CVE-2011-4449: Undefined Security Weakness

actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANETMODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a...

CVE-2012-1641

The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...

CVE-2012-1641: Undefined Security Weakness

The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...

PT-2012-3405

Name of the Vulnerable Software and Affected Versions Finder module versions 6.x-1.x before 6.x-1.26 Finder module versions 7.x-1.x Finder module versions 7.x-2.x before 7.x-2.0-alpha8 Description The issue allows remote authenticated users with the administer finder permission to execute arbitra...

PT-2012-3664

Name of the Vulnerable Software and Affected Versions Newscoop versions 3.5.x through 3.5.4 Newscoop versions 4.0.0 through 4.0.RC3 Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This can be achieved by providing a URL in the GLOBALSg...

CVE-2010-5091

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

PT-2012-5343

Name of the Vulnerable Software and Affected Versions Gallery 3 versions prior to 3.0.4 Description The issue allows attackers to execute arbitrary PHP code via unknown vectors. Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue...

CVE-2012-4343: Undefined Security Weakness

Multiple unspecified vulnerabilities in Gallery 3 before 3.0.4 allow attackers to execute arbitrary PHP code via unknown vectors...

CVE-2012-2073

The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors...

CVE-2012-3448

Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors...

CVE-2012-1037

PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the subtype parameter...

PT-2012-3035

Name of the Vulnerable Software and Affected Versions GLPI versions 0.78 through 0.80.61 Description The issue allows remote authenticated users to execute arbitrary PHP code via a URL in the sub type parameter in the front/popup.php file. Recommendations For GLPI versions 0.78 through 0.80.61,...

PT-2012-5016

Name of the Vulnerable Software and Affected Versions Font Uploader plugin version 1.2.4 Description The issue allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension to the font-upload.php file in the Font Uploader plugin, and then accessing it via...

PT-2012-4348

Name of the Vulnerable Software and Affected Versions Joomla Content Editor JCE component versions prior to 2.1 Description The issue allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension. This can be achieved when chunking is set to greater than zero...

CVE-2012-1205: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter...

CVE-2012-1200: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the 1 fileType parameter to optimizer/index.php, 2 id parameter to administrator/modules/moduleslist.php, 3 filename parameter to includes/function/gets.php, or 4...

CVE-2012-1199: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine BASE 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 BASEpath parameter to baseagmain.php, 2 basedbsetup.php, 3 basegraphcommon.php, 4 basegraphdisplay.php, 5 basegraphform.php, ...

Horde 3.3.12 Backdoor Arbitrary PHP Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Horde 3.3.12...

Gentoo Security Advisory GLSA 201201-01 (phpMyAdmin)

The remote host is missing updates announced in advisory GLSA 201201-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2012-1010

Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory...