CVE-2005-2014

The "upload a language pack" feature in paFAQ 1.0 Beta 4 allows remote authenticated administrators to execute arbitrary PHP commands by uploading a malicious language pack...

CVE-2005-1996: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the SERVERDOCUMENTROOT parameter...

CVE-2005-1868

I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension...

CVE-2005-1876

Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template .tpl file...

CVE-2005-1876

Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template .tpl file...

CVE-2005-1876

The CVE-2005-1876 entry describes a direct code injection vulnerability in CuteNews 1.3.6 and earlier . The issue allows remote attackers with administrative privileges to execute arbitrary PHP code by inputs injected into a template file (.tpl), effectively compromising the server’s PHP executio...

CVE-2005-1869: Undefined Security Weakness

PHP remote file inclusion vulnerability in startlobby.php in MWChat 6.x allows remote attackers to execute arbitrary PHP code via the CONFIGMWCHATLibs parameter...

FlatNuke 2.5.x - 'index.php?where' Full Path Disclosure

source: https://www.securityfocus.com/bid/13882/info Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content...

CVE-2005-1821: Undefined Security Weakness

PHP remote file inclusion vulnerability in pdlheader.inc.php in PowerDownload 3.0.2 and 3.0.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter to downloads.php...

CVE-2005-1604: Undefined Security Weakness

PHP Advanced Transfer Manager phpATM 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as demonstrated using a filename ending in "php.ns", which allows execution of arbitrary PHP code...

CVE-2003-1178

Eval injection vulnerability in comments.php in Advanced Poll 2.0.2 allows remote attackers to execute arbitrary PHP code via the 1 id, 2 templateset, or 3 action parameter...

CVE-2004-2041: Undefined Security Weakness

PHP remote file inclusion vulnerability in secureimgrender.php in e107 0.615 allows remote attackers to execute arbitrary PHP code by modifying the p parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1988: Undefined Security Weakness

PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPGMDIR to reference a URL on a remote web server that contains functions.inc.php...

CVE-2003-1148: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences phpMyConference 8.0.2 and possibly other products, allow remote attackers to execute arbitrary PHP code via a URL in the lvcincludedir parameter to 1 config.inc.php or 2...

CVE-2004-2018: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1989: Undefined Security Weakness

PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEMEDIR parameter to reference a URL on a remote web server that contains userlistinfobox.inc...

ZeroBoard - Worm Source Code

ZeroBoard - Worm Source Code / The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. /str0ke / / ZeroBoard -1day INE w0rm / include include include include include include include include include ifdef sun include endif / SunOS / define DEBUGING undef...

CVE-2005-1438: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1447: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.php in SitePanel 2.6.1 and earlier SitePanel2 allows remote attackers to execute arbitrary PHP code via the p parameter...

CVE-2005-0565

The Announce module in phpWebSite 0.10.0 and earlier allows remote attackers to execute arbitrary PHP code by setting the Image field to reference a PHP file whose name contains a .gif.php extension...