e107 ibrowser.php zend_has_del() Function Remote Code Execution

The 'e107handlers/tinymce/plugins/ibrowser/ibrowser.php' script included with the version of e107 installed on the remote host contains a programming flaw that may allow an unauthenticated, remote attacker to execute arbitrary PHP code on the affected host, subject to the privileges of the web...

TikiWiki jhot Remote Command Execution

TikiWiki contains a flaw that may allow a malicious user to execute arbitrary PHP code. The issue is triggered due to the jhot.php script not correctly verifying uploaded files. It is possible that the flaw may allow arbitrary PHP code execution by uploading a malicious PHP script resulting in a...

CVE-2006-4530

Direct static code injection vulnerability in include/change.php in membrepass 1.5 allows remote attackers to execute arbitrary PHP code via the aifon parameter, which is injected into include/variable.php...

CVE-2006-4533: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the PXconfigmanagerpath parameter to 1 articles.php, 2 categories.php, 3 news.php, 4 prefs.php, 5 sites.php, 6 subtypes.php, 7 users.php, 8 xmedia.php, 9...

CVE-2006-4532: Undefined Security Weakness

PHP remote file inclusion vulnerability in articles/article.php in Yet Another Community System YACS CMS 6.6.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the contextpathtoroot parameter...

CVE-2006-4531: Undefined Security Weakness

PHP remote file inclusion vulnerability in lib/config.php in Pheap CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter...

CVE-2006-4498: Undefined Security Weakness

PHP remote file inclusion vulnerability in sommaireadmin.php in PhpAlbum modphpalbum 2.15 for PortailPHP allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter, a different vector than CVE-2006-3922...

CVE-2006-4489: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in MiniBill 2006-07-14 1.2.2 allow remote attackers to execute arbitrary PHP code via 1 a URL in the configincludedir parameter in actions/ipn.php or 2 an FTP path in the configplugindir parameter in include/initPlugins.php...

CVE-2006-4451

Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the 1 User-Agent HTTP header in tag.php, which is executed by all.php, and 2 the banned parameter in adminindex.php...

CVE-2006-4451

Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the 1 User-Agent HTTP header in tag.php, which is executed by all.php, and 2 the banned parameter in adminindex.php...

CVE-2006-4452: Undefined Security Weakness

PHP remote file inclusion vulnerability in security/include/class.security.php in Web3news 0.95 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PHPSECURITYADMINPATH parameter...

CVE-2006-4425

CVE-2006-4425 affects the phpCOIN 1.2.3 package. Multiple remote file inclusion weaknesses allow an unauthenticated, remote attacker to cause code execution by manipulating the _CCFG[_PKG_PATH_INCL] parameter in seven coin_includes scripts (api.php, common.php, core.php, custom.php, db.php, redir...

CVE-2006-4424: Undefined Security Weakness

PHP remote file inclusion vulnerability in coinincludes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the CCFGPKGPATHINCL parameter...

CVE-2006-4441: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Ay System Solutions CMS 2.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathShowProcessHandle parameter to 1 home.php or 2 impressum.php. NOTE: the provenance of this information is unknown; the details ar...

CVE-2006-4429: Undefined Security Weakness

PHP remote file inclusion vulnerability in handlers/email/mod.output.php in PHlyMail Lite 3.4.4 and earlier Build 3.04.04 allows remote attackers to execute arbitrary PHP code via a URL in the PMpathhandler parameter, a different vector than CVE-2006-4291. NOTE: This issue has been disputed by a...

CVE-2006-4445: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter to 1 shownews.php or 2 search.php. NOTE: CVE analysis as of 20060829 has not identified any scenarios in which these vectors could result i...

CVE-2006-4422: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/phpdig/libs/searchfunction.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the relativescriptpath parameter, a different vector than CVE-2006-2270. NOTE: this issue has been disputed, and as of 20060830,...

CVE-2006-4423: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Bigace 1.8.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSBIGACEDIRadmin parameter in a system/command/admin.cmd.php, b admin/include/uploadform.php, and c admin/include/itemmain.php; and the 2...

CVE-2006-4363

PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component comcropimage 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter...

CVE-2006-4373

PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the lvcincludedir parameter...