CVE-2007-3130

Multiple PHP remote file inclusion vulnerabilities in the OpenWiki formerly JD-Wiki component comjd-wiki 1.0.2, and possibly earlier, for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 dwpage.php or 2 wantedpages.php, different...

AlstraSoft Template Seller Pro <= 3.25 Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo " AlstraSoft Template Seller Pro = 3.25 Remote Code Execution Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love "; if $argc4 echo "Usage:...

GLSA-200705-16 : PhpWiki: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200705-16 PhpWiki: Remote execution of arbitrary code Harold Hallikainen has reported that the Upload page fails to properly check the extension of a file. Impact : A remote attacker could upload a specially crafted PHP file to th...

CVE-2007-2679

PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts sphp allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the fileexists function. NOTE: the provenance...

CVE-2007-2542

PHP remote file inclusion vulnerability in header.php in workbench survival guide 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

LS simple guestbook (v1) Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ============================================================ LS simple guestbook v1 Remote Code Execution Vulnerability ============================================================ Special Greetings To - Timq,Warpboy,The-Maggot File:...

Crea-Book <= 1.0 Admin Access Bypass / DB Disclosure / Code Execution

No description provided by source. /=======================================\ | Advisory :: Crea-Book = 1.0 | +=======================================+---------------------------------------------------------------\ | | | Download link : http://www.comscripts.com/scripts/php.creabook.1359.html | |...

Woven dream content management system（DEDECMS 3.the X+4. X upload vulnerability-vulnerability warning-the black bar safety net

Ghost boy note:accurate to say should be DEDECMS used in the php version of FCKeditor there upload vulnerability, the gif89a file header to cheat, did not expect the php version of FCKeditor, even the existence of such a vulnerability, the gif89a file header spoofing is not fresh things. Sources ...

metaforum-upload.txt

:\r\n"; $phpcode = trimfgetsSTDIN; echo "\r\n+ Connection... "; $sock = @fsockopen$argv1, 80...

PT-2007-2850 · Php · Php Photo Album

Name of the Vulnerable Software and Affected Versions: PHP Photo Album versions prior to 0.3.2.6 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the db file parameter in the common.php file. It is noted that versions 0.3.2.6 and 0.4.1beta do not contain...

CVE-2006-7147

PHP remote file inclusion vulnerability in includes/functionsmoduser.php in phpBB Import Tools Mod 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2007-1288

Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the configinstalldir parameter to 1 comment.php, 2 themes.php, 3 directory.php, and 4 sendmsg.php in admin/...

WebCalendar -- "noSet" variable overwrite vulnerability

Secunia reports: A vulnerability has been discovered in WebCalendar, which can be exploited by malicious people to compromise a vulnerable system. Input passed to unspecified parameters is not properly verified before being used with the "noSet" parameter set. This can be exploited to overwrite...

Unrestricted file upload

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

webspell40-multi.txt

WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...

WebSpell > 4.0 Authentication Bypass and arbitrary code execution

WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...

LoveCMS 1.4 - id Cross-Site Scripting

LoveCMS 1.4 - id Cross-Site Scripting source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacke...

LoveCMS 1.4 - 'id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker can exploit these issues to steal...

LoveCMS 1.4 - 'step' Remote File Inclusion

source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker can exploit these issues to steal...

LoveCMS 1.4 - 'step' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker can exploit these issues to steal...