Code injection

Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php...

CVE-2007-0115

CVE-2007-0115 affects Coppermine Photo Gallery 1.4.10 and earlier. The vulnerability is a static code injection that lets remote authenticated administrators run arbitrary PHP code. The attack path involves injecting PHP code via the Username field to login.php, which is injected into an error me...

CVE-2007-0115: Undefined Security Weakness

Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php...

CVE-2006-6856: Undefined Security Weakness

Direct static code injection vulnerability in WebText CMS 0.4.5.2 and earlier allows remote attackers to inject arbitrary PHP code into a script in wt/users/ via the im parameter during a profile edit edycja operation, which is then executed via a direct request for this script...

CVE-2006-6790: Undefined Security Weakness

Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board UPB 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is injected into chat/text.php...

CVE-2006-6255

The CVE-2006-6255 entry concerns the NukeAI 0.0.3 Beta module for PHP-Nuke, where a vulnerability in util.php allows remote code execution. An attacker can upload and execute arbitrary PHP code by supplying a filename with a .php extension in the filename parameter and code in the moreinfo parame...

CVE-2006-6255

Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension in the filename parameter and code in the moreinfo...

CVE-2006-5837

CVE-2006-5837 describes a static code injection in the SimpleChat 1.0.0 module for iWare Professional CMS. The vulnerability resides in chat_panel.php, allowing remote attackers to inject arbitrary PHP code into chat_log.php via the msg parameter. The CVSSv2 vector is AV:N/AC:L/Au:N/C:P/I:P/A:P w...

CVE-2006-5837: Undefined Security Weakness

Static code injection vulnerability in chatpanel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows remote attackers to inject arbitrary PHP code into chatlog.php via the msg parameter...

CVE-2006-5511: Undefined Security Weakness

Direct static code injection vulnerability in delete.php in JaxUltraBB JUBB 2.0, when registerglobals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter...

CVE-2006-5432: Undefined Security Weakness

Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when registerglobals is enabled, allow remote attackers to create or overwrite arbitrary files via the 1 emailto, 2 emailfrom, 3 nameto, 4 namefrom, 5 picture, 6 comment, or 7 sessionID parameter, as...

CVE-2006-5131

module/shout/jafshout.php aka the shoutbox in ph03y3nk just another flat file JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "", possibly due to a static code injection vulnerability involving admin/datainc.php...

CVE-2006-5131: Undefined Security Weakness

module/shout/jafshout.php aka the shoutbox in ph03y3nk just another flat file JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by " ", possibly due to a static code injection vulnerability involving admin/datainc.php...

CVE-2006-5085

CVE-2006-5085 affects Blog Pixel Motion 2.1.1. The vulnerability is a static code injection in config.php where the nom_blog parameter is injected into include/variables.php, enabling remote attackers to execute arbitrary PHP code. The available connected documents confirm the affected software v...

CVE-2006-5085: Undefined Security Weakness

Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nomblog parameter, which is injected into include/variables.php...

CVE-2006-4979: Undefined Security Weakness

Direct static code injection vulnerability in cfgphpquiz/install.php in Walter Beschmout PhpQuiz 1.2 and earlier allows remote attackers to inject arbitrary PHP code in config.inc.php via modified configuration settings...

CVE-2006-4768

Multiple direct static code injection vulnerabilities in addgo.php in Stefan Ernst Newsscript aka WM-News 0.5 beta allow remote attackers to execute arbitrary PHP code via the 1 description, 2 issue, 3 title, 4 var, 5 name, 6 keywords, and 7 note parameters, which are stored in an article file...

CVE-2006-4674

Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php...

CVE-2006-4674

CVE-2006-4674 concerns DokuWiki prior to 2006-03-09c. A direct static code injection flaw in the script doku.php allows remote attackers to execute arbitrary PHP code by supplying a crafted X-FORWARDED-FOR HTTP header, which is stored in config.php. The vulnerability is characterized by an attack...

CVE-2006-4631

The CVE refers to SoftBB 0.1 (and possibly earlier) with a vulnerability in admin/save_opt.php: Direct static code injection allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php and makes it accessible v...