9285 matches found
CVE-2006-3172: Improper Control of Generation of Code
Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash / character in the 1 langpath parameter to a cms/plugins/colman/column.inc.php, b cms/plugins/poll/poll.inc.php, c...
CVE-2006-3177: Undefined Security Weakness
PHP remote file inclusion vulnerability in Admin/rtfparser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter...
CVE-2006-3192: Undefined Security Weakness
PHP remote file inclusion vulnerability in Ad Manager Pro 2.6 allows remote attackers to execute arbitrary PHP code via a URL in the 1 ipath parameter in common.php and 2 unspecified vectors in ad.php...
[SA20713] CMS Faethon "mainpath" File Inclusion and Cross-Site Scripting Vulnerabilities
---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...
CVE-2006-3158: Undefined Security Weakness
index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypass security checks and upload or execute arbitrary php code via the add action...
CVE-2006-3162: Undefined Security Weakness
PHP remote file inclusion vulnerability in include/incfoot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...
CVE-2006-3136: Improper Control of Generation of Code
Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIRLIBS parameter in 1 path/action.php, and to files in path/nucleus including 2 media.php, 3 /xmlrpc/server.php, and 4 /xmlrpc/apimetaweblog.inc.php. NOTE: this i...
Code injection
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files...
CVE-2006-2931
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files...
CVE-2006-3102
Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the modmime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles...
CVE-2006-3107: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 GLOBALSwhereframework to a admin/modules/news/newsclass.php and b admin/modules/content/contentclass.php, and 2...
CVE-2006-2931: Undefined Security Weakness
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files...
CVE-2006-3076: Undefined Security Weakness
PHP remote file inclusion vulnerability in softwareupload/publicincludes/pubtemplates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter...
CVE-2006-3075: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including 1 thumstbl.php, 2 wpfiles.php,...
PictureDis Products "lang" Parameter File Inclusion Vulnerability
PictureDis Products "lang" Parameter File Inclusion Vulnerability ================================================= Input passed to the "lang" parameter in thumstbl.php, wpfiles.php, and wallpapr.php is not properly verified before being used to include files. This can be exploited to execute...
RahnemaCo - page.php PageID Remote File Inclusion
RahnemaCo - page.php PageID Remote File Inclusion source: https://www.securityfocus.com/bid/18490/info RahnemaCo is prone to a remote file-include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of t...
RahnemaCo - 'page.php' PageID Remote File Inclusion
source: https://www.securityfocus.com/bid/18490/info RahnemaCo is prone to a remote file-include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker ...
GLSA-200606-16 : DokuWiki: PHP code injection
The remote host is affected by the vulnerability described in GLSA-200606-16 DokuWiki: PHP code injection Stefan Esser discovered that the DokuWiki spell checker fails to properly sanitize PHP's 'complex curly syntax'. Impact : A unauthenticated remote attacker may execute arbitrary PHP commands ...
mcGuestbook 1.3 - 'ecrire.php?lang' Remote File Inclusion
source: https://www.securityfocus.com/bid/18476/info mcGuestbook is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code an...
mcGuestbook 1.3 - 'admin.php?lang' Remote File Inclusion
source: https://www.securityfocus.com/bid/18476/info mcGuestbook is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code an...