CVE-2005-0513: Undefined Security Weakness

PHP remote file inclusion vulnerability in mailautocheck.php in the Email This Entry add-on for pMachine Pro 2.4, and possibly other versions including pMachine Free, allows remote attackers to execute arbitrary PHP code by directly requesting mailautocheck.php and modifying the pmpath parameter ...

CVE-2005-0511

misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter...

CVE-2004-1592: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the reqpath parameter to reference a URL on a remote web server that contains a malicious funcs.php script...

CVE-2004-1660: Undefined Security Weakness

PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to 1 showarchives.php or 2 shownews.php...

CVE-2004-1582: Undefined Security Weakness

PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter incorrectly called "libpach" to reference a URL on a remote web server that contains more.php, as demonstrated using checkdb.inc.php...

CVE-2005-0376: Undefined Security Weakness

PHP remote file inclusion vulnerability in SGallery 1.01 allows local and possibly remote attackers to execute arbitrary PHP code by modifying the DOCUMENTROOT parameter to reference a URL on a remote web server that contains 1 config.php or 2 sqllayer.php...

CVE-2004-1423

Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office VLO and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpcrootpath parameter to 1 includes/calendar.ph...

CVE-2004-1403: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the doc parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1427: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.inc in KorWeblog 1.6.2-cvs and earlier allows remote attackers to execute arbitrary PHP code by modifying the GPATH parameter to reference a URL on a remote web server that contains the code, as demonstrated in index.php when using .. dot dot...

CVE-2004-1426: Undefined Security Weakness

Directory traversal vulnerability in index.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to read arbitrary files and execute arbitrary PHP files via .. dot dot sequences in the lng parameter...

CVE-2005-0272

The provided documents confirm a vulnerability in ReviewPost (PHP Pro) prior to version 2.84. The flaw allows remote attackers to upload and execute arbitrary PHP files by submitting a review file with multiple extensions, bypassing the product’s restrictions. This results in remote code executio...

CVE-2005-0272: Undefined Security Weakness

ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, which bypasses the intended restrictions...

CVE-2005-0200: Improper Input Validation

TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386...

FlatNuke index.php url_avatar Field Arbitrary PHP Code Execution

The remote host is running FlatNuke, a content management system written in PHP and using flat files rather than a database for its storage. The remote version of this software has a form submission vulnerability that may allow an attacker to execute arbitrary PHP commands on the remote host...

CVE-2004-2740

PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the pathpre parameter...

CVE-2004-1421

Multiple PHP remote file inclusion vulnerabilities 1 stepone.php, 2 steponetables.php, 3 steptwotables.php in WHM AutoPilot 2.4.6.5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the serverinc parameter to reference a URL on a remote web server that contains the cod...

PHProjekt: Remote code execution vulnerability

Background PHProjekt is a modular groupware web application used to coordinate group activities and share files. Description cYon discovered that the authform.inc.php script allows a remote user to define the global variable $pathpre. Impact A remote attacker can exploit this vulnerability to for...

PHP-Calendar Multiple Script phpc_root_path Parameter Remote File Inclusion

The remote web server is running PHP-Calendar, a web-based calendar written in PHP. The remote version of this software is vulnerable to a file inclusion flaw that could allow an attacker to execute arbitrary PHP commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

phpBB Code EXEC (v2.0.10)

| | | | | | | | || | | | | | | | | |/ / / / | | | / | '| |/ / | | | | V V / | |/ / | | | | | |// // |/ ,|| || http://www.howdark.com ---------------------------------------------------------------------------------------------------------------------------------- // Information...

CVE-2004-0128: Undefined Security Weakness

PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGVBASEDIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script...