CVE-2008-5585: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter to 1 portal/includes/portalblock.php and 2 includes/acp/acplcxbbportal.php...

MG2 0.5.1 (filename) Remote Code Execution Vulnerability

No description provided by source. ?php /000000000000----------------------000\\ /-00--------++++++++++++++++++ -- -- - MiniGal2MG2 v0.5.1 remote Code Injection | Z okazji urodzin ¿yczê sobie wszystkiego zajebistego Zawsze na odwrót lol '''''---" 0 ------------ \ A-L | """""" '--==9 Victoria heh...

MG2 0.5.1 (filename) Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ======================================================== MG2 0.5.1 filename Remote Code Execution Vulnerability ======================================================== and rest and ALL ---------++++++++++++================= -- =======--...

MG2 0.5.1 - filename Remote Code Execution

MG2 0.5.1 - filename Remote Code Execution and rest and ALL ---------++++++++++++================= -- =======-- ./.................. =======--////- VULN:includes\mg2functions.php function writecomments$filename LINE 555 --------- function writecomments$filename $filename = "pictures/" . $filename...

CVE-2008-5334: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2008-5278: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5116: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter...

PHPX news_id SQL Injection Vulnerability (Nov 2008)

PHPX is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-5000

CVE-2008-5000 is an SQL injection vulnerability in PHPX 3.5.16, exploitable when magic_quotes_gpc is disabled. The flaw resides in admin/includes/news.inc.php, allowing remote attackers to inject arbitrary SQL via the news_id parameter (uppercase input). Multiple sources reference this PHPX issue...

CVE-2008-5000

SQL injection vulnerability in admin/includes/news.inc.php in PHPX 3.5.16, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via uppercase characters in the newsid parameter...

CVE-2008-5000: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/includes/news.inc.php in PHPX 3.5.16, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via uppercase characters in the newsid parameter...

CVE-2008-4894: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10a, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the...

sharedlog CMS Remote File Includes

I have discovered a remote file include vulnerability in the sharedlog Content management system. http://www.shatm.com/ http://sourceforge.net/projects/sharedlog/ Vulnerable code segment: requireonce$GLOBALS'rootdir'.'classes/!class.memcache.inc.php'; Line 5 of slideshowuploadvideo.content.php As...

CVE-2008-4769

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-4769: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-4524: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Check User" feature includes/checkuser.php in AdaptCMS Lite and AdaptCMS Pro 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2008-3060: Exposure of Sensitive Information to an Unauthorized Actor

V-webmail 1.5.0 allows remote attackers to obtain sensitive information via 1 malformed input in the login page includes/local.hooks.php and 2 an invalid session ID, which reveals the installation path in an error message...

CVE-2008-4208: Undefined Security Weakness

Unspecified vulnerability in OSADS Alliance Database before 2.1 has unknown impact and attack vectors, possibly related to includes/functions.php, a different issue than CVE-2006-2874...

CVE-2008-4181: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. dot dot or absolute pathname in the...

CVE-2008-4141: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the webroot parameter to 1 includes/functioncore.php and 2 templates/layoutlyrics.php...