Achievo 1.4.2 Shell Upload

view source print? Affected Applications: Confirmed in Achievo 1.4.2. Other versions may also be affected. Severity: Medium – CVSS: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Vendor Status: New release available Achievo 1.4.3 Reference to Vulnerability Disclosure Policy:...

Simple Machines Forum (SMF) 1.1.102.0 RC2 - Multiple Vulnerabilities

Simple Machines Forum SMF 1.1.102.0 RC2 - Multiple Vulnerabilities Simple Machines Forum is prone to multiple security vulnerabilities: - A remote PHP code-execution vulnerability - Multiple cross-site scripting vulnerabilities - Multiple cross-site request-forgery vulnerabilities - An...

Simple Machines Forum Multiple Security Vulnerabilities

Exploit for unknown platform in category web applications ======================================================= Simple Machines Forum Multiple Security Vulnerabilities ======================================================= Simple Machines Forum is prone to multiple security vulnerabilities: - ...

CVE-2009-4106: Improper Input Validation

Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters...

WordPress 2.8.5 Shell Upload

============================================= - Release date: November 11th, 2009 - Discovered by: Dawid Golunski - Severity: Moderately High ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.5 Unrestricted File Upload Arbitrary PHP Code...

WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

No description provided by source. ============================================= - Release date: November 11th, 2009 - Discovered by: Dawid Golunski - Severity: Moderately High ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.5 Unrestricted...

WordPress Core < 2.8.5 - Unrestricted Arbitrary File Upload / Arbitrary PHP Code Execution

============================================= - Release date: November 11th, 2009 - Discovered by: Dawid Golunski - Severity: Moderately High ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.5 Unrestricted File Upload Arbitrary PHP Code...

TikiWiki jhot Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'TikiWiki jhot...

CVE-2009-3817: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary combooklibrary component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter, a different vector than CVE-2009-2637. NOTE: the provenance of this...

CVE-2009-3760: Improper Control of Generation of Code

Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party...

CVE-2009-3660: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow...

CVE-2009-3511: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fsjVroot parameter to 1 sites/site/pages/index.php, 2 sites/test/pages/contact.php, 3 system/pageTemplate.php, and 4 system/utilities.php...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to 1 Calendar.php, 2 Comment.php, 3 Rss.php and 4 Trackback.php in lib/Loggix/Module/; and 5...

CVE-2009-3492: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to 1 Calendar.php, 2 Comment.php, 3 Rss.php and 4 Trackback.php in lib/Loggix/Module/; and 5...

CVE-2009-3426: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/filemanager/special.php in MaxCMS 3.11.20b allows remote attackers to execute arbitrary PHP code via a URL in the fmincludesspecial parameter...

CVE-2009-3424: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 isprojectPath parameter to includes/InstantSite/inc.isroot.php; GLOBALSthCMSroot parameter to 2 classes/class.Tree.php, 3...

CVE-2009-3307: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the FSPHPLIB parameter to 1 FSphp.php, 2 navigation.php, and 3 pathwrite.php in lib/...

CVE-2009-3323: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in BAnner ROtation System mini BAROSmini 0.32.595 allow remote attackers to execute arbitrary PHP code via a URL in the barospath parameter to 1 include/commonfunctions.php, and the mainpath parameter to 2 libusers.php, 3 libstats.php, and 4...

CVE-2009-3312: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in php/init.poll.php in phpPollScript 1.3 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a crafted URL in the includeclass parameter...

Design/Logic Flaw

The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with...