CVE-2006-0094: Improper Control of Generation of Code

PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the incstat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2006-0064: Improper Control of Generation of Code

PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the globrootDir parameter...

CVE-2005-4424: Undefined Security Weakness

Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. dot dot in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00...

CVE-2005-4031: Undefined Security Weakness

Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function...

CVE-2005-3860: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in athena.php in Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athenadir parameter...

CVE-2004-2602: Undefined Security Weakness

PHP remote file inclusion vulnerability in UberTec Help Center Live HCL before 1.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the HCLpath parameter to pipe.php...

CVE-2005-3859: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter...

CVE-2005-3796: Undefined Security Weakness

Direct static code injection vulnerability in adminoptionsmanage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter. NOTE: it is not clear from the original report whether administrator privileges are required. If not, then this doe...

CVE-2002-2130: Undefined Security Weakness

publishxpdocs.php in Gallery 1.3.2 allows remote attackers to execute arbitrary PHP code by modifying the GALLERYBASEDIR parameter to reference a URL on a remote web server that contains the code...

CVE-2005-2893: Undefined Security Weakness

Direct static code injection vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via the username u parameter, which is directly injected into a file that is later executed upon login...

CVE-2005-2865: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in aMember Pro 2.3.4 allow remote attackers to execute arbitrary PHP code via the configrootdir parameter to 1 mysql.inc.php, 2 efsnet.inc.php, 3 theinternetcommerce.inc.php, 4 cdg.inc.php, 5 compuworld.inc.php, 6 directone.inc.php, 7...

CVE-2005-2782: Undefined Security Weakness

PHP remote file inclusion vulnerability in alinitialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for "http" and "https" URLs...

CVE-2005-2687: Undefined Security Weakness

PHP remote file inclusion vulnerability in SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via the 1 SITEPath parameter to menudx.php or 2 CONTENTSDir parameter to menusx.php...

CVE-2005-2685: Undefined Security Weakness

SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via a direct request to admin/PhpMyExplorer/editerfichier.php, then editing the desired file to contain the PHP code, as demonstrated using header.php in the fichier parameter. NOTE: it is possible that this vulnerability ste...

CVE-2004-2368: Undefined Security Weakness

PHP remote file inclusion vulnerability in header.php in Opt-X 0.7.2 allows remote attackers to execute arbitrary PHP code via the systempath parameter...

CVE-2005-2544: Undefined Security Weakness

PHP remote file inclusion vulnerability in config.php in Comdev eCommerce 3.0 allows remote attackers to execute arbitrary PHP code via the pathdocroot parameter...

FlatNuke < 2.5.6 Multiple Remote Vulnerabilities

The remote host is running FlatNuke, a content management system written in PHP that uses flat files rather than a database for its storage. The version of FlatNuke installed on the remote host suffers from several flaws: - Arbitrary PHP Code Execution Vulnerability The application fails to remov...

CVE-2005-2437: Undefined Security Weakness

Website Baker Project does not properly verify the file extensions of uploaded files, which allows remote attackers to upload and execute arbitrary PHP code...

CVE-2005-2413: Undefined Security Weakness

PHP remote file inclusion vulnerability in apaphpinclude.inc.php in Atomic Photo Album APA allows remote attackers to execute arbitrary PHP code via the apamodulebasedir parameter...

CVE-2005-2412: Undefined Security Weakness

PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include parameter...