CVE-2007-5409: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/nuseoadmind.php in NuSEO PHP Enterprise 1.6 NuSEO.PHP, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the nuseodir parameter...

CVE-2007-5389: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in preview.php in the swMenuFree comswmenufree 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: a reliable third party disputes this issue because preview.php tests a...

CVE-2007-5410: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader comwmtrssreader 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-5362: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

CVE-2007-5313: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2007-5305: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 contenus parameter to a contenus.php; the 2 tpelseifportalrepertoire parameter to b votes.php, c espaceperso.php, d enregistrement.php, e...

CVE-2007-5309: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery comwmtgallery 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-5307: Improper Control of Generation of Code

ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php. NOTE: it coul...

CVE-2007-5298: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the cfgdocumenturi parameter to 1 administration/securite.php and 2 administration/gestionconfigurations/saveconfig.php...

CVE-2007-5271: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the bFieldbfdata parameter to 1 interface/editors/-custom.php or 2 interface/editors/custom.php...

CVE-2007-5221: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the form parameter...

CVE-2007-5216: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in eArk e-Ark 1.0 allow remote attackers to execute arbitrary PHP code via a URL in 1 the cfgvcardpath parameter to src/vcardinc.php or 2 the cfgphpmailerpath parameter to src/emailinc.php. NOTE: the arkinc.php vector is already covered by...

CVE-2007-5175: Improper Control of Generation of Code

PHP remote file inclusion vulnerability lib/base.php in actSite 1.991 Beta allows remote attackers to execute arbitrary PHP code via a URL in the BaseCfgBaseDir parameter...

CVE-2007-5186: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute...

CVE-2007-5173: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openidrootpath parameter...

CVE-2007-5178: Improper Control of Generation of Code

contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2007-5167: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nomrepsysteme parameter...

CVE-2007-5147: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Puzzle Apps CMS 2.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the MODULEDIR parameter to 1 core/modules/my/my.module.php or 2 core/modules/xml/xml.module.php; the COREROOT parameter to 3 config.loader.php, 4...

CVE-2007-5157: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in phfito-post.php in Alex Kocharin PHP Fidonet Tosser PhFiTo 1.3.0 in phpFidoNode allows remote attackers to execute arbitrary PHP code via a URL in the SRCPATH parameter to phfito-post...

CVE-2007-5160: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Thierry Leriche Restaurant Management System ReMaSys 0.5 allow remote attackers to execute arbitrary PHP code via a URL in 1 the DIRROOT parameter to a global.php, or the 2 DIRPAGE parameter to b template/fr/page.php or c...