CVE-2006-6511

dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain 1 feature, 2 editor, 3 newswire, 4 otherpress, 5 admin, 6 pbook, 7 media, or 8 mod, which are...

CVE-2006-6549: Undefined Security Weakness

PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the savepath parameter. NOTE: CVE disputes this vulnerability because savepath is originally defined as "" before use, and the nearby instructions say "SET T...

CVE-2006-6546: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork CN:AJ 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter...

CVE-2006-6533: Undefined Security Weakness

Directory traversal vulnerability in admin/templatesboxeslayout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. dot dot in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages...

CVE-2006-6552: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/plugins/NPUserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIRADMIN parameter...

CVE-2006-6541: Undefined Security Weakness

PHP remote file inclusion vulnerability in signer/final.php in warez distributions of Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter. NOTE: the vendor disputes this issue, stating that only Warez versions of Animated Smiley...

CVE-2006-6553: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/newssuiteconstants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2006-6526: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter...

CVE-2006-6462

PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter...

CVE-2006-6453

PHP remote file inclusion vulnerability in JOWAMPShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter...

CVE-2006-6426: Undefined Security Weakness

PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the templatefile parameter...

CVE-2006-6416: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PhpLeague - Univert PhpLeague 0.81 allow remote attackers to execute arbitrary PHP code via a URL in the cheminmini parameter to 1 consult/miniseul.php or 2 config.php. NOTE: The provenance of this information is unknown; the details are...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6360: Undefined Security Weakness

PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the footerpage parameter...

CVE-2006-6341: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the apxrootpath parameter to 1 act/actcheckaccess.php, 2 dsp/dspformbookingctl.php, and 3 dsp/dspbookings.php...

CVE-2006-6347: Undefined Security Weakness

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

PHP Live Helper <= 2.0 (abs_path) Remote File Inclusion Vulnerability

No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV43$2006 ------------------------------------------------------------------------------ ECHOADV43$2006 PHP Live Helper = 2.0 abspath Remote File Inclusion...

CVE-2006-6295: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/mxcommon.php in the mxtinies 1.3.0 Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

CVE-2006-6285: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Kai Blankenhorn Bitfolge simple and nice index file aka snif 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the externalConfig parameter. NOTE: CVE and other third parties dispute this vulnerability...

CVE-2006-6281: Undefined Security Weakness

PHP remote file inclusion vulnerability in checkstatus.php in dicshunary 0.1 alpha allows remote attackers to execute arbitrary PHP code via a URL in the dicshunaryrootpath parameter...