CVE-2006-4649: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in bpnews.php in BinGo News BP News 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter...

CVE-2006-4630: Undefined Security Weakness

PHP remote file inclusion vulnerability in jscript.php in Sky GUNNING MySpeach 3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mymsroot parameter...

CVE-2006-4609: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Content Management module "Content manager" for PHProjekt 0.6.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the pathpre parameter in 1 cmlib.inc.php, 2 doc/br.edithelp.php, 3...

CVE-2006-4610: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter...

CVE-2006-4618: Undefined Security Weakness

PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODBDIR parameter...

CVE-2006-4621: Undefined Security Weakness

PHP remote file inclusion vulnerability in settings.php in Pheap 1.2, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. The...

CVE-2006-4559: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System YACS CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the contextpathtoroot parameter in 1 articles/populate.php, 2 categories/category.php, 3 categories/populate.php, 4...

CVE-2006-4556: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in the JIM component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: another researcher has stated that the product distribution does not include an index.php...

CVE-2006-4591: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the configtemplatepath parameter to 1 payment/paymentresult.php or 2 /payment/spuserresult.php...

CVE-2006-4544: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...

CVE-2006-4557: Undefined Security Weakness

PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter. NOTE: another researcher has stated that an attacker cannot control the type parameter. As of 20060901, CVE analysis...

CVE-2006-4533: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the PXconfigmanagerpath parameter to 1 articles.php, 2 categories.php, 3 news.php, 4 prefs.php, 5 sites.php, 6 subtypes.php, 7 users.php, 8 xmedia.php, 9...

CVE-2006-4532: Undefined Security Weakness

PHP remote file inclusion vulnerability in articles/article.php in Yet Another Community System YACS CMS 6.6.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the contextpathtoroot parameter...

CVE-2006-4531: Undefined Security Weakness

PHP remote file inclusion vulnerability in lib/config.php in Pheap CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter...

CVE-2006-4498: Undefined Security Weakness

PHP remote file inclusion vulnerability in sommaireadmin.php in PhpAlbum modphpalbum 2.15 for PortailPHP allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter, a different vector than CVE-2006-3922...

CVE-2006-4489: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in MiniBill 2006-07-14 1.2.2 allow remote attackers to execute arbitrary PHP code via 1 a URL in the configincludedir parameter in actions/ipn.php or 2 an FTP path in the configplugindir parameter in include/initPlugins.php...

CVE-2006-4452: Undefined Security Weakness

PHP remote file inclusion vulnerability in security/include/class.security.php in Web3news 0.95 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PHPSECURITYADMINPATH parameter...

CVE-2006-4424: Undefined Security Weakness

PHP remote file inclusion vulnerability in coinincludes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the CCFGPKGPATHINCL parameter...

CVE-2006-4441: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Ay System Solutions CMS 2.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathShowProcessHandle parameter to 1 home.php or 2 impressum.php. NOTE: the provenance of this information is unknown; the details ar...

CVE-2006-4429: Undefined Security Weakness

PHP remote file inclusion vulnerability in handlers/email/mod.output.php in PHlyMail Lite 3.4.4 and earlier Build 3.04.04 allows remote attackers to execute arbitrary PHP code via a URL in the PMpathhandler parameter, a different vector than CVE-2006-4291. NOTE: This issue has been disputed by a...