CVE-2006-4629

PHP remote file inclusion vulnerability in affichage/commentaires.php in C-News.fr C-News 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

TikiWiki file upload vulnerability (jhot.php)

Added: 09/08/2006 CVE: CVE-2006-4602 BID: 19819 OSVDB: 28456 Background TikiWiki is a multi-purpose web content management system written in PHP. Problem The jhot.php script allows remote attackers to upload arbitrary PHP commands into the img/wiki directory. The commands can then be executed by...

CVE-2006-4635: Undefined Security Weakness

Unspecified vulnerability in MySource Classic 2.14.6, and possibly earlier, allows remote authenticated users, with superuser privileges, to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in WebExtensions - Notitia I/II. NOTE: due to lack of details, it is not...

CVE-2006-4645: Undefined Security Weakness

PHP remote file inclusion vulnerability in akarru.gui/maincontent.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bmcontent parameter...

CVE-2006-4647: Undefined Security Weakness

PHP remote file inclusion vulnerability in news.php in Sponge News 2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sndir parameter...

CVE-2006-4648: Undefined Security Weakness

PHP remote file inclusion vulnerability in bpncom.php in BinGo News BP News 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter...

CVE-2006-4644: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the repmod parameter...

CVE-2006-4629: Undefined Security Weakness

PHP remote file inclusion vulnerability in affichage/commentaires.php in C-News.fr C-News 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2006-4637: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ACGV News 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter in 1 header.php or 2 news.php. NOTE: portions of these details are obtained from third party information...

CVE-2006-4630: Undefined Security Weakness

PHP remote file inclusion vulnerability in jscript.php in Sky GUNNING MySpeach 3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mymsroot parameter...

CVE-2006-4649: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in bpnews.php in BinGo News BP News 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter...

CVE-2006-4596

PHP remote file inclusion in MyBace Light Skrip, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the 1 hauptverzeichniss parameter in includes/logincheck.php and the 2 templateback parameter in admin/login/content/userdaten.php...

CVE-2006-4609: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Content Management module "Content manager" for PHProjekt 0.6.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the pathpre parameter in 1 cmlib.inc.php, 2 doc/br.edithelp.php, 3...

CVE-2006-4605: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to execute arbitrary PHP code via the adodb parameter...

CVE-2006-4610

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter...

CVE-2006-4610: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter...

CVE-2006-4618: Undefined Security Weakness

PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODBDIR parameter...

CVE-2006-4621: Undefined Security Weakness

PHP remote file inclusion vulnerability in settings.php in Pheap 1.2, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. The...

CVE-2006-4557

PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter. NOTE: another researcher has stated that an attacker cannot control the type parameter. As of 20060901, CVE analysis...

CVE-2006-4559: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System YACS CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the contextpathtoroot parameter in 1 articles/populate.php, 2 categories/category.php, 3 categories/populate.php, 4...