CVE-2007-5009

PHP remote file inclusion vulnerability in language/langgerman/langmainalbum.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-5015: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the slthemeunixpath parameter to 1 adminfooter.php, 2 infofooter.php, 3 themefooter.php, 4 browsefooter.php, 5 accountfooter.php, or 6...

CVE-2007-5009: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in language/langgerman/langmainalbum.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-4951

PHP remote file inclusion vulnerability in sample.php in YaPiG 0.95b allows remote attackers to execute arbitrary PHP code via a URL in the YAPIGPATH parameter. NOTE: this issue has been disputed by CVE, since YAPIGPATH is defined before use...

CVE-2007-4954

PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic comjoom12pic 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic comjoom12pic 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-4954

CVE-2007-4954 describes a PHP remote file inclusion in the Joomla! 1.0 extension joom12Pic (com_joom12pic), specifically via the mosConfig_live_site parameter in admin.joom12pic.php. The vulnerability allows an attacker to supply a crafted URL and potentially execute arbitrary PHP code on the ser...

CVE-2007-4942

PHP remote file inclusion vulnerability in modules/Discipline/StudentFieldBreakdown.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter, a different vector than CVE-2007-4806. NOTE: the provenance of this information is unknown...

Code injection

Direct static code injection vulnerability in includes/admin/sub/confappearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a saveappearence action in admin.php, as demonstrated with the 1 productscount, 2 colscount,...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 programfiles/livedraft/livedraft.php or 2 programfiles/livedraft/admin.php...

shopscript-exec.txt

?php Shop-Script FREE = 2.0 Remote Command Execution Exploit by InATeam tested on versions 1.2 and 2.0 works regardless magicquotesgpc=on Greetz: eXp, Kuzya, cxim, Russian, ENFIX echo "--------------------------------------------------------\n"; echo "Shop-Script FREE = 2.0 Remote Command Executi...

Shop-Script FREE <= 2.0 Remote Command Execution Exploit

No description provided by source. ?php Shop-Script FREE = 2.0 Remote Command Execution Exploit by InATeam tested on versions 1.2 and 2.0 works regardless magicquotesgpc=on Greetz: eXp, Kuzya, cxim, Russian, ENFIX echo "--------------------------------------------------------\n"; echo "Shop-Scrip...

CVE-2007-4949: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpReactor 1.2.7pl1 allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to 1 ekilat.com-int.tpl.php, 2 phpreactor.org-top.tpl.php, or 3 ekilat.com-top.tpl.php in examples/. NOTE: this issue has been...

CVE-2007-4950: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in form/dbform/employee.php in PHPortal 0.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter. NOTE: this issue is disputed by CVE, since DOCUMENTROOT cannot be modified by an attacker...

CVE-2007-4933: Improper Control of Generation of Code

Direct static code injection vulnerability in includes/admin/sub/confappearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a saveappearence action in admin.php, as demonstrated with the 1 productscount, 2 colscount,...

CVE-2007-4935: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 admin.php, 2 custompages.php, 3 draft.php, 4 faq.php, 5 leagues.php, 6 livedraft.php, 7 login.php, 8 myteam.php, 9 profile.php, 10...

CVE-2007-4954: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic comjoom12pic 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-4947: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in myphpPagetool 0.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the ptinclude parameter to 1 help1.php, 2 help2.php, 3 help3.php, 4 help4.php, 5 help5.php, 6 help6.php, 7 help7.php, 7 help8.php, 8 help9.php, or 10 index.p...

Shop-Script FREE 2.0 - Remote Command Execution

Shop-Script FREE 2.0 - Remote Command Execution ?php Shop-Script FREE = 2.0 Remote Command Execution Exploit by InATeam tested on versions 1.2 and 2.0 works regardless magicquotesgpc=on Greetz: eXp, Kuzya, cxim, Russian, ENFIX echo "--------------------------------------------------------\n"; ech...

CVE-2007-4923: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 comjoomlaradiov5 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...