CVE-2007-6485: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 aka Oreon 1.4 allow remote attackers to execute arbitrary PHP code via a URL in the fileOreonConf parameter to 1 MakeXML.php or 2 MakeXML4statusCounter.php in include/monitoring/engine/...

Code injection

Direct static code injection vulnerability in wiki/index.php in Bitweaver 2.0.0 and earlier, when comments are enabled, allows remote attackers to inject arbitrary PHP code via an editcomments action...

Code injection

Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the 1 username, 2 password, and 3 email parameters when registering a user account, which can be executed by accessing the user's php file for this...

CVE-2007-6412

Direct static code injection vulnerability in wiki/index.php in Bitweaver 2.0.0 and earlier, when comments are enabled, allows remote attackers to inject arbitrary PHP code via an editcomments action...

Remote file inclusion

PHP remote file inclusion vulnerability in blocks/blocksitemap.php in ViArt 1 CMS 3.3.2, 2 HelpDesk 3.3.2, 3 Shop Evaluation 3.3.2, and 4 Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the rootfolderpath parameter. NOTE: some of these details are obtained from...

Remote file inclusion

PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitrary PHP code via a URL in the configfsBase parameter, a different vector than CVE-2006-2726...

CVE-2007-6325: Improper Input Validation

PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitrary PHP code via a URL in the configfsBase parameter, a different vector than CVE-2006-2726...

CVE-2007-6296

PHP remote file inclusion vulnerability in userspopupL.php3 in phpMyChat 0.14.5 allows remote attackers to execute arbitrary PHP code via a URL in the From parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 level parameter to a installmodule.php and b uninstallmodule.php in upload/xax/admin/modules/, c upload/xax/admin/patch/index.php, and d...

CVE-2007-6231: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tmincludepath parameter to 1 Classes.inc.php, 2 statistic.inc.php, 3 status.inc.php, 4 statustopx.inc.php, or 5 libchart-1.1/libchart.php in include/. NOTE:...

CVE-2007-6218: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 level parameter to a installmodule.php and b uninstallmodule.php in upload/xax/admin/modules/, c upload/xax/admin/patch/index.php, and d...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccmslibrarypath parameter to 1 markdown.php and 2 gallery.php in decoder/...

CVE-2007-6179: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccmslibrarypath parameter to 1 markdown.php and 2 gallery.php in decoder/...

CVE-2007-6178: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu EHCP 0.22.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the confdir parameter to 1 dbutil.bck.php and 2 dbutil.php in config/...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfmbasepath parameter...

CVE-2007-6139

PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skinfile parameter...

CVE-2007-6133

PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfmbasepath parameter...

CVE-2007-6139: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skinfile parameter...

CVE-2007-6147: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the a phprootpath and sometimes the b privilegerootpath parameter to various PHP scripts under 1 admin/includes/, 2 admin/phase/, 3 includes/, 4...

ucms-backdoor.txt

Opencosmo Security http://www.opencosmo.com Ucms v. 1.8 Np exploit function sethostseite document.host.action = seite + 'index.php?&q=test&e=1'; document.all.data.innerHTML = document.host.action; /he...