CVE-2007-6649: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the configrootordner parameter...

CVE-2007-6655: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

CVE-2007-6657: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in source/includes/loadforum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfhrootpath parameter...

CVE-2007-6615: Improper Control of Generation of Code

Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selectedprovider parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFapproot parameter to 1 tcuser.class.php, 2 absencecount.inc.php, 3 avatar.inc.php, 4 csvhandler.class.php, 5 functions.tcpro.php, 6...

CVE-2007-6553: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFapproot parameter to 1 tcuser.class.php, 2 absencecount.inc.php, 3 avatar.inc.php, 4 csvhandler.class.php, 5 functions.tcpro.php, 6...

CVE-2007-6318: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DBCHARSET is set to 1 Big5, 2 GBK, or possibly other character set encodings that support a "" in a multibyte character...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the a phprootpath and sometimes the b privilegerootpath parameter to various PHP scripts under 1 admin/includes/, 2 admin/phase/, 3 includes/, 4...

CVE-2007-6082

Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote attackers to inject arbitrary PHP code via the filecontents parameter, which can be executed by accessing includes/news.php...

CVE-2007-6088: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functionsmoduser.php in phpBBViet 02.03.07 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-5843: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute arbitrary PHP code via a URL in the pathdot parameter...

GuppY Includes.Inc远程文件包含漏洞

GuppY是一款基于PHP的WEB应用程序。 GuppY不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'Includes.Inc'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的任意文件作为包含参数，可导致以WEB权限执行任意PHP代码。 GuppY 4.6.3 目前没有详细解决方案提供： http://www.freeguppy.org/ http://www.example.com/path/index.php?selskin=..%2Finc%2Fboxleft.inc%00&xposboxL=RFI...

CVE-2007-5595: Improper Neutralization of CRLF Sequences in HTTP Headers

CRLF injection vulnerability in the drupalgoto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue is disputed by CVE because the identified code is in a function that is not accessible via direct reques...

PT-2007-6586 · Phpcms · Phpscms

Name of the Vulnerable Software and Affected Versions: phpSCMS versions 0.0.1-Alpha1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter in the includes/functions.php file. This is a remote file inclusion issue. Note that the identified code...

CVE-2007-5566: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHPBlog 0.1 Alpha allow remote attackers to execute arbitrary PHP code via a URL in the bloglocalpath parameter to 1 includes/functions.php or 2 includes/email.php. NOTE: this issue is disputed by CVE because the identified code is in function...

CVE-2007-5565: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue is disputed by CVE because the identified code is in a function that is not accessible via direct reques...

PT-2007-6587 · Php · Sphpblog

Name of the Vulnerable Software and Affected Versions: PHPBlog version 0.1 Alpha Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the blog localpath parameter to includes/functions.php or includes/email.php. However, it is noted that this issue is disputed...

Remote file inclusion

PHP remote file inclusion vulnerability in htmls/forum/includes/topicreview.php in UniversiBO 1.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not calle...

CVE-2007-5151: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the abgetadmin function in includes/nukesentinel.php in NukeSentinel 2.5.12 allows remote attackers to execute arbitrary SQL commands via base64-encoded data in an admin cookie...