CVE-2006-3185: Undefined Security Weakness

PHP remote file inclusion vulnerability in data/header.php in CMS Faethon 1.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter...

CVE-2006-3172: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash / character in the 1 langpath parameter to a cms/plugins/colman/column.inc.php, b cms/plugins/poll/poll.inc.php, c...

CVE-2006-3192: Undefined Security Weakness

PHP remote file inclusion vulnerability in Ad Manager Pro 2.6 allows remote attackers to execute arbitrary PHP code via a URL in the 1 ipath parameter in common.php and 2 unspecified vectors in ad.php...

CVE-2006-3158: Undefined Security Weakness

index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypass security checks and upload or execute arbitrary php code via the add action...

CVE-2006-3162: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/incfoot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2006-3136: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIRLIBS parameter in 1 path/action.php, and to files in path/nucleus including 2 media.php, 3 /xmlrpc/server.php, and 4 /xmlrpc/apimetaweblog.inc.php. NOTE: this i...

CVE-2006-3102

Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the modmime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles...

CVE-2006-3107: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 GLOBALSwhereframework to a admin/modules/news/newsclass.php and b admin/modules/content/contentclass.php, and 2...

CVE-2006-3076: Undefined Security Weakness

PHP remote file inclusion vulnerability in softwareupload/publicincludes/pubtemplates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter...

CVE-2006-3045: Undefined Security Weakness

PHP remote file inclusion vulnerability in managesongs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the foingrootpath parameter...

CVE-2006-3019

Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMSINCLUDEPATH parameter to files in parser/include/ including 1 class.parserphpcms.php, 2 class.sessionphpcms.php, 3 class.editphpcms.php, 4...

CVE-2006-3019: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMSINCLUDEPATH parameter to files in parser/include/ including 1 class.parserphpcms.php, 2 class.sessionphpcms.php, 3 class.editphpcms.php, 4...

CVE-2006-3041: Undefined Security Weakness

PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ltwconfigincludedir parameter. NOTE: CVE disputes this claim, since the $ltwconfigincludedir variable is defined as a static...

CVE-2006-3042: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 goinfoispclassesroot parameter in a server.inc.php, and the 2 goinfoserverclassesroot parameter in b app.inc.php, c login.php, and d trylogin.php. NOTE: th...

CVE-2006-3028: Undefined Security Weakness

PHP remote file inclusion vulnerability in statmodules/usersage/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-2908

The domecode function in inc/functionspost.php in MyBulletinBoard MyBB 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a pregreplace function call with a /e executable modifier...

CVE-2006-2982: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems EPS 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in 1 footer.php and 2 admin/footer.php...

CVE-2006-2996: Undefined Security Weakness

PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dirdata parameter...

CVE-2006-2995: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in WebprojectDB 0.1.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INCDIR parameter in 1 include/nav.php and 2 include/lang.php...

CVE-2006-2998: Undefined Security Weakness

PHP remote file inclusion vulnerability in board/post.php in free QBoard 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the qbpath parameter...