CVE-2006-4422: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/phpdig/libs/searchfunction.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the relativescriptpath parameter, a different vector than CVE-2006-2270. NOTE: this issue has been disputed, and as of 20060830,...

CVE-2006-4423: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Bigace 1.8.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSBIGACEDIRadmin parameter in a system/command/admin.cmd.php, b admin/include/uploadform.php, and c admin/include/itemmain.php; and the 2...

CVE-2006-4445: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter to 1 shownews.php or 2 search.php. NOTE: CVE analysis as of 20060829 has not identified any scenarios in which these vectors could result i...

CVE-2006-4378: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Rssxt component for Joomla! comrssxt, possibly 2.0 Beta 1 or 1.0 and earlier, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter in 1 pinger.php, 2 RPC.php, or 3 rssxt.php. NOTE: another...

CVE-2006-4375: Undefined Security Weakness

PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD ContXTD component for Mambo comcontxtd allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: another researcher has disputed this issue, saying that the softwar...

CVE-2006-4357: Undefined Security Weakness

PHP remote file inclusion vulnerability in clients/index.php in Diesel Smart Traffic allows remote attackers to execute arbitrary PHP code via a URL in the src parameter...

CVE-2006-4363: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component comcropimage 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter...

CVE-2006-4321: Undefined Security Weakness

PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component comcpg 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4329: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Shadows Rising RPG Pre-Alpha 0.0.5b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFIGgameroot parameter to 1 core/includes/security.inc.php, 2 core/includes/smarty.inc.php, 3 qcms/includes/smarty.inc.php ...

CVE-2006-4322: Undefined Security Weakness

PHP remote file inclusion vulnerability in estateagent.php in the EstateAgent component comestateagent for Mambo, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4320: Undefined Security Weakness

PHP remote file inclusion vulnerability in sef.php in the OpenSEF 2.0.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4311: Undefined Security Weakness

PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1Adressbuch/delete.php...

CVE-2006-4283: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in SOLMETRA SPAW Editor 1.0.6 and 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the spawdir parameter in dialogs/ scripts including 1 a.php, 2 collorpicker.php, 3 img.php, 4 imglibrary.php, 5 table.php, or 6 td.php...

CVE-2006-4287: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 phphtmllib parameter to a phphtmllib/includes.php; tagutils/ scripts including b divtagutils.php, c formutils.php, d...

CVE-2006-4242: Undefined Security Weakness

PHP remote file inclusion vulnerability in install.jim.php in the JIM 1.0.1 component for Joomla or Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4269: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component comx-shop 1.7 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: this issue has been disputed by third party researchers...

CVE-2006-4236: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in POWERGAP allow remote attackers to execute arbitrary PHP code via a URL in the 1 shopid parameter to a s01.php, b s02.php, c s03.php, and d s04.php; and possibly a URL located after "shopid=" or "sid=" in the PATHINFO...

CVE-2006-4277: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIBDIR parameter to 1 include/novalib/class.novaAdmin.mysql.php and 2 novalib/class.novaRead.mysql.php. NOTE: the provenance of this information...

CVE-2006-4270: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in mambelfish.class.php in the mambelfish component commambelfish 1.1 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4240: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Fusion News 3.7 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter...