CVE-2006-2888: Undefined Security Weakness

PHP remote file inclusion vulnerability in wk/wklang.php in Wikiwig 4.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the WKwkPath parameter...

CVE-2006-2878: Undefined Security Weakness

The spellchecker spellcheck.php in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by pregreplace with the /e executable modifier...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via a URL in the bhconfigbhfilepath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...

Remote file inclusion

PHP remote file inclusion vulnerability in config.php in Rumble 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the configArrpathtodir parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the includePath cookie to 1 auth/extauth/drivers/mambo.inc.php or 2 auth/extauth/drivers/postnuke.inc.php...

CVE-2006-2842: Undefined Security Weakness

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by...

CVE-2006-2863: Undefined Security Weakness

PHP remote file inclusion vulnerability in class.csphpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the classesdir parameter...

CVE-2006-2864: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrary PHP code via a URL in the 1 APPpathapplications parameter to a BsFaq.class.php, 2 APPpathcore parameter to b fileBrowserInner.php, c file.php, and d viewer.php, and e...

CVE-2006-2866: Undefined Security Weakness

PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...

CVE-2006-2860: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 inc/logincheck.inc.php, 2 inc/adminheader.inc.php, 3 inc/global.php, or 4 inc/mainheader.inc.php. NOTE: some of these vectors were also...

CVE-2006-2845: Undefined Security Weakness

PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REXINCLUDEPATH parameter to imageresize/pages/index.inc.php...

CVE-2006-2844: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REXINCLUDEPATH parameter to 1 simpleuser/pages/index.inc.php and 2 stats/pages/index.inc.php...

CVE-2006-2859: Undefined Security Weakness

PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggierootpath parameter to 1 admin.php or 2 scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBlogg...

CVE-2006-2871: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/common.php in CyBoards PHP Lite 1.25 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter. NOTE: CVE disputes this issue, since $scriptpath is set to a constant value...

Remote file inclusion

PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFlocalpath parameter...

[SA20438] BlueShoes Framework Multiple File Inclusion Vulnerabilities

---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...

CVE-2006-2811: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in 1 index.php, 2 topman.php, 3 approb.php, 4 vacadmb.php, 5 vacadma.php, 6 vacadm.php, 7 statart.php, 8 search.php, 9...

CVE-2006-2819: Undefined Security Weakness

PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cnodeclasspath parameter...

SquirrelMail plugin.php plugins Parameter Local File Inclusion

The version of SquirrelMail installed on the remote web server fails to properly sanitize user-supplied input to the 'plugins' parameter of the 'functions/plugin.php' script before using it in a PHP 'includeonce' function. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated...