PHP Easy Download admin/save.php moreinfo Parameter Code Injection

The version of PHP Easy Download installed on the remote host fails to sanitize input to the 'moreinfo' parameter before using it in the 'save.php' script. By sending a specially crafted value, an attacker can store and execute code at the privilege level of the remote web server. %NASLMINLEVEL...

CVE-2006-6255: Undefined Security Weakness

Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension in the filename parameter and code in the moreinfo...