CVE-2006-5918: Undefined Security Weakness

Unrestricted file upload vulnerability in RapidKill aka PHP Rapid Kill 5.7 Pro, and certain other versions, allows remote attackers to upload and execute arbitrary PHP scripts via the "Link to Download" field. NOTE: it is possible that the field value is restricted to files on specific public web...

CVE-2006-5845: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1...

CVE-2005-4814: Undefined Security Weakness

Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory...

CVE-2006-5411

The CVE-2006-5411 entry concerns an unrestricted file upload in Free Web Publishing System (FreeWPS) via upload.php, potentially affecting version 2.11 and earlier. Remote attackers could upload and execute arbitrary PHP programs. The vulnerability enables partial confidentiality, integrity, and ...

CVE-2006-5411: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php for Free Web Publishing System FreeWPS, possibly 2.11 and earlier, allows remote attackers to upload and execute arbitrary PHP programs...

CVE-2006-5016

The CVE concerns Szava Gyula and Csaba Tamas e-Vision CMS (likely version 1.0). The vulnerable component is admin/x_image.php, where an unrestricted file upload allows remote attackers to place arbitrary files in the /imagebank directory. The vulnerability’s root cause is an unconstrained upload ...

CVE-2006-5016: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/ximage.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to upload arbitrary files to the /imagebank directory...

GLSA-200609-16 : Tikiwiki: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200609-16 Tikiwiki: Arbitrary command execution A vulnerability in jhot.php allows for an unrestricted file upload to the img/wiki/ directory. Additionally, an XSS exists in the highlight parameter of tiki-searchindex.php. Impact ...

Tikiwiki: Arbitrary command execution

Background Tikiwiki is a web-based groupware and content management system, developed with PHP, ADOdb and Smarty. Description A vulnerability in jhot.php allows for an unrestricted file upload to the img/wiki/ directory. Additionally, an XSS exists in the highlight parameter of...

CVE-2006-4977

The vulnerability described in CVE-2006-4977 affects Walter Beschmout PhpQuiz 1.2 and earlier, specifically in back/upload_img.php and admin/upload_img.php. It is an unrestricted file upload flaw that lets remote attackers upload arbitrary PHP code to the phpquiz/img_quiz folder by abusing the (a...

CVE-2006-4977: Undefined Security Weakness

Multiple unrestricted file upload vulnerabilities in 1 back/uploadimg.php and 2 admin/uploadimg.php in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to upload arbitrary PHP code to the phpquiz/imgquiz folder via the a upload, b okupdate, c image, and d path parameters, possibly...

CVE-2006-4922

CVE-2006-4922 describes an unrestricted file upload in Site@School (S@S) 2.4.02 and earlier, specifically in starnet/editors/htmlarea/popups/images.php. The vulnerability enables remote attackers to upload and execute arbitrary files with executable extensions. The available documents identify th...

CVE-2006-4922: Undefined Security Weakness

Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School S@S 2.4.02 and earlier allows remote attackers to upload and execute arbitrary files with executable extensions...

CVE-2006-4859

Limbo CMS (Lite Mambo) — affected: Limbo/Lite Mambo com_contact in versions up to 1.0.4.2L. The contact.html.php file’s contact_attach parameter allows unrestricted file uploads using a filename with a double extension, bypassing a restrictive regex. This enables remote attackers to upload PHP co...

CVE-2006-4859: Undefined Security Weakness

Unrestricted file upload vulnerability in contact.html.php in the Contact comcontact component in Limbo aka Lite Mambo CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the contactattach parameter in a contac...

CVE-2006-4875: Undefined Security Weakness

Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, and possibly files with arbitrary extensions, to gallery/albums/public...

CVE-2006-4675: Undefined Security Weakness

Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors...

CVE-2006-4602: Undefined Security Weakness

Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory...

CVE-2006-4617: Undefined Security Weakness

Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder...

CVE-2006-4602

CVE-2006-4602 affects TikiWiki (jhot.php) prior to/including 1.9.4 Sirius and earlier. Unrestricted file upload allows remote attackers to place a .php file in img/wiki/ and execute arbitrary PHP code. Connected sources document a remote-code-execution risk via jhot.php upload validation flaw; ex...