CVE-2008-4810: Improper Control of Generation of Code

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and 1 a dollar-sign character, aka "php executed in templates;" and 2 a double quoted literal string, aka a "function...

[SECURITY] Fedora 8 Update: rubygem-rails-2.1.1-2.fc8

Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...

[SECURITY] Fedora 9 Update: rubygem-rails-2.1.1-2.fc9

Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...

CVE-2008-4141: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the webroot parameter to 1 includes/functioncore.php and 2 templates/layoutlyrics.php...

Directory traversal

Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...

Freeway 1.4.1.171 - templatesFreewayboxescard1.php?language Traversal Local File Inclusion

Freeway 1.4.1.171 - templatesFreewayboxescard1.php?language Traversal Local File Inclusion source: https://www.securityfocus.com/bid/30731/info Freeway is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these...

Improper access control

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...

CVE-2008-3458

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...

CVE-2008-3458

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...

k-links directory - SQL Injection Cross-Site Scripting

k-links directory - SQL Injection Cross-Site Scripting ================================================================================ || K-Links Directory SQL-INJECTION, XSS ================================================================================ Application: K-Links Directory...

CVE-2008-3298: Improper Control of Generation of Code

SocialEngine SE before 2.83 grants certain write privileges for templates, which allows remote authenticated administrators to execute arbitrary PHP code...

CodeDB 1.1.1 - 'list.php' Local File Inclusion

Name : CodeDB list.php lang Local File Inclusion Vulnerability Author : cOndemned Greetz : ZaBeaTy, str0ke, irk4z, GregStar, doctor, Adish, Avantura ; Source : // list.php 2. $lang = htmlspecialchars$GET'lang'; // ok, but.... for what ? lol 7. iffileexists'templates/'.$lang.'middle.php' // We'll...

CodeDB 1.1.1 - list.php Local File Inclusion

CodeDB 1.1.1 - list.php Local File Inclusion Name : CodeDB list.php lang Local File Inclusion Vulnerability Author : cOndemned Greetz : ZaBeaTy, str0ke, irk4z, GregStar, doctor, Adish, Avantura ; Source : // list.php 2. $lang = htmlspecialchars$GET'lang'; // ok, but.... for what ? lol 7...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

CVE-2008-2981

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

CVE-2008-2981

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

CVE-2008-2981: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the 1 contenidopath parameter to a contenido/backendsearch.php; the 2 cfgpathcontenido parameter to b movearticles.php, c moveoldstats.php, d...

CVE-2008-2128: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in templates/header.php in CMS Faethon 2.2 Ultimate allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter, a different vulnerability than CVE-2006-5588 and CVE-2006-3185...

Blog PixelMotion - modif_config.php Arbitrary File Upload

Blog PixelMotion - modifconfig.php Arbitrary File Upload ------------------------------------------------------------------------- -- JIKI Team JIKO + KIl1er --- ------------------------------------------------------------------------- Author : jiko jiki team email : [email protected] Home :...