PT-2006-4031 · Nucleus · Nucleus

Name of the Vulnerable Software and Affected Versions: Nucleus version 3.23 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL using the DIR LIBS parameter in various files, including path/action.php, media.php, /xmlrpc/server.php, and /xmlrpc/api...

PT-2006-3958 · Phorum · Phorum

Name of the Vulnerable Software and Affected Versions: Phorum versions 5.1.13 and earlier Description: A remote file inclusion issue in common.php allows remote attackers to execute arbitrary PHP code via a URL in the PHORUMhttp path parameter. However, the vendor disputes this issue, stating tha...

CVE-2006-3022: Undefined Security Weakness

Cross-site scripting XSS vulnerability in zoom.php in fipsGallery 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter...

CVE-2006-2983

PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems EPS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in cal.php. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

CVE-2006-2982

Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems EPS 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in 1 footer.php and 2 admin/footer.php...

Remote file inclusion

PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 inc/logincheck.inc.php, 2 inc/adminheader.inc.php, 3 inc/global.php, or 4 inc/mainheader.inc.php. NOTE: some of these vectors were also...

CVE-2006-2860: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 inc/logincheck.inc.php, 2 inc/adminheader.inc.php, 3 inc/global.php, or 4 inc/mainheader.inc.php. NOTE: some of these vectors were also...

PT-2006-3777 · Mybloggie · Mybloggie

Name of the Vulnerable Software and Affected Versions: MyBloggie versions 2.1.1 and earlier Description: A remote file inclusion issue allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie root path parameter to admin.php. The issue's validity has been disputed, with so...

CVE-2006-2261: Undefined Security Weakness

PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2006-2241: Undefined Security Weakness

PHP remote file inclusion vulnerability in show.php in Fast Click SQL Lite 1.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: This is a different vulnerability than CVE-2006-2175...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: this issue might be resultant from the directory traversal vulnerability...

CVE-2006-2210

Cross-site scripting XSS vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: this issue might be resultant from the directory traversal vulnerability...

CVE-2006-2210: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: this issue might be resultant from the directory traversal vulnerability...

CVE-2006-2211: Undefined Security Weakness

Absolute path traversal vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to browse arbitrary directories via the path parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 show.php or 2 top.php...

CVE-2006-2175: Undefined Security Weakness

PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 show.php or 2 top.php...

CVE-2006-2149: Undefined Security Weakness

PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the CONFIGpath parameter, as demonstrated by including a GIF that contains PHP code...

Directory traversal

Directory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a .. dot dot in the path parameter...

CVE-2006-0702: Undefined Security Weakness

admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. dot dot sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal...

CVE-2005-4424: Undefined Security Weakness

Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. dot dot in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00...