CVE-2010-2918: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites comjoomla-visites component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2010-2681: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in the SEF404x comsef component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to index.php...

CVE-2010-2341: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in system/application/views/public/commentform.php in EZPX Photoblog 1.2 beta allows remote attackers to execute arbitrary PHP code via a URL in the tplbasedir parameter...

CVE-2010-2315: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in picturelib.php in SmartISoft phpBazar 2.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cat parameter...

CVE-2010-2314: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in nucleus/plugins/NPTwitter.php in the NPTwitter Plugin 0.8 and 0.9 for Nucleus, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DIRPLUGINS parameter. NOTE: some of these details are obtained from thi...

CVE-2010-1514: Undefined Security Weakness

Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an image file, and then accessing it via a direct request to the file in an unspecified directory...

CVE-2010-2145: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the csbasepath parameter to 1 docs.php and 2 include/admin/deviceadmin.php. NOTE: the header.php vector is already covered by...

CVE-2010-2137: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2010-2126: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the cfgadminpath parameter to 1 index.php, 2 view.php, 3 image.php, 4 search.php, 5 admin/index.php, 6 admin/gallery/index.php, 7 admin/gallery/view.php, 8...

CVE-2010-2005: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in DataLife Engine DLE 8.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the selectedlanguage parameter to engine/inc/include/init.php, 2 the configlangs parameter to engine/inc/help.php, 3 the configlang parameter to...

CVE-2010-1946: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 autorisationnormale.class.php, 2 collectivite.class.php, 3 dossier.class.php, 4...

CVE-2010-1945: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in openMairie Openfoncier 2.00, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 action.class.php, 2 architecte.class.php, 3 avis.class.php, 4 bible.class.php, and 5...

CVE-2010-1921: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 annuaire.class.php, 2 droit.class.php, 3 collectivite.class.php, 4 profil.class.php, 5...

CVE-2009-4779: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in NukeHall 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter to 1 blocks.php, 2 messages.php, and 3 stories.php in admin/modules/...

CVE-2009-4789: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 wp-comments-post.php and 2 wp-trackback.php...

CVE-2010-1467: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 collectivite.class.php, 2 injection.class.php, 3 utilisateur.class.php, 4 droit.class.php, 5 laboratoire.class.php, 6...

CVE-2010-1299: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magicquotesgpc is disabled and registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 DefineRootToTool parameter to counter.php, 2 PathToRoot parameter to...

CVE-2010-1114: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pg parameter to index.php and the 2 path parameter to news/form.php...

CVE-2010-1055: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magicquotesgpc is disabled and registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the configforuminstalled parameter to 1 forum/adminLogin.php and 2 forum/userLogin.php...

CVE-2009-4693: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in GraFX MiniCWB 2.3.0 allow remote attackers to execute arbitrary PHP code via a URL in the LANG parameter to 1 en.inc.php, 2 hu.inc.php, 3 no.inc.php, 4 ro.inc.php, and 5 ru.inc.php in language/...