CVE-2007-3543: Undefined Security Weakness

Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code by making a post that specifies a .php filename in the wpattachedfile metadata field; and then sending this file's content, alo...

CVE-2007-3460: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in index.php3 in EVA-Web 1.1 through 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 aide or 2 perso parameter...

CVE-2007-3431: Undefined Security Weakness

PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to execute arbitrary PHP code via a URL in the diredgelang parameter...

CVE-2007-3401: Undefined Security Weakness

PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfooter parameter...

CVE-2007-3371: Undefined Security Weakness

PHP remote file inclusion vulnerability in plugins/widgets/htmledit/htmledit.php in Powl 0.94 allows remote attackers to execute arbitrary PHP code via a URL in the POWLinstallPath parameter...

CVE-2007-3358: Undefined Security Weakness

PHP remote file inclusion vulnerability in html/loadlang.php in SerWeb 0.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SERWEBserwebdir parameter...

CVE-2007-3370: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrary PHP code via a URL in 1 the sunPath parameter to include.php or 2 the dir parameter to skin/board/default/doctype.php...

CVE-2007-3353: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myeventpath parameter. NOTE: a reliable third party disputes this issue, saying "the entire file is a class...

CVE-2007-3325: Undefined Security Weakness

PHP remote file inclusion vulnerability in lib/language.php in LAN Management System LMS 1.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter, a different vector than CVE-2007-1643 and CVE-2007-2205...

CVE-2007-3315: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in YourFreeScreamer 1.0, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the serverPath parameter to bodyTemplate.php in 1 templates/Classic/, 2 templates/Classic Guestbook/, 3...

CVE-2007-3306: Undefined Security Weakness

PHP remote file inclusion vulnerability in crontab/runbilling.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL in the configincludedir parameter, a different vector than CVE-2006-4489...

CVE-2007-3297: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSiniarrayEXTLIBPATH parameter to 1 msDb.php, 2 modules/MusooTemplateLite.php, or 3 modules/SoundImporter.php...

CVE-2007-3289: Undefined Security Weakness

PHP remote file inclusion vulnerability in spaw/spawcontrol.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

CVE-2007-3270: Undefined Security Weakness

PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to execute arbitrary PHP code via a URL in the strIncludePrefix parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...

CVE-2007-3239

Cross-site scripting XSS vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative sessio...

CVE-2007-3240

Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...

CVE-2007-3240

The CVE-2007-3240 entry concerns the WordPress Vistered-Little theme vulnerable in 404.php: XSS via the REQUEST_URI that accesses index.php, potentially allowing remote injection of script/HTML and, per notes, execution in an administrative session. The issue is actionable in the theme code and i...

CVE-2007-3240

Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...

CVE-2007-3240: Undefined Security Weakness

Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...