

CVE-2006-3076: Undefined Security Weakness

PHP remote file inclusion vulnerability in softwareupload/publicincludes/pubtemplates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter...

CVE-2006-3075: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including 1 thumstbl.php, 2 wpfiles.php,...

CVE-2006-3045: Undefined Security Weakness

PHP remote file inclusion vulnerability in managesongs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the foingrootpath parameter...

CVE-2006-3053: Undefined Security Weakness

PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUMhttppath parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of...

CVE-2006-3019

Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMSINCLUDEPATH parameter to files in parser/include/ including 1 class.parserphpcms.php, 2 class.sessionphpcms.php, 3 class.editphpcms.php, 4...

CVE-2006-3028

PHP remote file inclusion vulnerability in statmodules/usersage/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-3042: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 goinfoispclassesroot parameter in a server.inc.php, and the 2 goinfoserverclassesroot parameter in b app.inc.php, c login.php, and d trylogin.php. NOTE: th...

CVE-2006-3041: Undefined Security Weakness

PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ltwconfigincludedir parameter. NOTE: CVE disputes this claim, since the $ltwconfigincludedir variable is defined as a static...

CVE-2006-3028: Undefined Security Weakness

PHP remote file inclusion vulnerability in statmodules/usersage/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-3019: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMSINCLUDEPATH parameter to files in parser/include/ including 1 class.parserphpcms.php, 2 class.sessionphpcms.php, 3 class.editphpcms.php, 4...

CVE-2006-2996: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dirdata parameter...

CVE-2006-2995: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in WebprojectDB 0.1.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INCDIR parameter in 1 include/nav.php and 2 include/lang.php...

CVE-2006-2998: Undefined Security Weakness

PHP remote file inclusion vulnerability in board/post.php in free QBoard 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the qbpath parameter...

CVE-2006-2982: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems EPS 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in 1 footer.php and 2 admin/footer.php...