CVE-2006-2568: Undefined Security Weakness

PHP remote file inclusion vulnerability in addpostnewpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 trial allows remote attackers to execute arbitrary PHP code via a URL in the thispath parameter...

Remote Code Execution in artmedic Newsletter 4.1 [log.php]

I found a bug in artmedic Newsletter 4.1 proably even in newer versions which lets an attacker run arbitrary php-code and bypass the password protection. The reason for this is mistake in design. log.php: ?php $time = time; $date = date"d.m.Y, H:i:s"; $remote = getenv"REMOTEADDR"; $ip =...

XOOPS xoopsConfig Parameter Variable Overwrite Local File Inclusion

The version of XOOPS installed on the remote host allows an unauthenticated attacker to skip processing of the application's 'include/common.php' script and thereby to gain control of the variables '$xoopsConfiglanguage' and '$xoopsConfigthemeset', which are used by various scripts to include PHP...

newsletter.txt

I found a bug in artmedic Newsletter 4.1 proably even in newer versions which lets an attacker run arbitrary php-code and bypass the password protection. The reason for this is mistake in design. log.php: Usually the log.php is included and $logfile,$logtime and $email are declared in the parent...

XOOPS < 2.0.9.4 include/common.php nocommon Parameter Local File Inclusion

Binary data 3629.prm...

CVE-2006-2523: Undefined Security Weakness

PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magicquotesgpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie...

CVE-2006-2526: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in PHP Easy Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter...

CVE-2006-2507: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter in 1 index.php, 2 song.php, 3 faq.php, 4 list.php, 5 genm3u.php, and 6 playlist.php...

CVE-2005-1755

PHP remote file inclusion vulnerability in pollvote.php in PHP Poll Creator 1.01 allows remote attackers to execute arbitrary PHP code via the relativerpfad parameter...

Fusion News v.1.0 (fil_config) Remote File Inclusion Exploit

No description provided by source. !/usr/bin/perl use IO::Socket; Exploit coded by: X0r1 Bug found by: X0r1 release: 21.05.06 vulnerable code in sources\post.php at lines 32-35: ---------------------------------------------------------------------------------- ... global $VARS, $TEMPLATE, $fillan...

CVE-2005-1755: Undefined Security Weakness

PHP remote file inclusion vulnerability in pollvote.php in PHP Poll Creator 1.01 allows remote attackers to execute arbitrary PHP code via the relativerpfad parameter...

CVE-2006-2479

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site...

Design/Logic Flaw

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site...

CVE-2006-2479

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site...

CVE-2006-2483: Undefined Security Weakness

PHP remote file inclusion vulnerability in cartcontent.php in Squirrelcart 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cartisproot parameter...

CVE-2006-2485: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/classtemplate.php in Quezza 1.0 and earlier, and possibly 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the quezzarootpath parameter...

Artmedic NewsLetter 4.1 - 'Log.php' Remote Script Execution

source: https://www.securityfocus.com/bid/18047/info Artmedic Newsletter is prone to a remote PHP code-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to create files containing arbitrary conte...

[SA20156] ScozNews &quot;CONFIG[main_path]&quot; File Inclusion Vulnerabilities

TITLE: ScozNews "CONFIGmainpath" File Inclusion Vulnerabilities SECUNIA ADVISORY ID: SA20156 VERIFY ADVISORY: http://secunia.com/advisories/20156/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: ScozNews 1.x http://secunia.com/product/10016/ DESCRIPTION: Kacper has...

Remote file inclusion

PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the ezUserManagerPath parameter to ezusermanagerpwdforgott.php, possibly due to an issue in ezusermanagercore.inc.php...

Newsportal: code injection vulnerability

Hello, there is a code injection vulnerability in NewsPortal that could give everyone the ability to execute php code on the webserver where newsportal is installed. This bug should only occur if "registerglobals=on" is set in the php.ini. To remove the problem: - install the recent version:...