CVE-2010-2341

PHP remote file inclusion vulnerability in system/application/views/public/commentform.php in EZPX Photoblog 1.2 beta allows remote attackers to execute arbitrary PHP code via a URL in the tplbasedir parameter...

CVE-2010-2341: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in system/application/views/public/commentform.php in EZPX Photoblog 1.2 beta allows remote attackers to execute arbitrary PHP code via a URL in the tplbasedir parameter...

CVE-2010-2315: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in picturelib.php in SmartISoft phpBazar 2.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cat parameter...

CVE-2010-2314: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in nucleus/plugins/NPTwitter.php in the NPTwitter Plugin 0.8 and 0.9 for Nucleus, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DIRPLUGINS parameter. NOTE: some of these details are obtained from thi...

CVE-2010-1514: Undefined Security Weakness

Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an image file, and then accessing it via a direct request to the file in an unspecified directory...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in a binnincludepath cookie. NOTE: this can also be leveraged to include and execute arbitrary local files...

Snipe Gallery 'cfg_admin_path' Multiple Remote File Include Vulnerabilities

The host is running Snipe Gallery and is prone to multiple remote file include vulnerabilities. OpenVAS Vulnerability Test $Id: gbsnipegalleryremotefileincludevuln.nasl 5373 2017-02-20 16:27:48Z teissa $ Snipe Gallery 'cfgadminpath' Multiple Remote File Include Vulnerabilities Authors: Sooraj KS...

DDLCMS 2.1 - 'skin' Remote File Inclusion

============================================================== DDLCMS v2.1 skin Remote File Inclusion Vulnerability ============================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ ...

CVE-2010-2145: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the csbasepath parameter to 1 docs.php and 2 include/admin/deviceadmin.php. NOTE: the header.php vector is already covered by...

GLSA-201006-13 : Smarty: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201006-13 Smarty: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Smarty: The vendor reported that the modifier.regexreplace.php plug-in contains an input sanitation flaw related to the ASCII NUL characte...

CVE-2010-2137: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2010-2126: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the cfgadminpath parameter to 1 index.php, 2 view.php, 3 image.php, 4 search.php, 5 admin/index.php, 6 admin/gallery/index.php, 7 admin/gallery/view.php, 8...

Design/Logic Flaw

bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method...

Open-AudIT include_lang.php language Parameter Traversal Local File Inclusion

The web server hosts Open-AudIT, an open source network auditing application written in PHP. At least one install of Open-AudIT on the remote host fails to sanitize user-supplied input to the 'language' parameter before using it in 'includelang.php' to include PHP code. Regardless of PHP's...

CVE-2010-1546

Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...

CVE-2010-1546

Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...

CVE-2010-2005: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in DataLife Engine DLE 8.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the selectedlanguage parameter to engine/inc/include/init.php, 2 the configlangs parameter to engine/inc/help.php, 3 the configlang parameter to...

CVE-2010-1946: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 autorisationnormale.class.php, 2 collectivite.class.php, 3 dossier.class.php, 4...

CVE-2010-1945: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in openMairie Openfoncier 2.00, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 action.class.php, 2 architecte.class.php, 3 avis.class.php, 4 bible.class.php, and 5...

CVE-2010-1921: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 annuaire.class.php, 2 droit.class.php, 3 collectivite.class.php, 4 profil.class.php, 5...