CVE-2009-2228

Cross-site scripting XSS vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web script or HTML via the url parameter in a redirect action...

CVE-2009-2218

Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the home parameter to 1 ihead.php, 2 inav.php, 3 usernew2.php, or 4 house/myrents.php; or 5 allbooks.php, 6 home.php,...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 adpopup.php, 2 camphtml.php, 3 initcontent.php, 4 logout.php, 5 menu.php, and 6 set-author.php in admin-files/; 7...

Design/Logic Flaw

pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message...

CVE-2009-1779

PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the formincludetemplate parameter...

CVE-2009-1450

PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the pagecontent parameter...

CVE-2008-6740

PHP remote file inclusion vulnerability in html/admin/modules/pluginadmin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the settingspluginpath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in html/admin/modules/pluginadmin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the settingspluginpath parameter...

CVE-2008-6740

PHP remote file inclusion vulnerability in html/admin/modules/pluginadmin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the settingspluginpath parameter...

CVE-2009-1315

Multiple cross-site scripting XSS vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 gid parameter to groupsprofile.php, 2 catid and 3 razdid parameters to advcat.php, and the 4 URL to blogsfull.php...

Remote file inclusion

PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dirinc parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the themedirectory parameter to 1 container.php and 2 header.php in themes/...

CVE-2008-6584

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

Design/Logic Flaw

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

CVE-2008-6584

The affected software is TorrentFlux 2.3 (html/index.php). The vulnerability arises from the url_upload parameter, which accepts a URL to a file with an executable extension; TorrentFlux downloads this file and it can be accessed directly in the html/downloads/ user directory. This enables remote...

Remote file inclusion

PHP remote file inclusion vulnerability in news/include/createdb.php in Web Server Creator Web Portal 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the langfile parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...

CVE-2008-6511

Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter...

CVE-2008-6491

PHP remote file inclusion vulnerability in connexion.php in PHPGKit 0.9 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-0970

PHP remote file inclusion vulnerability in includes/classimage.php in PHP Pro Bid 6.05, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the fileExtension parameter. NOTE: the provenance of this information is unknown; the details are obtained...

Remote file inclusion

PHP remote file inclusion vulnerability in slideshowuploadvideo.content.php in SharedLog, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSrootdir parameter...