CVE-2006-3608: Undefined Security Weakness

The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code via an uploaded .php file...

CVE-2006-3556: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-3562: Improper Control of Generation of Code

PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the PXconfigmanagerpath parameter to 1 index.php, 2 rss.php, or 3 search.php, a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725...

CVE-2006-3537: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375...

CVE-2006-3520: Undefined Security Weakness

PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pluginpath0 parameter...

CVE-2006-3530: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in compccookbook/pccookbook.php in the PccookBook Component for Mambo and Joomla 0.3 and possibly up to 1.3.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfigabsolutepath parameter...

CVE-2006-3517: Undefined Security Weakness

PHP remote file inclusion vulnerability in stats.php in RW::Download, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

CVE-2006-3475: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the qbpath parameter to 1 index.php, 2 about.php, 3 contact.php, 4 delete.php, 5 faq.php, 6 features.php or 7 history.php, a different set of vectors than...

CVE-2006-3421

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in 1 comment.php, 2 admin/comedit.php, 3 admin/test.php, 4 admin/index.php, and 5 admin/include/incadminfoot.php, ...

CVE-2006-3421: Undefined Security Weakness

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in 1 comment.php, 2 admin/comedit.php, 3 admin/test.php, 4 admin/index.php, and 5 admin/include/incadminfoot.php, ...

CVE-2006-3422: Undefined Security Weakness

PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via the configtemplatepath parameter in userbottom.php, as used by multiple templates including 1 rwb template/rwb/userbottom.php, 2 gwb template/rwb/userbottom.php, 3 blues, 4...

CVE-2006-3375

PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter...

CVE-2006-3374

PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attackers to execute arbitrary PHP code via a URL in the incl parameter...

CVE-2006-3363

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3375: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter...

CVE-2006-3381: Undefined Security Weakness

SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. NOTE: It is uncertain whether this is a vulnerability or a feature of the product...

CVE-2006-3363: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3395: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...

CVE-2006-3340: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the 1 phpbbrootpath parameter in a includes/functionscms.php and the 2 GlobalSettingstemplatesDirectory parameter i...

CVE-2006-3323: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page parameter. NOTE: the same vector can be used for cross-site scripting, but CVE analysis suggests that this is resultant from file inclusion of HTML or...