CVE-2009-4693: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in GraFX MiniCWB 2.3.0 allow remote attackers to execute arbitrary PHP code via a URL in the LANG parameter to 1 en.inc.php, 2 hu.inc.php, 3 no.inc.php, 4 ro.inc.php, and 5 ru.inc.php in language/...

CVE-2010-0755: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute arbitrary PHP code via a URL in the langFile parameter...

CVE-2010-0678: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includesdirectory parameter...

CVE-2009-4622: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/adminnewsbot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter, a different vector than CVE-2007-0572...

CVE-2009-4614: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the MOAPATH parameter to 1 errorfuncs.php, 2 integrityfuncs.php, 3 templatecomponentadmin.php, 4 templatecomponentgallery.php, 5 templateparser.php...

CVE-2009-4623: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACSpath parameter to 1 index.php and 2 admin.php in advancedcommentsystem/. NOTE: this might only be a vulnerability when the administrator has n...

CVE-2009-4541: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to 1 newticket.php or 2 rempass.php, or a URL in the lang parameter in an adduser action to 3 index.php. NOTE: this can also be...

CVE-2009-4543: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. dot dot sequences...

CVE-2009-4471: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CLASSPATH parameter to 1 bibform.php, 2 bibpldetails.php, 3 bibplform.php, 4 bibplsearchc.php, 5 bibplsearchs.php, 6 bibsave.php, 7...

CVE-2009-4319: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BBCODEpath parameter...

CVE-2009-4106: Improper Input Validation

Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters...

WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

No description provided by source. ============================================= - Release date: November 11th, 2009 - Discovered by: Dawid Golunski - Severity: Moderately High ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.5 Unrestricted...

CVE-2009-3817: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary combooklibrary component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter, a different vector than CVE-2009-2637. NOTE: the provenance of this...

CVE-2009-3760: Improper Control of Generation of Code

Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party...

CVE-2009-3660: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow...

CVE-2009-3511: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fsjVroot parameter to 1 sites/site/pages/index.php, 2 sites/test/pages/contact.php, 3 system/pageTemplate.php, and 4 system/utilities.php...

CVE-2009-3492: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to 1 Calendar.php, 2 Comment.php, 3 Rss.php and 4 Trackback.php in lib/Loggix/Module/; and 5...

CVE-2009-3424: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 isprojectPath parameter to includes/InstantSite/inc.isroot.php; GLOBALSthCMSroot parameter to 2 classes/class.Tree.php, 3...

CVE-2009-3426: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/filemanager/special.php in MaxCMS 3.11.20b allows remote attackers to execute arbitrary PHP code via a URL in the fmincludesspecial parameter...

CVE-2009-3307: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the FSPHPLIB parameter to 1 FSphp.php, 2 navigation.php, and 3 pathwrite.php in lib/...