CVE-2007-2070: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart before 3.5.1 allow remote attackers to execute arbitrary PHP code via a URL in the abspath parameter to 1 index.php or 2 checkout.php...

CVE-2007-2088: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Sitebar 3.3.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 writerFile parameter to index.php and the 2 file parameter to Integrator.php...

CVE-2007-2087: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in CNStats 2.12, when registerglobals is enabled and .htaccess is not recognized, allow remote attackers to execute arbitrary PHP code via a URL in the bn parameter to 1 whor.php or 2 whos.php in reports/. NOTE: the provenance of this information...

CVE-2007-2086: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code via a URL in the bj parameter to 1 whor.php or 2 whos.php in reports/...

CVE-2006-7194: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SESSIONPATHCOMPOSANT parameter...

CVE-2007-2091: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in blocks/tsdisplay4xoopsblock2.php in tsdisplay4xoops TSD4XOOPS, aka the TeamSpeak display module 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the xoopsurl parameter...

CVE-2007-2096: Undefined Security Weakness

PHP remote file inclusion vulnerability in common.php in Hinton Design PHPHD Download System phphddownloads allows remote attackers to execute arbitrary PHP code via a URL in the phphdrealpath parameter. NOTE: this issue may be present in versions from 2006...

CVE-2007-2067: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Marco Antonio Islas Cruz Web Slider WebSlider 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 index.php, 2 modules/pdf.php, 3 plugins/highlight.php, or 4 include/modules.php...

CVE-2007-2076: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtofolder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this problem existed only brief...

CVE-2007-2077: Undefined Security Weakness

PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtofolder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this issue was fixed last year...

CVE-2007-2073: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the gallery parameter in a new session...

CVE-2007-2072: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue has been disputed by third party researchers for 0.3, stating that the dir variable is properly initialized before...

CVE-2007-2089: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter to comarticles.php in 1 components/ or 2 classes/html/...

CVE-2007-2103: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in my little forum 1.7 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to 1 admin.php and 2 timedifference.php...

ShoutPro 1.5.2 - shout.php Remote Code Injection

ShoutPro 1.5.2 - shout.php Remote Code Injection ?php echo "\n"; echo " Special Greetings To - Timq,Warpboy,The-Maggot \n"; echo "\n\n\n"; //Writes Files - Under 100 bytes to meet requirements $temppayload = "...

CVE-2007-2049: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Calendar Module comcalendar 1.5.5 for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter to 1 comcalendar.php or 2 modcalendar.php...

CVE-2007-2043: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia commosmedia 1.08 and earlier module for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 media.tab.php or 2 media.divs.php...

CVE-2007-2044: Undefined Security Weakness

PHP remote file inclusion vulnerability in modweather.php in the Antonis Ventouris Weather module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter...

Authorization

InoutMailingListManager 3.1 and earlier sends a Location redirect header but does not exit after an authorization check fails, which allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by ignoring the redirect...

CVE-2007-1998

Direct static code injection vulnerability in HIOX Guest Book HGB 4.0 allows remote attackers to inject arbitrary PHP code via the Email field, which results in code execution through a direct request to gb.php...