CVE-2007-5389: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in preview.php in the swMenuFree comswmenufree 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: a reliable third party disputes this issue because preview.php tests a...

CVE-2007-5412: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass commp3allopass 1.0 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter to 1 allopass.php and 2 allopass-error.php...

CVE-2007-5409: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/nuseoadmind.php in NuSEO PHP Enterprise 1.6 NuSEO.PHP, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the nuseodir parameter...

CVE-2007-5410: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader comwmtrssreader 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-5387: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in active/components/xmlrpc/client.php in Pindorama 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ccomponents parameter...

CVE-2007-5362: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion

PicoFlat CMS Remote file inclusion f0und bY 0in download:http://sourceforge.net/project/showfiles.php?groupid=195156&packageid=230351&releaseid=533796 Greetings to:Dark-coders team members: Die-angel,Slim,Umbro Others: Joker186,Kaja,Wojto111,Rade0n And funny n00b-firends: Pucik and Steryd ; FUN B...

CVE-2007-5314

PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PEARPATH parameter...

Command injection

ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php. NOTE: it coul...

CVE-2007-5294

PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta aka Phoenix allows remote attackers to execute arbitrary PHP code via a URL in the siteabsolutepath parameter...

CVE-2007-5298: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the cfgdocumenturi parameter to 1 administration/securite.php and 2 administration/gestionconfigurations/saveconfig.php...

CVE-2007-5305: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 contenus parameter to a contenus.php; the 2 tpelseifportalrepertoire parameter to b votes.php, c espaceperso.php, d enregistrement.php, e...

CVE-2007-5307: Improper Control of Generation of Code

ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php. NOTE: it coul...

CVE-2007-5313: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2007-5309: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery comwmtgallery 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-5271: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the bFieldbfdata parameter to 1 interface/editors/-custom.php or 2 interface/editors/custom.php...

CVE-2007-5221: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the form parameter...

CVE-2007-5216: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in eArk e-Ark 1.0 allow remote attackers to execute arbitrary PHP code via a URL in 1 the cfgvcardpath parameter to src/vcardinc.php or 2 the cfgphpmailerpath parameter to src/emailinc.php. NOTE: the arkinc.php vector is already covered by...

CVE-2007-5178

contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2007-5173: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openidrootpath parameter...