FreeBSD : phpbb -- NULL byte injection vulnerability (86526ba4-53c8-11db-8f1a-000a48049292)

Secunia reports : ShAnKaR has discovered a vulnerability in phpBB, which can be exploited by malicious users to compromise a vulnerable system. Input passed to the 'avatarpath' parameter in admin/adminboard.php is not properly sanitised before being used as a configuration variable to store avata...

CVE-2006-5167: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in BasiliX 1.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 BSXLIBDIR parameter in scripts in /files/ including a abook.php3, b compose-attach.php3, c compose-menu.php3, d compose-new.php3, e...

CVE-2006-5165: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/functions.inc.php in Skrypty PPA Gallery 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the configpparootpath parameter...

CVE-2006-5155: Undefined Security Weakness

PHP remote file inclusion vulnerability in core/pdf.php in VideoDB 2.2.1 and earlier allows remote attackers to execute arbitrary PHP code via the configpdfmodule parameter...

CVE-2006-5154: Undefined Security Weakness

PHP remote file inclusion vulnerability in cp/sig.php in DeluxeBB 1.09 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the templatefolder parameter...

CVE-2006-5126

PHP remote file inclusion vulnerability in index.php in John Himmelman aka DaRk2k1 PowerPortal 1.3a allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter...

CVE-2006-5141: Undefined Security Weakness

PHP remote file inclusion vulnerability in script.php in Kevin A. Gordon Open Geo Targeting aka geotarget allows remote attackers to execute arbitrary PHP code via a URL in the anppath parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-5135: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 openbox, 2 middlebox, and 3 closebox parameters in a sources/myaccount.php; the 4 navigationend parameter in b navigation/search.php and c navigation/donation.php...

CVE-2006-5132: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in phpMyAgenda 3.0 Final and earlier allow remote attackers to execute arbitrary PHP code via a URL in the rootagenda parameter to 1 agendaplace.php3, 2 agendaplace2.php3, 3 infoevent.php3, and 4 agenda2.php3, different vectors than CVE-2006-2009...

CVE-2006-5147: Undefined Security Weakness

PHP remote file inclusion vulnerability in wampdir/setup/yesno.phtml in VAMP Webmail 2.0beta1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the nourl parameter...

CVE-2006-5118: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php3 in the PDD package for PHPSelect Web Development Division allows remote attackers to execute arbitrary PHP code via a URL in the ApplicationRoot parameter...

CVE-2006-5136: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ubbt.inc.php in Groupee UBB.threads 6.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSthispath or 2 GLOBALSconfigdir parameter...

CVE-2006-5123: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Albrecht Guenther PHProjekt 5.1.x before 5.1.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 libpath or 2 langpath parameter in unspecified files, related to code changes intended to fix inclusion, a different...

CVE-2006-5101: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in 1 Comdev Contact Form 3.1, 2 Comdev Customer Helpdesk 3.1, 3 Comdev Events Calendar 3.1, 4 Comdev FAQ Support 3.1, 5 Comdev Guestbook 3.1, 6 Comdev Links Directory 3.1, 7 Comdev News...

CVE-2006-5148: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the repertorylevel parameter including scripts in /forum/ including 1 search.php, 2 message.php, 3 member.php, 4 mail.php, 5 lostpassword.php, 6...

CVE-2006-5102: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/editfunc.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.42 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NWCONFSYSTEMserverpath parameter...

CVE-2006-5103: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/index2.php in bbsNew 2.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the "right" parameter...

CVE-2006-5124: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 target and 2 action parameters in window.php, and possibly the 3 target parameter in home.php...

CVE-2006-5100: Undefined Security Weakness

PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS aka webnews 1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the WNBASEDIR parameter...

CVE-2006-5093

PHP remote file inclusion vulnerability in index.php in Tagmin Control Center in TagIt! Tagboard 2.1.B Build 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...