603 matches found
CVE-2007-0370
Unrestricted file upload vulnerability in index.php in phpBP RC3 2.204 and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an imageform parameter specifying a multiple-extension filename...
CVE-2006-4127
Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the 1 privmsg or 2 pubmsg functions from a cmd.user.c, b penalties.c, or c cmd.dc.c...
CVE-2006-4127
The CVE-2006-4127 entry covers format string vulnerabilities in DConnect Daemon (versions up to 0.7.0). The issue arises when calling privmsg() or pubmsg from the files cmd.user.c, penalties.c, or cmd.dc.c, allowing remote administrators to execute arbitrary code due to improper handling of forma...
CVE-2006-3046
Unspecified vulnerability in the admin login feature in Subtext 1.5, in a multiblog setup, allows remote administrators of one blog to login to another blog...
Cross site scripting
Cross-site scripting XSS vulnerability in PunBB 1.2.11 allows remote authenticated administrators to inject arbitrary HTML or web script to other administrators via the "Admin note" feature, a different vulnerability than CVE-2006-2227...
Directory traversal
Directory traversal vulnerability in 1 editmailtexte.cgi and 2 bestmail.cgi in Cosmoshop 8.11.106 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter...
Code injection
Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts...
CVE-2006-1658
Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts...
CVE-2006-1658
Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts...
CVE-2006-1576
Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php...
CVE-2006-1576
Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php...
CVE-2006-1576
QLnews 1.2 contains a direct static code injection vulnerability that lets remote authenticated administrators execute arbitrary PHP code by modifying config.php. Root cause is injection via config.php; impact across confidentiality, integrity, and availability is implied in CVSS 2.0. No patch is...
Code injection
Direct static code injection vulnerability in config.php in vscripts aka Kuba Kunkiewicz VBook aka VBook 2.0 allows remote administrators to execute arbitrary PHP code into the config file, which is included other VBook scripts...
CVE-2006-1563
Direct static code injection vulnerability in config.php in vscripts aka Kuba Kunkiewicz VBook aka VBook 2.0 allows remote administrators to execute arbitrary PHP code into the config file, which is included other VBook scripts...
CVE-2006-1545
Direct static code injection vulnerability in admin/config.php in vscripts aka Kuba Kunkiewicz VNews 1.2 allows remote authenticated administrators to execute code by inserting the code into variables that are stored in admin/config.php...
CVE-2006-1545
Direct static code injection vulnerability in admin/config.php in vscripts aka Kuba Kunkiewicz VNews 1.2 allows remote authenticated administrators to execute code by inserting the code into variables that are stored in admin/config.php...
CVE-2005-2786
Directory traversal vulnerability in bestmailedit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter...
CVE-2005-2786
Directory traversal vulnerability in bestmailedit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter...
CVE-2000-1229
Phorum 3.0.7 is affected by a directory traversal vulnerability that allows remote Phorum administrators to read arbitrary files via dot-dot sequences in the default .langfile name field in the Master Settings admin function, causing the file to be displayed in admin.php3. The issue stems from im...