CVE-2006-4922: Undefined Security Weakness

Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School S@S 2.4.02 and earlier allows remote attackers to upload and execute arbitrary files with executable extensions...

Jupiter CMS 1.1.41.1.5 - modulessearch.php Multiple Cross-Site Scripting Vulnerabilities

Jupiter CMS 1.1.41.1.5 - modulessearch.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20048/info Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, becaus...

CVE-2006-4636: Undefined Security Weakness

Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contai...

CVE-2006-4617: Undefined Security Weakness

Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder...

EZContents 2.0.3 - 'toprated.php?GLOBALS[language_home]' Remote File Inclusion

source: https://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code a...

EZContents 2.0.3 - review_summary.php?GLOBALS[admin_home] Remote File Inclusion

EZContents 2.0.3 - reviewsummary.php?GLOBALSadminhome Remote File Inclusion source: https://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit thes...

CVE-2006-3391: Undefined Security Weakness

The Execute function in iMBCContents ActiveX Control before 2.0.0.59 allows remote attackers to execute arbitrary files via the file URI handler...

PHP Blue Dragon CMS 2.9.1 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/18609/info PHP Blue Dragon CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application. An attacker may leverage these issues to have an arbitrary remote file containing malicio...

[DRUPAL-SA-2006-007] Drupal 4.6.8 / 4.7.2 fixes arbitrary file execution issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-007 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-007 Project: Drupal core and any web app that allows user uploads Date:...

CVE-2006-2743: Undefined Security Weakness

Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with modmime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory...

CVE-2006-2511

The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog...

Advanced Guestbook 2.x - 'Addentry.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/17745/info Advanced GuestBook for phpBB is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file...

CVE-2006-1800: Undefined Security Weakness

Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the glsession cookie of users.php, which is stored in error.log...

CVE-2006-1292: Undefined Security Weakness

Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the phpicalendarcookielanguage and phpicalendarcookiestyle cookies, as...

CVE-2006-1243

CVE-2006-1243 affects Simple PHP Blog (SPB) up to version 0.4.7.1, via install05.php. The vulnerability is a local file inclusion triggered by improper handling of the blog_language parameter, allowing directory traversal and a NUL character to force inclusion of arbitrary local files (demonstrat...

CVE-2006-1083: Undefined Security Weakness

Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. dot dot in the 1 optionlanguage and 2 optiontemplate parameters, and 3 possibly other parameters, to a admin.php and b other unspecified...

CVE-2006-0936: Undefined Security Weakness

Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00...

CVE-2006-0785

Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with 1 '/' slash for an absolute pathname or 2 a drive...

CVE-2006-0785: Undefined Security Weakness

Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with 1 '/' slash for an absolute pathname or 2 a drive...

ImageVue 0.16.1 - 'upload.php' Unrestricted Arbitrary File Upload

source: https://www.securityfocus.com/bid/16594/info ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection. Successful exploitation could allow attackers to upload an...