CVE-2011-3833: Undefined Security Weakness

Unrestricted file upload vulnerability in ftpuploadfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory...

Multiple Bugs Haunt WordPress Setup

Researchers have found a string of weaknesses in the WordPress default installation page, including PHP code execution and a persistent cross-site scripting flaw, affecting versions 3.3.1 and later. WordPress officials say that they’re not planning to fix the vulnerabilities as there’s only a sma...

WordPress <= 3.3.1 - Multiple Vulnerabilities

WordPress version 3.3.1 is prone to PHP code execution and persistent cross-site scripting vulnerabilities via "setup-config.php" page. The attackers can host their own MySQL database server and then successfully complete the WordPress installation without having any valid credentials on the targ...

WordPress <= 3.3.1 Multiple Vulnerabilities

Exploit for php platform in category web applications Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version affected: 3.3.1 and prior Product description:...

WordPress Core 3.3.1 - Multiple Vulnerabilities

Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version affected: 3.3.1 and prior Product...

miniCMS 1.0 / 2.0 Code Execution

Title : miniCMS v1.0 : v2.0 php inject code Author : Or4nG.M4n Version : all version GDork : "This site is managed using MiniCMS©" Download : http://sourceforge.net/projects/mini-cms/files/mini-cms/ Thnks : +----------------------------------+ | xSs m4n i-Hmx h311 c0d3 | sp. Cyb3r-Crystal |...

[PT-2011-02] PHP code Injection in Kayako Support Suite

----------------------------------------------------------------- PT-2011-02 Positive Technologies Security Advisory PHP code Injection in Kayako Support Suite ----------------------------------------------------------------- --- Vulnerable software Kayako Support Suite Version: 3.70.02-stable an...

Multiple vulnerabilities in ZENphoto

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ZENphoto, which can be exploited to perform arbitrary PHP code execution, sql injection and cross site scripting attacks. 1 Arbitrary PHP Code Execution in ZENphoto: CVE-2012-0993 Input passed via...

Kayako Support Suite 3.70.02 PHP Code Execution

----------------------------------------------------------------- PT-2011-02 Positive Technologies Security Advisory PHP code Injection in Kayako Support Suite ----------------------------------------------------------------- --- Vulnerable software Kayako Support Suite Version: 3.70.02-stable an...

phpLDAPadmin orderby Parameter Arbitrary PHP Code Execution

The version of phpLDAPadmin installed on the remote host does not sanitize input to the 'orderby' parameter of the 'cmd.php' script when 'cmd' is set to 'queryengine' before using it in a call to 'createfunction'. An unauthenticated, remote attacker can leverage this issue to execute arbitrary PH...

PT-2011-1975

Name of the Vulnerable Software and Affected Versions Nucleus NP Gallery plugin version 0.94 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the DIR NUCLEUS parameter. This is a PHP remote file inclusion vulnerability in the NP Gallery plugin for Nucleus...

CVE-2010-4988: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in modchatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPLpath parameter...

PT-2011-1923

Name of the Vulnerable Software and Affected Versions Family Connections Who is Chatting version 2.2.3 Description A remote file inclusion issue exists in the mod chatting/themes/default/header.php file, allowing remote attackers to execute arbitrary PHP code via a URL in the TMPLpath parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the classpath parameter to 1 file.php or 2 comdel.php...

CVE-2010-4943: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the classpath parameter to 1 file.php or 2 comdel.php...

CVE-2010-4918

CVE-2010-4918 affects the Joomla! extension iJoomla Magazine (com_magazine) version 3.0.1, where a PHP Remote File Inclusion (RFI) vulnerability in magazine.functions.php allows an attacker to execute arbitrary PHP code via the config parameter in a URL. The underlying issue is an unchecked confi...

CVE-2010-4918: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in iJoomla Magazine commagazine component 3.0.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the config parameter to magazine.functions.php...

PT-2011-1813

Name of the Vulnerable Software and Affected Versions Kontakt Formular version 1.1 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the script pfad parameter in the formmailer.php file. Recommendations For Kontakt Formular version 1.1, consider restricting...

CVE-2010-4879: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the inputfile parameter...

CVE-2010-4878: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpfad parameter...