7270 matches found
CVE-2008-1511
Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the PathToComment parameter for 1 classes/classadmin.php and 2 classes/classcomments.php. NOTE: the provenance of this information is unknown; the details are...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bndirdefault parameter to 1 adduser.php, 2 createforum.php, 3 createuser.php, 4 deletenotes.php, 5 deleteuser.php, 6 editforum.php, 7 mailusers.php, 8...
Le Forum - 'Fichier_Acceuil' Remote File Inclusion
source: https://www.securityfocus.com/bid/28423/info Le Forum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the...
Le Forum - Fichier_Acceuil Remote File Inclusion
Le Forum - FichierAcceuil Remote File Inclusion source: https://www.securityfocus.com/bid/28423/info Le Forum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute malicious PHP code in the context ...
SA-2008-021 - Live - Cross site request forgery
The contributed module Live provides previews of content items while typing them. Live is vulnerable to a cross site request forgery which may lead to execution of PHP code when an authenticated, privileged user visits a malicious site. Versions affected Live for Drupal 5.x before Live 5.x-0.1...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to 1 converter.inc.php, 2 messages.inc.php, and 3 settings.inc.php in includes/...
CVE-2008-1405
PHP remote file inclusion vulnerability in code/display.php in fuzzylime cms 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...
PHPAuction Multiple Script include_path Parameter File Inclusion
The remote host is running PHPAuction, a PHP script for building auction websites. The version of PHPAuction installed on the remote host fails to sanitize input to the 'includepath' parameter of several scripts before using it to include PHP code. An unauthenticated, remote attacker can exploit...
CVE-2008-0300
mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences...
Null pointer dereference
mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences...
CVE-2008-0300
mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences...
CVE-2008-0300
Mapbender vulnerability CVE-2008-0300 affects Mapbender 2.4 up to 2.4.4, via mapFiler.php. Root cause: lack of input filtering allows PHP code sequences placed in the factor parameter to be written to a file and later executed. Impact: remote code execution on the webserver with the privileges of...
VHCS 2.4.7.1 - 'vhcs2_daemon' Remote Code Execution
!/usr/bin/php -q http://acid-root.new.fr/ [email protected] Exploit: + Logged in Administrator + The administrator has 2 resellers / Changing dareseller's password / Trying to connect as dareseller:thatpwnz + Login successful + The reseller has 2 users + Host domaintest.fr is connected /...
VHCS <= 2.4.7.1 (vhcs2_daemon) Remote Root Exploit
Exploit for linux platform in category remote exploits ================================================== VHCS http://acid-root.new.fr/ email protected Exploit: + Logged in Administrator + The administrator has 2 resellers / Changing dareseller's password / Trying to connect as dareseller:thatpwn...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in KCWiki 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the page parameter to 1 minimal/wiki.php and 2 simplest/wiki.php...
CVE-2008-1124
Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absoluteurl parameter to 1 components/xmlparser/loadparser.php; 2 admin.php, 3 categories.php, 4 categoriesadd.php, 5...
KC Wiki 1.0 - '/minimal/wiki.php?page' Remote File Inclusion
source: https://www.securityfocus.com/bid/28074/info KC Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in t...
KC Wiki 1.0 - '/simplest/wiki.php?page' Remote File Inclusion
source: https://www.securityfocus.com/bid/28074/info KC Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in t...
Urulu 2.1 Blind SQL Injection Vulnerability (CVE-2008-0385)
COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: Urulu Vendor: USystems Subject: Blind SQL Injection Vulnerability Risk: High Author: Daniel Roethlisberger Date: 2008-02-25 CVE Name: CVE-2008-0385 Introduction ------------ An AJAX based Blind SQL Injection vulnerability exists in the Web 2....
PHPMyTourney 2 - tourneyindex.php Remote File Inclusion
PHPMyTourney 2 - tourneyindex.php Remote File Inclusion source: https://www.securityfocus.com/bid/28057/info phpMyTourney is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote fi...