569 matches found
PT-2006-3280 · Ispconfig · Ispconfig
Name of the Vulnerable Software and Affected Versions: ISPConfig versions 2.2.2 and earlier Description: A remote file inclusion issue allows attackers to execute arbitrary PHP code via a URL in the go infoserverclasses root parameter. The vendor has disputed this issue, stating that the affected...
CVE-2006-1371: Improper Control of Generation of Code
Laurentiu Matei eXpandable Home Page XHP CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using 1 manager.php, 2 standalonemanager.php, and 3 images.php...
CVE-2006-1013: Undefined Security Weakness
PHP remote file include vulnerability in index.php in SMartBlog aka SMBlog 1.2 allows remote attackers to include and execute arbitrary PHP files via 1 the pg parameter and 2 a query string without a parameter...
Code injection
Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified, possibly due to XSS or direct static code injection...
Q-News 2.0 - Remote File Inclusion
Q-News 2.0 - Remote File Inclusion source: https://www.securityfocus.com/bid/15576/info Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remot...
CVE-2005-3767
Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded files, which allows remote attackers to upload and execute PHP files...
CVE-2005-3767: Undefined Security Weakness
Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded files, which allows remote attackers to upload and execute PHP files...
CVE-2005-2686
CVE-2005-2686 describes a directory traversal vulnerability in SaveWebPortal 3.4. Remote attackers can cause arbitrary file inclusion and execute local PHP programs by supplying ".." sequences in the SITE_Path parameter to menu_dx.php or the CONTENTS_Dir parameter to menu_sx.php. Affected softwar...
CVE-2004-2256: Undefined Security Weakness
Directory traversal vulnerability in phpMyFAQ 1.4.0 alpha allows remote attackers to read arbitrary files, and possibly execute local PHP files, via .. sequences in the lang language variable...
CVE-2002-1841: Unrestricted Upload of File with Dangerous Type
The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execute arbitrary PHP files with extensions such as .php4...
PHP Execution Vulnerability in CuteNews
There is a vulnerability in the latest and to the best of my knowledge, all prior versions of CuteNews from CutePHP.com. CuteNews does not properly sanitize user input when an administrative account edits the template files. CuteNews takes HTML code from a web form and outputs it to a template fi...
GLSA-200503-04 : phpWebSite: Arbitrary PHP execution and path disclosure
The remote host is affected by the vulnerability described in GLSA-200503-04 phpWebSite: Arbitrary PHP execution and path disclosure NST discovered that, when submitting an announcement, uploaded files aren't correctly checked for malicious code. They also found out that phpWebSite is vulnerable ...
phpWebSite: Arbitrary PHP execution and path disclosure
Background phpWebSite provides a complete web site content management system. Description NST discovered that, when submitting an announcement, uploaded files aren't correctly checked for malicious code. They also found out that phpWebSite is vulnerable to a path disclosure. Impact A remote...
cutenews.txt
===================================================== cutenews 1.3.6: Remote XSS && Local Code Execution ===================================================== FraMe - frame at kernelpanik.org http://www.kernelpanik.org ===================================================== cutenews es un script...
CVE-2004-1426
Directory traversal vulnerability in index.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to read arbitrary files and execute arbitrary PHP files via .. dot dot sequences in the lng parameter...
CVE-2004-1426: Undefined Security Weakness
Directory traversal vulnerability in index.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to read arbitrary files and execute arbitrary PHP files via .. dot dot sequences in the lng parameter...
CVE-2005-0272: Undefined Security Weakness
ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, which bypasses the intended restrictions...
CVE-2005-0200: Improper Input Validation
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386...
ZeroBoard Multiple Scripts dir Parameter Remote File Inclusion
The remote host runs Zeroboard, a web BBS application popular in Korea. The remote version of this CGI is vulnerable to multiple flaws which may allow an attacker to execute arbitrary PHP commands on the remote host by including a PHP file hosted on a third-party server, or to read arbitrary file...
