CVE-2007-5451: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.color.php in the comcolorlab aka comcolor 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-5440: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter to 1 index.php or 2 login.php. NOTE: this issue is disputed by CVE, since DOCUMENTROOT cannot be modified by an attacker...

Command injection

Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupaleval function through a callback parameter to t...

CVE-2007-5416

Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupaleval function through a callback parameter to t...

CVE-2007-5416

Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupaleval function through a callback parameter to t...

Several vulnerabilities in CMS Made Simple 1.1.3.1

Hi, There are several security bugs in CMS Made Simple 1.1.3.1 : I am not going to release dangerous and exploitable info here 1 There is a highly dangerous PHP code execution bug in the script . 2 A registered user can access unauthorized pages . For example he can upload files to the server, or...

CVE-2007-5389: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in preview.php in the swMenuFree comswmenufree 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: a reliable third party disputes this issue because preview.php tests a...

CVE-2007-5412: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass commp3allopass 1.0 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter to 1 allopass.php and 2 allopass-error.php...

CVE-2007-5388: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in WebDesktop 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 app parameter to apps/apps.php and the 2 wsk parameter to wsk/wsk.php...

CVE-2007-5410: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader comwmtrssreader 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-5387: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in active/components/xmlrpc/client.php in Pindorama 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ccomponents parameter...

CVE-2007-5409: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/nuseoadmind.php in NuSEO PHP Enterprise 1.6 NuSEO.PHP, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the nuseodir parameter...

CVE-2007-5362: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion

PicoFlat CMS Remote file inclusion f0und bY 0in download:http://sourceforge.net/project/showfiles.php?groupid=195156&packageid=230351&releaseid=533796 Greetings to:Dark-coders team members: Die-angel,Slim,Umbro Others: Joker186,Kaja,Wojto111,Rade0n And funny n00b-firends: Pucik and Steryd ; FUN B...

CVE-2007-5314

PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PEARPATH parameter...

CVE-2007-5315

PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbumdir parameter...

CVE-2007-5315

PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbumdir parameter...

Command injection

ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php. NOTE: it coul...

CVE-2007-5294

PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta aka Phoenix allows remote attackers to execute arbitrary PHP code via a URL in the siteabsolutepath parameter...

CVE-2007-5307

ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php. NOTE: it coul...