CVE-2006-6887: Improper Control of Generation of Code

Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to plugins/widged/widged.php aka the WidgEd plugin, a different vulnerability than CVE-2006-6783. NOTE: The provenance of this information is...

CVE-2006-6879: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated users to upload arbitrary PHP scripts to the gfx/ and files/ directories via the userfile parameter...

CVE-2006-4581: Undefined Security Weakness

Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts...

CVE-2006-6570

CVE-2006-6570 describes an unrestricted file upload in upload.php of GenesisTrader 1.0. The vulnerability allows remote authenticated users to upload arbitrary files through unspecified vectors, possibly involving form.php and the ajoutfich “foap” action. The available sources indicate a high-sev...

CVE-2006-6570: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via unspecified vectors, possibly involving form.php and the ajoutfich "foap" action...

PT-2006-7072 · Midicart · Midicart

Name of the Vulnerable Software and Affected Versions: Midicart affected versions not specified Description: The issue concerns an unrestricted file upload vulnerability. It allows remote authenticated users to upload arbitrary files, possibly including .php files, to the images/ directory under...

CVE-2006-6463: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root...

CVE-2006-6347: Undefined Security Weakness

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6338: Undefined Security Weakness

Unrestricted file upload vulnerability in upload/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/...

Multiple bugs in TFT-Gallery

Script Name: TFT-Gallery Authors: Mike Scalora, Eric Thelin, Sascha Lorenz & Jan Berndt Website: http://tftgallery.sourceforge.net Bug Report: NetJackal njAThackerzDOTir & nima501ATyahooDOTcom Status: Patch not released First i should apologize for my bad english. Intro: TFT-Gallery is a PHP-base...

CVE-2006-5918

CVE-2006-5918 describes an unrestricted file upload vulnerability in RapidKill (aka PHP Rapid Kill) 5.7 Pro and some other versions, where remote attackers can upload and execute arbitrary PHP scripts through the "Link to Download" field. This field may be restricted to files on public sites in s...

CVE-2006-5918: Undefined Security Weakness

Unrestricted file upload vulnerability in RapidKill aka PHP Rapid Kill 5.7 Pro, and certain other versions, allows remote attackers to upload and execute arbitrary PHP scripts via the "Link to Download" field. NOTE: it is possible that the field value is restricted to files on specific public web...

CVE-2006-5845: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1...

CVE-2005-4814: Undefined Security Weakness

Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory...

CVE-2006-5411

The CVE-2006-5411 entry concerns an unrestricted file upload in Free Web Publishing System (FreeWPS) via upload.php, potentially affecting version 2.11 and earlier. Remote attackers could upload and execute arbitrary PHP programs. The vulnerability enables partial confidentiality, integrity, and ...

CVE-2006-5411: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php for Free Web Publishing System FreeWPS, possibly 2.11 and earlier, allows remote attackers to upload and execute arbitrary PHP programs...

CVE-2006-5016

The CVE concerns Szava Gyula and Csaba Tamas e-Vision CMS (likely version 1.0). The vulnerable component is admin/x_image.php, where an unrestricted file upload allows remote attackers to place arbitrary files in the /imagebank directory. The vulnerability’s root cause is an unconstrained upload ...

CVE-2006-5016: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/ximage.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to upload arbitrary files to the /imagebank directory...

GLSA-200609-16 : Tikiwiki: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200609-16 Tikiwiki: Arbitrary command execution A vulnerability in jhot.php allows for an unrestricted file upload to the img/wiki/ directory. Additionally, an XSS exists in the highlight parameter of tiki-searchindex.php. Impact ...

Tikiwiki: Arbitrary command execution

Background Tikiwiki is a web-based groupware and content management system, developed with PHP, ADOdb and Smarty. Description A vulnerability in jhot.php allows for an unrestricted file upload to the img/wiki/ directory. Additionally, an XSS exists in the highlight parameter of...