CVE-2008-3747: Undefined Security Weakness

The 1 geteditpostlink and 2 geteditcommentlink functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie...

Directory traversal

Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...

CVE-2008-3677

Directory traversal vulnerability in includes/eventsapplicationtop.php in Freeway before 1.4.2.197 allows remote attackers to include and execute arbitrary local files via unspecified vectors...

CVE-2008-3677: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/eventsapplicationtop.php in Freeway before 1.4.2.197 allows remote attackers to include and execute arbitrary local files via unspecified vectors...

CVE-2008-3489

SQL injection vulnerability in checkCookie function in includes/functions.inc.php in PHPX 3.5.16 allows remote attackers to execute arbitrary SQL commands via a PXL cookie...

CVE-2008-3489: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in checkCookie function in includes/functions.inc.php in PHPX 3.5.16 allows remote attackers to execute arbitrary SQL commands via a PXL cookie...

CVE-2008-3416: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the cleanstring function in includes/functions.php...

Remote file inclusion

PHP remote file inclusion vulnerability in ktmlpro/includes/ktedit/toolbar.php in gapicms 9.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the dirDepth parameter...

gapicms v9.0.2 (dirDepth) Remote File Inclusion Vulnerability

gapicms v9.0.2 dirDepth Remote File Inclusion Vulnerability Found : Ghost Hacker R-H TeaM |, .-. .-. ,| HOME : www.Real-Hack.net | o/ o | Email : [email protected] |/ / | Script : gapicms v9.0.2 Download Script : http://heanet.dl.sourceforge.net/sourceforge/gapicms/gapicmsv9.0.2stable.tar.gz...

CVE-2008-2905: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2008-2899

Technical details for CVE-2008-2899 are not publicly provided in the supplied documents. The initial description is generic, and connected records do not expose affected product specifics, root cause, or remediation.

CVE-2008-2898: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ctemppath parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname...

CVE-2008-2899: Undefined Security Weakness

Unspecified vulnerability in includes/classes/page.php in j00lean-CMS 1.03 has unknown impact and attack vectors...

CVE-2008-2146: Undefined Security Weakness

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2008-2044: Improper Control of Generation of Code

includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1, as demonstrated by uploading a PHP...

CVE-2008-1963: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbitrary PHP code via a URL in the location parameter...

CVE-2008-1911: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via a cookpass cookie...

CVE-2008-1860: Improper Control of Generation of Code

Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2008-1773: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...