CVE-2007-5015: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the slthemeunixpath parameter to 1 adminfooter.php, 2 infofooter.php, 3 themefooter.php, 4 browsefooter.php, 5 accountfooter.php, or 6...

CVE-2007-5009: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in language/langgerman/langmainalbum.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-4935: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 admin.php, 2 custompages.php, 3 draft.php, 4 faq.php, 5 leagues.php, 6 livedraft.php, 7 login.php, 8 myteam.php, 9 profile.php, 10...

CVE-2007-4949: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpReactor 1.2.7pl1 allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to 1 ekilat.com-int.tpl.php, 2 phpreactor.org-top.tpl.php, or 3 ekilat.com-top.tpl.php in examples/. NOTE: this issue has been...

CVE-2007-4954: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic comjoom12pic 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-4950: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in form/dbform/employee.php in PHPortal 0.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter. NOTE: this issue is disputed by CVE, since DOCUMENTROOT cannot be modified by an attacker...

CVE-2007-4921: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/settings.inc.php in Ajax File Browser 3 Beta allows remote attackers to execute arbitrary PHP code via a URL in the approot parameter...

CVE-2007-4923: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 comjoomlaradiov5 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-4834: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpRealty 0.02 allow remote attackers to execute arbitrary PHP code via a URL in the MGR parameter to 1 index.php, 2 pins.php, and 3 uins.php in manager/admin/...

CVE-2007-4806: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter...

CVE-2007-4757: Improper Input Validation

PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functionsfile parameter...

CVE-2007-4763: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in dbmodules/DBadodb.class.php in PHP Object Framework PHPOF 20040226 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHPOFINCLUDEPATH parameter...

CVE-2007-4737: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library STPHPLibrary 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIBDIR parameter to 1 stphpapplication.php, 2 stphpbtnimage.php, or 3 stphpform.php...

CVE-2007-4738: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library STPHPLibrary 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 dbconf or 2 ADODBDIR parameter to utils/stphpimageshow.php; or a URL in the STPHPLIBDIR parameter to 3 stphpbutton.php, 4...

CVE-2007-4715: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code via a URL in the filesdir parameter in 1 esdesp.php, 2 escustommenu.php, and 3 esoffer.php...

CVE-2007-4606: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in convert/mvcwconver.php in the Virtual War VWar module for PHPNuke-Clan PNC 4.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter, a different vector than CVE-2006-1602. NOTE: it is possible that this...

CVE-2007-4608: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in protection.php in ePersonnel RC200402 allows remote attackers to execute arbitrary PHP code via a URL in the logoutpage parameter...

CVE-2007-4536: Undefined Security Weakness

TorrentTrader 1.07 and earlier sets insecure permissions for files in the root directory, which allows attackers to execute arbitrary PHP code by modifying 1 disclaimer.txt, 2 sponsors.txt, and 3 banners.txt, which are used in an include call. NOTE: there might be local attack vectors that extend...

CVE-2007-4524: Undefined Security Weakness

PHP remote file inclusion vulnerability in adisplay.php in PhPress 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter...

CVE-2007-4525: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squelettecache parameter, a different vector than CVE-2006-1702. NOTE: this issue has been disputed by third party researchers, stating that the...