CVE-2024-23336

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the "127.0.0.0/8" block, which may result in a Server-Side Request Forgery SSRF vulnerability. The Configuration File's Disallowed Remote Addresses list "$config'disallowedremoteaddresses'"...

CVE-2024-23336: Server-Side Request Forgery (SSRF)

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery SSRF vulnerability. The Configuration File's Disallowed Remote Addresses list $config'disallowedremoteaddresses'...

CVE-2020-22124: Files or Directories Accessible to External Parties

A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information...

CVE-2018-8966: Improper Control of Generation of Code

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2010-0966: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in inc/config.php in deV!Lz Clanportal DZCP 1.5.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter...

CVE-2008-2687

CVE-2008-2687 affects ProManager 0.73. A directory traversal flaw in inc/config.php allows remote attackers to include and execute arbitrary local files by using a .. in the language parameter, enabling arbitrary code execution on affected systems. No remediation details are provided in the suppl...

CVE-2008-2687: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in inc/config.php in ProManager 0.73 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

CVE-2006-2877

CVE-2006-2877 describes a PHP remote file inclusion in Bookmark4U 2.0.0 and earlier. An attacker can cause the application to include arbitrary PHP files via the include_prefix parameter in one of four files: inc/dbase.php, inc/config.php, inc/common.php, or inc/function.php. The advisory notes t...

CVE-2006-2877: Undefined Security Weakness

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the includeprefix parameter in 1 inc/dbase.php, 2 inc/config.php, 3 inc/common.php, and 4 inc/function.php. NOTE: it has been reported that the inc directory is...