CVE-2007-5216: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in eArk e-Ark 1.0 allow remote attackers to execute arbitrary PHP code via a URL in 1 the cfgvcardpath parameter to src/vcardinc.php or 2 the cfgphpmailerpath parameter to src/emailinc.php. NOTE: the arkinc.php vector is already covered by...

CVE-2007-5178

The CVE describes a vulnerability in the mx_glance 2.3.3 module for mxBB where a missing delimiter inside a security check placed within a comment enables remote file inclusion (RFI) and arbitrary PHP code execution via a URL in the mx_root_path parameter. Affected software is mx_glance 2.3.3 for...

CVE-2007-5186: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute...

CVE-2007-5175: Improper Control of Generation of Code

PHP remote file inclusion vulnerability lib/base.php in actSite 1.991 Beta allows remote attackers to execute arbitrary PHP code via a URL in the BaseCfgBaseDir parameter...

CVE-2007-5173: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openidrootpath parameter...

CVE-2007-5178: Improper Control of Generation of Code

contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...

CVE-2007-5157: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in phfito-post.php in Alex Kocharin PHP Fidonet Tosser PhFiTo 1.3.0 in phpFidoNode allows remote attackers to execute arbitrary PHP code via a URL in the SRCPATH parameter to phfito-post...

CVE-2007-5167: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nomrepsysteme parameter...

CVE-2007-5168: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in ClanLite 1.23.01.2005 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 modules/serveurjeux.php or 2 conf/conf-php.php. NOTE: vector 1 is disputed by CVE because the requireonce is only reached when ...

CVE-2007-5146: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedipath parameter to 1 inc.generatecode.php, 2 fnc.typeforms.php, or 3 fnc.type.php in backend/inc/, or 4 frontend.php or 5 backend.php in...

CVE-2007-5147: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Puzzle Apps CMS 2.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the MODULEDIR parameter to 1 core/modules/my/my.module.php or 2 core/modules/xml/xml.module.php; the COREROOT parameter to 3 config.loader.php, 4...

CVE-2007-5160: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Thierry Leriche Restaurant Management System ReMaSys 0.5 allow remote attackers to execute arbitrary PHP code via a URL in 1 the DIRROOT parameter to a global.php, or the 2 DIRPAGE parameter to b template/fr/page.php or c...

CVE-2007-5156: Undefined Security Weakness

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

CVE-2007-5166: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SiteSys 1.0a allow remote attackers to execute arbitrary PHP code via a URL in the docroot parameter to 1 inc/pagehead.inc.php or 2 inc/pageinit.inc.php...

CVE-2007-5139: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter...

CVE-2007-5117: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in FrontAccounting FA 1.13, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathtoroot parameter to 1 access/login.php and 2 includes/lang/language.php, different vectors than CVE-2007-4279...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Ekke Doerre Contenido 42VariablVersion 42VV10 in contenidohacks in Mods 4 Xoops Contenido eZ publish pdf4cms allow remote attackers to execute arbitrary PHP code via a URL in the cfgPathInc parameter to 1 mainupl.php, 2 mainconeditside.php, 3...

CVE-2007-5115

Multiple PHP remote file inclusion vulnerabilities in Ekke Doerre Contenido 42VariablVersion 42VV10 in contenidohacks in Mods 4 Xoops Contenido eZ publish pdf4cms allow remote attackers to execute arbitrary PHP code via a URL in the cfgPathInc parameter to 1 mainupl.php, 2 mainconeditside.php, 3...

CVE-2007-5097: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in lib/classes/offlnflteam.php in Online Fantasy Football League OFFL 0.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the DOCROOT parameter. NOTE: this issue is disputed by CVE because a FILE test protects offlnflteam.php against...

CVE-2007-5098: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the setdepth parameter to 1 app.lib/product.control/core.php/product.control.config.php, or 2 customer.browse.list.p...