CVE-2008-6221: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager comdadamail component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSmosConfigabsolutepath parameter...

CVE-2009-0643

CVE-2009-0643 describes a static code injection in Simple PHP News 1.0 final. An attacker can inject arbitrary PHP code into news.txt via the post parameter and then trigger execution by requesting display.php, indicating a combination of unsafeguarded input handling and file-based code execution...

CVE-2009-0643

Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter, and then execute the code via a direct request to display.php. NOTE: some of these details are obtained from third party...

Code injection

Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the 1 title or 2 date parameter, and then execute the code via a direct request to display.php. NOTE: the provenance of this information is...

CVE-2009-0595: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter...

CVE-2008-6138

PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter...

CVE-2008-6138: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter...

Sql injection

Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via the startdate parameter...

CVE-2008-6132

Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via the startdate parameter...

CVE-2009-0572: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS aka Flatnuke3 2009-01-27 and 2009-02-04, when registerglobals is enabled and magicquotesgpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the FNROOTPATH parameter to 1 index.php and 2...

CVE-2009-0517

Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tzenv.class. NOTE: some of these details are obtained...

CVE-2009-0530: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SnippetMaster 2.2.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 SESSIONSCRIPTPATH parameter to includes/vars.inc.php and the 2 gpcltarlibdir parameter to...

CVE-2009-0513: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code via a URL in the classFiles parameter to 1 admin/doc/index.php, 2 index.php, and 3 base/menu.php in mod/...

CVE-2008-6103: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in A4Desk Event Calendar, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the v parameter...

Hedgedog CMS 1.21 LFI / Command Execution

!/usr/bin/perl |----------------------------------------------------------------------------------------------------------------------------------| | INFORMATIONS | |----------------------------------------------------------------------------------------------------------------------------------|...

Hedgehog-CMS 1.21 (LFI) Remote Command Execution Exploit

Exploit for unknown platform in category web applications ======================================================== Hedgehog-CMS 1.21 LFI Remote Command Execution Exploit ======================================================== !/usr/bin/perl...

Hedgehog-CMS 1.21 - Local File Inclusion Remote Command Execution

Hedgehog-CMS 1.21 - Local File Inclusion Remote Command Execution !/usr/bin/perl |----------------------------------------------------------------------------------------------------------------------------------| | INFORMATIONS |...

Unrestricted file upload

Unrestricted file upload vulnerability in pages/download.php in Iamma Simple Gallery 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory...

CVE-2009-0456: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in examples/exampleclientsidejavascript.php in patForms, as used in Sourdough 0.3.5, allows remote attackers to execute arbitrary PHP code via a URL in the neededFilespatForms parameter...

Jaws language Parameter Multiple Local File Includes

Jaws, a Framework and Content Management System for building dynamic websites, is installed on the remote system. The installed version fails to filter input to the 'language' parameter before using it to include PHP code in '/upgrade/index.php' and '/install/index.php'. Regardless of PHP's...