CVE-2006-3363: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3395: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...

CVE-2006-3340: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the 1 phpbbrootpath parameter in a includes/functionscms.php and the 2 GlobalSettingstemplatesDirectory parameter i...

StudIP1302.txt

/------------------------------------------------ IHS Public advisory -------------------------------------------------/ Stud.IP Remote File Inclusion Stud.IP is a learning and an information management system for universities, educational facilities and enterprises. http://www.studip.de...

CVE-2006-3323: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page parameter. NOTE: the same vector can be used for cross-site scripting, but CVE analysis suggests that this is resultant from file inclusion of HTML or...

CVE-2006-3302: Undefined Security Weakness

PHP remote file inclusion vulnerability in modcbsms.php in CBSMS Mambo Module 1.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosCapath parameter. NOTE: the provenance of this information is unknown; portions of the details...

CVE-2006-3294: Undefined Security Weakness

PHP remote file inclusion vulnerability in modcbsmsmessages.php in CBSMS Mambo Module 1.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-3315: Undefined Security Weakness

PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the osCsid parameter...

CVE-2006-3269: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/functionscms.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary PHP code via the phpbbrootpath parameter...

CVE-2006-3173

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pathcb parameter to a libraries/comment/postComment.php and b modules/poll/poll.php, 2 rel parameter to c modules/archive/overview.inc.php, and the 3...

CVE-2006-3193: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 includes/content/contactcontent.php; multiple files in adminpanel/includes/addforms/...

CVE-2006-3175: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to 1 admin.php, 2 ecrire.php, and 3 lire.php. NOTE: it was later reported that the ecrire.php vector also affects 1.2. NOTE: this issue might ...

CVE-2006-3172: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash / character in the 1 langpath parameter to a cms/plugins/colman/column.inc.php, b cms/plugins/poll/poll.inc.php, c...

CVE-2006-3192: Undefined Security Weakness

PHP remote file inclusion vulnerability in Ad Manager Pro 2.6 allows remote attackers to execute arbitrary PHP code via a URL in the 1 ipath parameter in common.php and 2 unspecified vectors in ad.php...

CVE-2006-3177: Undefined Security Weakness

PHP remote file inclusion vulnerability in Admin/rtfparser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter...

CVE-2006-3185: Undefined Security Weakness

PHP remote file inclusion vulnerability in data/header.php in CMS Faethon 1.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter...

CVE-2006-3158: Undefined Security Weakness

index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypass security checks and upload or execute arbitrary php code via the add action...

CVE-2006-3162: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/incfoot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2006-3136: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIRLIBS parameter in 1 path/action.php, and to files in path/nucleus including 2 media.php, 3 /xmlrpc/server.php, and 4 /xmlrpc/apimetaweblog.inc.php. NOTE: this i...

CVE-2006-3102

Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the modmime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles...