CVE-2005-0859: Undefined Security Weakness

PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to 1 headlines.php or 2 news.php. NOTE: some sources have reported the "dir" parameter as being affected; however, this is likely a cut-and-paste error from the...

CVE-2005-0860: Undefined Security Weakness

PHP remote file inclusion vulnerability in TRG News Script 3.0 allows remote attackers to execute arbitrary PHP code via the dir parameter to 1 article.php, 2 authorall.php, 3 comment.php, 4 display.php, or 5 displayall.php...

CVE-2005-0800

PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2005-0720...

CVE-2005-0800: Undefined Security Weakness

PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2005-0720...

CVE-2005-0793: Undefined Security Weakness

PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to 1 execute arbitrary PHP code in ZPanel 2.0 or 2 include local files in ZPanel 2.5 beta 10 and earlier by modifying the page parameter...

PHP mcNews arbitrary file inclusion

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- BadRoot Security Advisory 2005-0x01 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Thu Mar 17 2005 - 00:46 am GMT +1 Product: mcNews =1.3 successfully exploited on 1.3 Vendor: http://www.phpforums.net/index.php?dir=dld Home Page Type: Arbitrary fil...

paNews 2.0.4b Multiple Input Validation Vulnerabilities

The remote host is running a version of paNews that suffers from the following vulnerabilities: - SQL Injection Issue in the 'login' method of includes/auth.php. A remote attacker can leverage this vulnerability to add users with arbitrary privileges. - Local Script Injection Vulnerability in...

CVE-2005-0748: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in initdb.php for WEBInsta Mailing list manager 1.3d allows remote attackers to execute arbitrary PHP code by modifying the absolutepath parameter to reference a URL on a remote web server that contains the code...

CVE-2005-0720: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/header.php in PHP mcNews 1.3 allows remote attackers to execute arbitrary PHP code by modifying the skinfile parameter to reference a URL on a remote web server that contains the code...

CVE-2005-0721: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules.php in eXPerience2 allows remote attackers to execute arbitrary PHP code by modifying the file parameter to reference a URL on a remote web server that contains the code...

CVE-2005-0698

PHP remote file inclusion vulnerability in PHPWebLog 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the 1 GPATH parameter to init.inc.php or the 2 PATH parameter to index.php to reference a URL on a remote web server that contains the code...

CVE-2005-0698: Undefined Security Weakness

PHP remote file inclusion vulnerability in PHPWebLog 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the 1 GPATH parameter to init.inc.php or the 2 PATH parameter to index.php to reference a URL on a remote web server that contains the code...

CVE-2005-0679: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in tellafriend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the scriptroot parameter to reference a URL on a remote web server that contains the code. NOTE: it was later reported tha...

CVE-2005-0678: Undefined Security Weakness

PHP remote file inclusion vulnerability in formmail.inc.php for Form Mail Script 2.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the scriptroot to reference a URL on a remote web server that contains the code...

CVE-2005-0680: Undefined Security Weakness

PHP remote file inclusion vulnerability in downloadcenterlite.inc.php for Download Center Lite 1.6 allows remote attackers to execute arbitrary PHP code by modifying the scriptroot parameter to reference a URL on a remote web server that contains the code...

CVE-2005-0645

CVE-2005-0645 describes a cross-site scripting (XSS) vulnerability in CuteNews 1.3.6. The flaw allows an attacker to inject arbitrary HTML, web script, and PHP code via the CLIENT-IP or X-FORWARDED-FOR headers in an HTTP POST to show_news.php. Affected component is show.inc.php in CuteNews 1.3.6....

CVE-2005-0647

The CVE-2005-0647 entry concerns paNews 2.0.4b. Vulnerability: in admin_setup.php, remote attackers can inject arbitrary PHP code via the (1) $form[comments] or (2) $form[autoapprove] parameters, which are written to config.php. This is a local script injection affecting paNews’s configuration fi...

CVE-2005-0647

adminsetup.php in paNews 2.0.4b allows remote attackers to inject arbitrary PHP code via the 1 $formcomments or 2 $formautoapprove parameters, which are written to config.php...

CVE-2005-0632: Undefined Security Weakness

PHP remote file inclusion vulnerability in auth.php in PHPNews 1.2.4 and possibly 1.2.3, allows remote attackers to execute arbitrary PHP code via the path parameter...

PHPNews auth.php path Parameter Remote File Inclusion

The remote host is running PHPNews, an open source news application written in PHP. The installed version of PHPNews has a remote file include vulnerability in the script 'auth.php'. By leveraging this flaw, a attacker can cause arbitrary PHP code to be executed on the remote host using the...