CVE-2006-4637: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ACGV News 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter in 1 header.php or 2 news.php. NOTE: portions of these details are obtained from third party information...

CVE-2006-4596

PHP remote file inclusion in MyBace Light Skrip, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the 1 hauptverzeichniss parameter in includes/logincheck.php and the 2 templateback parameter in admin/login/content/userdaten.php...

CVE-2006-4605: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to execute arbitrary PHP code via the adodb parameter...

CVE-2006-4609: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Content Management module "Content manager" for PHProjekt 0.6.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the pathpre parameter in 1 cmlib.inc.php, 2 doc/br.edithelp.php, 3...

CVE-2006-4610

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter...

softbb01.txt

!/usr/bin/perl Affected.scr..: SoftBB 0.1 Poc.ID........: 11060904 Type..........: PHP code execution, SQL Injection, Full Path Disclosure Risk.level....: High Vendor.Status.: Unpatched Src.download..: softbb.be Poc.link......: acid-root.new.fr/poc/11060904.txt Advisory.link.:...

CVE-2006-4610: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter...

CVE-2006-4605

The CVE describes a PHP remote file inclusion vulnerability in Longino Jacome php-Revista 1.1.2, exploitable via the adodb parameter in index.php, allowing remote attackers to execute arbitrary PHP code. The NVD entry records a CVSS v2 base score of 7.5 (HIGH) with network attack vector and low a...

CVE-2006-4621: Undefined Security Weakness

PHP remote file inclusion vulnerability in settings.php in Pheap 1.2, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. The...

CVE-2006-4618: Undefined Security Weakness

PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODBDIR parameter...

CVE-2006-4551

Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via 1 the file specified as the value of the format parameter, and possibly 2 the RSS feed...

CVE-2006-4558

DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the modmime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php...

CVE-2006-4548

e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code via the tinyMCEimglibinclude image/jpeg parameter in...

CVE-2006-4559: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System YACS CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the contextpathtoroot parameter in 1 articles/populate.php, 2 categories/category.php, 3 categories/populate.php, 4...

CVE-2006-4557

PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter. NOTE: another researcher has stated that an attacker cannot control the type parameter. As of 20060901, CVE analysis...

CVE-2006-4551

Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via 1 the file specified as the value of the format parameter, and possibly 2 the RSS feed...

[SA21757] MySource Classic Equation Attribute PHP Code Injection

TITLE: MySource Classic Equation Attribute PHP Code Injection SECUNIA ADVISORY ID: SA21757 VERIFY ADVISORY: http://secunia.com/advisories/21757/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: MySource Classic 2.x http://secunia.com/product/5773/ DESCRIPTION: A...

CVE-2006-4591: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the configtemplatepath parameter to 1 payment/paymentresult.php or 2 /payment/spuserresult.php...

PmWiki < 2.1.21 Global Variables Overwriting

The version of PmWiki installed on the remote host contains a programming flaw in 'pmwiki.php' that may allow an unauthenticated remote attacker to overwrite global variables used by the application, which could in turn be exploited to execute arbitrary PHP code on the affected host, subject to t...

CVE-2006-4544

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...