Remote file inclusion

PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via a URL in the bhconfigbhfilepath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the includePath cookie to 1 auth/extauth/drivers/mambo.inc.php or 2 auth/extauth/drivers/postnuke.inc.php...

Remote file inclusion

PHP remote file inclusion vulnerability in config.php in Rumble 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the configArrpathtodir parameter...

CVE-2006-2864: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 APPpathapplications parameter to a BsFaq.class.php, 2 APPpathcore parameter to b fileBrowserInner.php, c file.php, and d viewer.php, and e...

CVE-2006-2863: Undefined Security Weakness

PHP remote file inclusion vulnerability in class.csphpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the classesdir parameter...

CVE-2006-2871: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/common.php in CyBoards PHP Lite 1.25 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter. NOTE: CVE disputes this issue, since $scriptpath is set to a constant value...

CVE-2006-2842: Undefined Security Weakness

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by...

CVE-2006-2860: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 inc/logincheck.inc.php, 2 inc/adminheader.inc.php, 3 inc/global.php, or 4 inc/mainheader.inc.php. NOTE: some of these vectors were also...

CVE-2006-2866: Undefined Security Weakness

PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...

CVE-2006-2859: Undefined Security Weakness

PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggierootpath parameter to 1 admin.php or 2 scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBlogg...

CVE-2006-2845: Undefined Security Weakness

PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REXINCLUDEPATH parameter to imageresize/pages/index.inc.php...

CVE-2006-2844: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REXINCLUDEPATH parameter to 1 simpleuser/pages/index.inc.php and 2 stats/pages/index.inc.php...

Remote file inclusion

PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFlocalpath parameter...

[SA20438] BlueShoes Framework Multiple File Inclusion Vulnerabilities

---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...

CVE-2006-2819: Undefined Security Weakness

PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cnodeclasspath parameter...

CVE-2006-2811: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in 1 index.php, 2 topman.php, 3 approb.php, 4 vacadmb.php, 5 vacadma.php, 6 vacadm.php, 7 statart.php, 8 search.php, 9...

SquirrelMail plugin.php plugins Parameter Local File Inclusion

The version of SquirrelMail installed on the remote web server fails to properly sanitize user-supplied input to the 'plugins' parameter of the 'functions/plugin.php' script before using it in a PHP 'includeonce' function. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated...

Remote file inclusion

PHP remote file inclusion vulnerability in METAjour 2.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the 1 systempath parameter in a large number of files in the a app/edocument/, b app/eproject/, c app/erek/, and d extension/ directories, and the 2...

CVE-2006-2768

METAjour 2.1 contains a PHP remote file inclusion vulnerability exploitable when register_globals is enabled. An attacker can execute arbitrary PHP code via (1) the system_path parameter in files under app/edocument/, app/eproject/, app/erek/, and extension/ directories, and (2) the GLOBALS[syste...