Unrestricted file upload

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

webspell40-multi.txt

WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...

WebSpell > 4.0 Authentication Bypass and arbitrary code execution

WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...

LoveCMS 1.4 - id Cross-Site Scripting

LoveCMS 1.4 - id Cross-Site Scripting source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacke...

LoveCMS 1.4 - 'id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker can exploit these issues to steal...

LoveCMS 1.4 - 'step' Remote File Inclusion

source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker can exploit these issues to steal...

LoveCMS 1.4 - 'step' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker can exploit these issues to steal...

LoveCMS 1.4 - step Traversal Arbitrary File Access

LoveCMS 1.4 - step Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issu...

LoveCMS 1.4 - load Traversal Arbitrary File Access

LoveCMS 1.4 - load Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issu...

Jupiter CMS 1.1.5 Remote File Upload Exploit

No description provided by source. URL: http://www.acid-root.new.fr/advisories/12070214.txt / errorreportingEALL ^ ENOTICE; $url = ' http://localhost/jupiter/'; $xpl = new phpsploit; $xpl-agent"Mozilla"; $arr = arrayfrmdturl = $url.'modules/emoticons.php', "a" = 1, "reqfile" =...

Jupiter CMS 1.1.5 - Arbitrary File Upload

URL: http://www.acid-root.new.fr/advisories/12070214.txt / errorreportingEALL ^ ENOTICE; $url = ' http://localhost/jupiter/'; $xpl = new phpsploit; $xpl-agent"Mozilla"; $arr = arrayfrmdturl = $url.'modules/emoticons.php', "a" = 1, "reqfile" = arrayfrmdtfilename = "iamaphpfile.php", frmdttype =...

wps1-rfi.txt

+-------------------------------------------------------------------- + + Wap Portal Serve 1. = Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: Wap Portal Server + Venedor ...........: http://www.sakic.net + Class ...............

CVE-2007-0656

PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-0167

Multiple PHP file inclusion vulnerabilities in WGS-PPC aka PPC Search Engine, as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in 1 configadmin.php, 2 configmain.php, 3 configmember.php, and 4 mysqlconfig.php in config/; 5...

CVE-2007-0167

Multiple PHP file inclusion vulnerabilities in WGS-PPC aka PPC Search Engine, as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in 1 configadmin.php, 2 configmain.php, 3 configmember.php, and 4 mysqlconfig.php in config/; 5...

extreme-fusion 4.02 - Remote Code Execution

DEVIL TEAM IRC: irc.milw0rm.com:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patriots : -...

CVE-2006-6511

dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain 1 feature, 2 editor, 3 newswire, 4 otherpress, 5 admin, 6 pbook, 7 media, or 8 mod, which are...

CVE-2006-6043

PHP file inclusion vulnerability in loginform-inc.php in Oliver formerly Webshare 1.2.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the confmotdfile parameter, which is accessed by the...

mxBB Module calsnails 1.06 - mx_common.php File Inclusion

mxBB Module calsnails 1.06 - mxcommon.php File Inclusion mxBB calsnails module 1.06 Remote File Inclusion Vulnerability Bugfounder: bd0rk || SOH-Crew Website: www.soh-crew.it.tt Gr33tings: nukedx, DeeJay, TheJT, str0ke Mod-Download:...

CVE-2006-5505

Multiple PHP file inclusion vulnerabilities in 2BGal 3.0 allow remote attackers to execute arbitrary PHP code via the lang parameter to 1 admin/configuration.inc.php, 2 admin/creeralbum.inc.php, 3 admin/changepwd.php.inc, and unspecified other files. NOTE: the provenance of this information is...