CVE-2007-5178: Improper Control of Generation of Code

contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2007-5175: Improper Control of Generation of Code

PHP remote file inclusion vulnerability lib/base.php in actSite 1.991 Beta allows remote attackers to execute arbitrary PHP code via a URL in the BaseCfgBaseDir parameter...

CVE-2007-5186: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/functions/layout.php in Nexty 1.01.A Beta allows remote attackers to execute arbitrary PHP code via a URL in the rel parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct...

CVE-2007-5167

PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nomrepsysteme parameter...

CVE-2007-5157: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in phfito-post.php in Alex Kocharin PHP Fidonet Tosser PhFiTo 1.3.0 in phpFidoNode allows remote attackers to execute arbitrary PHP code via a URL in the SRCPATH parameter to phfito-post...

CVE-2007-5156: Undefined Security Weakness

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

CVE-2007-5167: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nomrepsysteme parameter...

CVE-2007-5166: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SiteSys 1.0a allow remote attackers to execute arbitrary PHP code via a URL in the docroot parameter to 1 inc/pagehead.inc.php or 2 inc/pageinit.inc.php...

CVE-2007-5146: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedipath parameter to 1 inc.generatecode.php, 2 fnc.typeforms.php, or 3 fnc.type.php in backend/inc/, or 4 frontend.php or 5 backend.php in...

CVE-2007-5147: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Puzzle Apps CMS 2.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the MODULEDIR parameter to 1 core/modules/my/my.module.php or 2 core/modules/xml/xml.module.php; the COREROOT parameter to 3 config.loader.php, 4...

CVE-2007-5160: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Thierry Leriche Restaurant Management System ReMaSys 0.5 allow remote attackers to execute arbitrary PHP code via a URL in 1 the DIRROOT parameter to a global.php, or the 2 DIRPAGE parameter to b template/fr/page.php or c...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/archive/archivetopic.php in IntegraMOD Nederland 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-5139: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter...

CVE-2007-5117: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in FrontAccounting FA 1.13, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathtoroot parameter to 1 access/login.php and 2 includes/lang/language.php, different vectors than CVE-2007-4279...

CVE-2007-5114

PHP remote file inclusion vulnerability in include/plugin/block.t.php in Peter Schmidt phpmyProfiler 0.9.6b allows remote attackers to execute arbitrary PHP code via a URL in the pmprelpath parameter. NOTE: this issue is disputed by CVE because the applicable requireonce is in a function that is...

Remote file inclusion

PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2007-5100

Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter to 1 language/langgerman/langadminalbum.php, 2...

CVE-2007-5098: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the setdepth parameter to 1 app.lib/product.control/core.php/product.control.config.php, or 2 customer.browse.list.p...

CVE-2007-5097: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in lib/classes/offlnflteam.php in Online Fantasy Football League OFFL 0.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the DOCROOT parameter. NOTE: this issue is disputed by CVE because a FILE test protects offlnflteam.php against...