CVE-2006-2270: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/config.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary code via a URL in the relativescriptpath parameter...

Invision Power Board 2.x.x < 04-25-06 Multiple Vulnerabilities

The installation of Invision Power Board on the remote host fails to sanitize input to the 'ck' parameter of the 'index.php' script before using it in database queries. An unauthenticated attacker may be able to leverage this issue to disclose sensitive information, modify data, or launch attacks...

Sql injection

SQL injection vulnerability in portfoliophotopopup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the countclick function in includes/functions/fnsstd.php. NOTE: this issue could...

CVE-2006-2080

SQL injection vulnerability in portfoliophotopopup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the countclick function in includes/functions/fnsstd.php. NOTE: this issue could...

CVE-2006-1895: Undefined Security Weakness

Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that 1 bypasses a loose "." regular expression to match BEGIN and END statements in overallheader.tpl, or...

CVE-2006-1794

SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via 1 the $username variable in the mosGetParam function and 2 the $task parameter in the mosMenuCheck function in a includes/mambo.php; and 3 the $filter...

Sql injection

SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via 1 the $username variable in the mosGetParam function and 2 the $task parameter in the mosMenuCheck function in a includes/mambo.php; and 3 the $filter...

CVE-2006-1794: Undefined Security Weakness

SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via 1 the $username variable in the mosGetParam function and 2 the $task parameter in the mosMenuCheck function in a includes/mambo.php; and 3 the $filter...

PT-2006-2671 · Maxdev · Maxdev Md-Pro

Name of the Vulnerable Software and Affected Versions: MAXdev MDPro versions prior to 1.076 Description: The issue allows remote attackers to obtain the full path of the server via a direct request to "includes/legacy.php". Recommendations: For versions prior to 1.076, consider restricting access...

CVE-2006-1677: Exposure of Sensitive Information to an Unauthorized Actor

MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...

CVE-2006-1602

CVE-2006-1602 describes a PHP remote file inclusion in includes/functions_common.php within the VWar Account module (vWar_Account) of PHPNuke Clan 3.0.1. The vulnerability allows remote attackers to include arbitrary files via a URL supplied to the vwar_root2 parameter. The issue is scoped to the...

CVE-2006-1602: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/functionscommon.php in the VWar Account module vWarAccount in PHPNuke Clan 3.0.1 allows remote attackers to include arbitrary files via a URL in the vwarroot2 parameter. NOTE: it is possible that this issue stems from a problem in VWar itself, b...

CVE-2006-1503: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functionsinstall.php in Virtual War VWar 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1636...

The Includer remote command execution flaw

The remote web server contains a PHP script that is affected by a remote code execution vulnerability. The remote host is running The Includer, a PHP script for emulating server-side includes. The version of The Includer installed on the remote host allows an attacker to execute arbitrary shell...

CVE-2006-1104

Pixelpost

CVE-2006-1105: Undefined Security Weakness

Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not...

CVE-2006-1104: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the showimage parameter in index.php; and the 2 USERAGENT, 3 HTTPREFERER, and 4 HTTPHOST HTTP header fields as used in the bookvistor function in...

LoudBlog 0.41 - index.php?template Traversal Arbitrary File Access

LoudBlog 0.41 - index.php?template Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/17023/info Loudblog is prone to multiple input-validation vulnerabilities: - An SQL-injection vulnerability. - Two local file-include vulnerabilities. - An information-disclosure...

CVE-2006-0986

WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 default-filters.php, 2 template-loader.php, 3 rss-functions.php, 4 locale.php, 5 wp-db.php, and 6 kses.php in the wp-includes/ directory; and 7 edit-form-advanced.php, 8...

Directory traversal

WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 default-filters.php, 2 template-loader.php, 3 rss-functions.php, 4 locale.php, 5 wp-db.php, and 6 kses.php in the wp-includes/ directory; and 7 edit-form-advanced.php, 8...