757 matches found
Remote file inclusion
PHP remote file inclusion vulnerability in includes/common.php in Yaap 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter, possibly related to the autoload function...
CVE-2007-2507
CVE-2007-2507 describes a directory traversal vulnerability in the Treble Designs 1024 CMS 0.7. The flaw exists in includes/download.php and allows remote attackers to read arbitrary files by providing a ../ sequence in the item parameter. The issue affects Treble Designs 1024 CMS 0.7 and enables...
phpchess-rfi.txt
phpChess Community Edition 2.0 Multiple Remote File Inclusion Vulnerabilities D.Script: http://www.phpchess.net/index-3.html Discovered by: GolDM = Mahmoodali Homepage: http://www.Tryag.cc Exploit:Path/skins/phpchess/layoutadmincfg.php?RootPath=Shell...
Remote file inclusion
PHP remote file inclusion vulnerability in includes/CAltInstaller.php in the JoomlaPack comjpack 1.0.4a2 RE component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...
PT-2007-3439 · Openconcept · Openconcept Back-End Cms
Name of the Vulnerable Software and Affected Versions: OpenConcept Back-End CMS version 0.4.7 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the includes path parameter to various PHP files, including "click.php" and "pollcollector.php" in the htdocs...
AjPortal2Php - PagePrefix Remote File Inclusion
AjPortal2Php - PagePrefix Remote File Inclusion AjPortal2Php Class: File Include Vulnerability Remote: Yes Site: http://www.ajlopez.com/downloads/AjPortal2Php.zip Author: Alkomandoz Hacker Contact: [email protected] file ; begin.inc.php connection.inc.php events.inc.php footer.inc.php...
CVE-2007-1894
CVE-2007-1894 describes an XSS in WordPress via the year parameter in wp_title, in the file wp-includes/general-template.php, before 20070309. The linked Debian advisory confirms fixes in WordPress versions 2.0.10-1 and 2.1.3-1 (DSA-1285-1). Other references (NVD OSV, OSV-DEBIAN) corroborate the ...
WordPress fails to properly sanitize input passed to the iz parameter in wp-includes/theme.php
Overview WordPress fails to properly sanitize input to the iz parameter in wp-includes/theme.php, which could allow a remote, unauthenticated attacker to execute arbitrary commands. Description WordPress is a blogging application that is written in PHP. WordPress 2.1.1 fails to properly sanitize...
CVE-2007-1230
Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the donsimgbasepath parameter to 1 attributes.php, 2 images.php, or 3 scan.php in admin/; or 4 attributes.php, 5 dbutils.php, 6 images.php, 7 utils.php, or ...
WordPress < 2.1.1 Multiple Script Backdoors
The version of WordPress installed on the remote host appears to include a backdoor that allows an unauthenticated, remote attacker to execute arbitrary code on the remote host, subject to the permissions of the web server user id. %NASLMINLEVEL 70300 Tenable Network Security, Inc...
DBGuestbook 1.1 (dbs_base_path) Remote File Include Vulnerabilities
DBGuestBook 1.1 Found by Denven Script: http://www.dbscripts.net/download/?file=2 ERROR: includes/utils.php requireonce $dbsbasepath includes/guestbook.php requireonce $dbsbasepath includes/views.php requireonce $dbsbasepath RFI: http://SITE.com/path/includes/utils.php?dbsbasepath=SHELL...
CVE-2007-1060
Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when registerglobals and allowfopenurl are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOTDIR parameter to 1 createemails.inc.php and 2 sendemails.inc.php in...
DBImageGallery 1.2.2 (donsimg_base_path) RFI Vulnerabilities
Exploit for unknown platform in category web applications ============================================================ DBImageGallery 1.2.2 donsimgbasepath RFI Vulnerabilities ============================================================ DBImageGallery 1.2.2 Found by Denven ERROR:...
ZebraFeeds 1.0 (zf_path) Remote File Include Vulnerabilities
Exploit for unknown platform in category web applications ============================================================ ZebraFeeds 1.0 zfpath Remote File Include Vulnerabilities ============================================================ Discovered By:- ThE email protected aggregator.php:-...
ZebraFeeds 1.0 - 'zf_path' Remote File Inclusion
To ConTacT mE @ wWw.Asb-May.net/bb ScRiPt:-http://cazalet.org/zebrafeeds/releases/zebrafeeds-current.zip Discovered By:- ThE dE@Th aggregator.php:- requireonce$zfpath . 'includes/feed.php'; requireonce$zfpath . 'includes/view.php'; requireonce$zfpath . 'includes/template.php'; requireonce$zfpath...
CVE-2007-0762
PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...
phpBB++ Build 100 - 'phpbb_root_path' Remote File Inclusion
C xoron Name: phpBB++ phpbbrootpath Remote File Include Exploit Author: xoron Exploit coded by xoron Download: http://sourceforge.net/project/showfiles.php?groupid=86688&packageid=90098 xoron.biz - xoron.info Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn Tesekkurler: chaos, pang0, DJR POC:...
NSGalPHP Config.Inc.PHP远程文件包含漏洞
NSGalPHP是一款基于PHP的WEB应用程序。 NSGalPHP不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Config.Inc.PHP'脚本对用户提交的'racineTBS'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 nsGalPHP 目前没有解决方案提供,请关注以下链接： http://www.easy-script.com/compt.php?id=3521 http://www.example.com/path/includes/config.inc.php?racineTBS=PHPSHELL...
CVE-2006-6938
CVE-2006-6938 is a directory traversal in NitroTech 0.0.3a (distributed before 2006) that allows remote attackers to include arbitrary files via ".." in the root parameter of includes/common.php. Documents report a network-based, low-complexity attack with no authentication, potentially exposing ...