InteliEditor 1.2.x - lib.editor.inc.php Remote File Inclusion

InteliEditor 1.2.x - lib.editor.inc.php Remote File Inclusion -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= InteliEditor syspath Remote File Include Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-...

CVE-2006-5389: Undefined Security Weakness

tools/tellhim.php in PHP-Wyana allows remote attackers to obtain sensitive information via an invalid lang parameter, which reveals the path in an error message...

CVE-2006-5326: Undefined Security Weakness

PHP remote file inclusion vulnerability in language/lang/langcontactfaq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter. NOTE: the provenance of this information is unknown; the details ar...

CVE-2006-5302: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrary PHP code via a URL in the 1 langprefix parameter to a conn.php, b sesscheck.php, c wap/conn.php, or d wap/sesscheck.php, or the 2 lang parameter to e index.php...

CVE-2006-4913: Undefined Security Weakness

Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. dot dot sequence and trailing null %00 byte in the lang parameter, as demonstrated by injecting PHP code...

KnowledgeBuilder 2.2 - visEdit_root Remote File Inclusion

KnowledgeBuilder 2.2 - visEditroot Remote File Inclusion +-------------------------------------------------------------------- + + KnowledgeBuilder.v2.2.PHP.NULL-WDYL Remote File Inclusion + +------------------------------------------------------------------- + + Version ...........:...

CVE-2006-4753: Undefined Security Weakness

Directory traversal vulnerability in index.php in PHProg before 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...

PT-2006-5528 · Phprog · Phprog

Name of the Vulnerable Software and Affected Versions: PHProg versions prior to 1.1 Description: The issue allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter of the index.php file. This is a directory traversal vulnerability. Recommendations: For versions prior...

PHProg 1.0 - 'index.php?lang' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/19957/info PHProg is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and local file-include attacks. Version 1.0 of PHProg is reported...

CVE-2006-3821

Multiple cross-site scripting XSS vulnerabilities in ATutor 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 lang parameter in a indexlist.php and 2 year, 3 month, and 4 day parameter in b registration.php...

CVE-2006-3830: Undefined Security Weakness

The Languages selection in the admin interface in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to upload files with arbitrary extensions to the bmc/Inc/Lang directory. NOTE: because the uploaded files cannot be accessed through HTTP, this...

Directory traversal

Absolute path directory traversal vulnerability in a MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and b VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the 1 language parameter in...

Directory traversal

Absolute path directory traversal vulnerability in 1 MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and 2 VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname i...

pictureDis.txt

PictureDis Products "lang" Parameter File Inclusion Vulnerability ================================================= Input passed to the "lang" parameter in thumstbl.php, wpfiles.php, and wallpapr.php is not properly verified before being used to include files. This can be exploited to execute...

CVE-2006-3175: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to 1 admin.php, 2 ecrire.php, and 3 lire.php. NOTE: it was later reported that the ecrire.php vector also affects 1.2. NOTE: this issue might ...

CVE-2006-3062

Cross-site scripting XSS vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-3075: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including 1 thumstbl.php, 2 wpfiles.php,...

CVE-2006-3062: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2006-2893: Undefined Security Weakness

index.php in GANTTy 1.0.3 allows remote attackers to obtain the full path of the web server via an invalid lang parameter in an authenticate action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 lang parameter in index.php, and the 2 mytheme and 3 myskin parameters in multiple "p-themes" index.inc.php files including c...