CVE-2006-3556: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-3562: Improper Control of Generation of Code

PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the PXconfigmanagerpath parameter to 1 index.php, 2 rss.php, or 3 search.php, a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725...

CVE-2006-3536

Direct static code injection vulnerability in code/classdbtext.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as 1 descripcion and 2 pais, which are stored directly in a PHP script. NOTE: the provenance of this information is unknown;...

CVE-2006-3537: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375...

CVE-2006-3520: Undefined Security Weakness

PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pluginpath0 parameter...

CVE-2006-3530: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in compccookbook/pccookbook.php in the PccookBook Component for Mambo and Joomla 0.3 and possibly up to 1.3.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfigabsolutepath parameter...

Mambo phpBB Component download.php phpbb_root_path Parameter Remote File Inclusion

The remote host is running the phpBB component for Mambo, a web-based bulletin board. The version of the phpBB component for Mambo installed on the remote host fails to sanitize input to the 'phpbbrootpath' parameter of the 'download.php' and other scripts before using it to include PHP code...

CVE-2006-3517: Undefined Security Weakness

PHP remote file inclusion vulnerability in stats.php in RW::Download, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

CVE-2006-3475: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the qbpath parameter to 1 index.php, 2 about.php, 3 contact.php, 4 delete.php, 5 faq.php, 6 features.php or 7 history.php, a different set of vectors than...

Ottoman CMS 1.1.3 - ?default_path Remote File Inclusion (2)

Ottoman CMS 1.1.3 - ?defaultpath Remote File Inclusion 2 !/usr/bin/perl use IO::Socket; Jacek Wlodarczyk j4ck - jacekwloatgmaildotcom Title: Ottoman CMS \r\n"; print "-...

Ottoman CMS <= 1.1.3 (default_path) Remote File Inclusion Exploit

Exploit for unknown platform in category web applications ================================================================= Ottoman CMS = 1.1.3 defaultpath Remote File Inclusion Exploit ================================================================= !/usr/bin/perl use IO::Socket; Jacek Wlodarcz...

Ottoman CMS 1.1.3 - '?default_path=' Remote File Inclusion (2)

!/usr/bin/perl use IO::Socket; Jacek Wlodarczyk j4ck - jacekwloatgmaildotcom Title: Ottoman CMS \r\n"; print "- - Victim's target eg: http://www.victim.com\r\n"; prin...

CVE-2006-3421: Undefined Security Weakness

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in 1 comment.php, 2 admin/comedit.php, 3 admin/test.php, 4 admin/index.php, and 5 admin/include/incadminfoot.php, ...

CVE-2006-3422: Undefined Security Weakness

PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via the configtemplatepath parameter in userbottom.php, as used by multiple templates including 1 rwb template/rwb/userbottom.php, 2 gwb template/rwb/userbottom.php, 3 blues, 4...

CVE-2006-3374

PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attackers to execute arbitrary PHP code via a URL in the incl parameter...

CVE-2006-3361

PHP remote file inclusion vulnerability in Stud.IP 1.3.0-2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the 1 PHPLIBlibdir parameter in studip-phplib/oohforms.inc and 2 ABSOLUTEPATHSTUDIP parameter in studip-htdocs/archivassi.php...

CVE-2006-3381

SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. NOTE: It is uncertain whether this is a vulnerability or a feature of the product...

CVE-2006-3395

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...

CVE-2006-3375: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter...

CVE-2006-3381: Undefined Security Weakness

SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. NOTE: It is uncertain whether this is a vulnerability or a feature of the product...