CVE-2006-6041: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the ginclude parameter to 1 index.php, 2 module/forum/forum.php, 3 unspecified files under...

CVE-2006-6045: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Comdev One Admin Pro 4.1 allow remote attackers to execute arbitrary PHP code via a URL in the pathskin parameter to 1 adminfoot.php, 2 adminhead.php, or 3 adminlogin.php...

CVE-2006-6044: Undefined Security Weakness

PHP remote file inclusion vulnerability in gallerytop.inc.php in PHPQuickGallery 1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the textFile parameter...

CVE-2006-5928

Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the installedconfigfile parameter to 1 add-modify.php, 2 delete.php, 3 modify.php, and 4 phpjobscheduler.php...

CVE-2006-5929: Undefined Security Weakness

PHP remote file inclusion vulnerability in firepjs.php in Phpjobscheduler 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the installedconfigfile parameter. NOTE: the provenance of this information is unknown; details are obtained from third party sources...

CVE-2006-5931: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to certain PHP scripts in 1 lib/actions/, 2 lib/displays/, 3...

CVE-2006-5928: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the installedconfigfile parameter to 1 add-modify.php, 2 delete.php, 3 modify.php, and 4 phpjobscheduler.php...

CVE-2006-5930: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to 1 basicfunctions.php, or 2 pageactionauthor.php...

CVE-2006-5899

The CVE-2006-5899 issue is a PHP remote file inclusion in @cid stats 2.3 via the repertoire parameter of install.php3, enabling remote code execution. The root cause is the presence of install.php3 that can be invoked with a URL parameter to include arbitrary PHP code. The notes in sources indica...

CVE-2006-5899: Undefined Security Weakness

PHP remote file inclusion vulnerability in install.php3 in @cid stats 2.3 allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter. NOTE: this issue has been disputed by a third party, who states that install.php3 is supposed to be deleted after installation and...

CVE-2006-5911: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 2.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the gdocumentRoot parameter to 1 Alias.php, 2 Article.php, 3 ArticleAttachment.php, 4 ArticleComment.php, 5 ArticleData.php, 6 ArticleImage.php, 7...

CVE-2006-5919: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/edata/visEditcontrol.class.php in ActiveCampaign KnowledgeBuilder 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the visEditroot parameter, a different vector than CVE-2003-1131...

CVE-2006-5923: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog aka GimeScripts Shopping Catalog 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the custom parameter...

CVE-2006-5906: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES aka ban 0.1 and PLS-Bannieres 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: the issue is disputed by other researchers, who...

CVE-2006-5920: Undefined Security Weakness

PHP remote file inclusion vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter. NOTE: SecurityFocus disputes this issue, saying "further analysis reveals that the application is not vulnerable." NOTE: thi...

CVE-2006-5895: Undefined Security Weakness

PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

Update Protection against phpFullAnnu 'repmod' parameter File Inclusion Vulnerability

phpFullAnnu, a content management system portal application, is prone to a remote file inclusion vulnerability. An attacker can exploit this vulnerability to execute arbitrary PHP code on an affected system via a maliciously crafted URL in the 'repmod' parameter...

CVE-2006-5865: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in language.inc.php in MyAlbum 3.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the langsdir parameter...

CVE-2006-5863: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter...

CVE-2006-5845: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1...