CVE-2006-4269: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component comx-shop 1.7 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: this issue has been disputed by third party researchers...

CVE-2006-4277: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIBDIR parameter to 1 include/novalib/class.novaAdmin.mysql.php and 2 novalib/class.novaRead.mysql.php. NOTE: the provenance of this information...

CVE-2006-4236: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in POWERGAP allow remote attackers to execute arbitrary PHP code via a URL in the 1 shopid parameter to a s01.php, b s02.php, c s03.php, and d s04.php; and possibly a URL located after "shopid=" or "sid=" in the PATHINFO...

CVE-2006-4237: Undefined Security Weakness

PHP remote file inclusion vulnerability in pageheaderdefault.inc.php in Invisionix Roaming System Remote IRSR 0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sysSessionPath parameter...

CVE-2006-4281: Undefined Security Weakness

PHP remote file inclusion vulnerability in akocomments.php in AkoComment 1.1 module comakocomment for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4240: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Fusion News 3.7 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter...

CVE-2006-4270: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in mambelfish.class.php in the mambelfish component commambelfish 1.1 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4239: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool OPT Max 1.2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CRMinc parameter...

CVE-2006-4263: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Product Scroller Module and other modules in mambo-phpshop comphpshop for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter in 1 modphpshop.php, 2 modphpshopallinone.php...

CVE-2006-4278: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the mainnav parameter...

CVE-2006-4271: Undefined Security Weakness

PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the...

CVE-2006-4229: Undefined Security Weakness

PHP remote file inclusion vulnerability in archive.php in the mosListMessenger Component comlm before 20060719 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4230: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in index.php in Lizge V.20 Web Portal allow remote attackers to execute arbitrary PHP code via a URL in the 1 lizge or 2 bade parameters...

CVE-2006-4215

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig9990loadFile parameter...

CVE-2006-4207: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Bob Jewell Discloser 0.0.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the fileloc parameter to 1 content/content.php or 2 /inc/indexhead.php...

CVE-2006-4217: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/usersonline/users.php in WEBInsta CMS 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the moduledir parameter, a different vulnerability than CVE-2006-4196. NOTE: the provenance of this information is unknown; the details...

CVE-2006-4204: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHProjekt 5.1 and possibly earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 pathpre parameter in lib/specialdays.php and the 2 libpath parameter in lib/dbmanfilter.inc.php...

CVE-2006-4198: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/session.php in Wheatblog wB 1.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wbclassdir parameter...

Zen Cart autoload_func.php autoLoadConfig Array Remote File Inclusion

The version of Zen Cart installed on the remote host fails to sanitize input to the 'autoLoadConfig' array parameter before using it in 'includes/autoloadfunc.php' to include PHP code. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able to exploit these...

CVE-2006-4205: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in WebDynamite ProjectButler 0.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to /classes/ scripts including 1 Cache.class.php, 2 Customer.class.php, 3 Performance.class.php, 4 Project.class.php, 5...