CVE-2006-4557

PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter. NOTE: another researcher has stated that an attacker cannot control the type parameter. As of 20060901, CVE analysis...

CVE-2006-4594: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager phpAtm 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the includelocation parameter in 1 confirm.php or 2 login.php. NOTE: the includelocation parameter to index.php is already...

CVE-2006-4559: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System YACS CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the contextpathtoroot parameter in 1 articles/populate.php, 2 categories/category.php, 3 categories/populate.php, 4...

CVE-2006-4470: Undefined Security Weakness

Joomla! before 1.0.11 omits some checks for whether VALIDMOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion...

CVE-2006-4363: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component comcropimage 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter...

CVE-2006-4321: Undefined Security Weakness

PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component comcpg 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

EUVD-2006-4275

Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 phphtmllib parameter to a phphtmllib/includes.php; tagutils/ scripts including b divtagutils.php, c formutils.php, d...

CVE-2006-4286

PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component comcontentpublisher for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: this issue has been disputed by third parties who state tha...

CVE-2006-4291

PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier Build 3.04.04 allows remote attackers to execute arbitrary PHP code via a URL in the PMpathhandler parameter...

CVE-2006-4277

Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIBDIR parameter to 1 include/novalib/class.novaAdmin.mysql.php and 2 novalib/class.novaRead.mysql.php. NOTE: the provenance of this information...

CVE-2006-4166

CVE-2006-4166 : PHP remote file inclusion in TinyWebGallery (≤1.5) allows remote attackers to execute arbitrary PHP code via a URL provided in the image parameter to (1) image.php or (2) image.php2. Root cause is unsafe handling of the image parameter enabling inclusion of remote/local code; CVSS...

CVE-2006-4085

PHP remote file inclusion vulnerability in Olaf Noehring The Search Engine Project TSEP 0.942 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tsepconfigabsPath parameter to pagenavigation.php, a different vector than CVE-2006-4055. NOTE: the provenance of this...

CVE-2006-4075: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition docpile:we 0.2.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INITPATH parameter to 1 lib/folder.class.php, 2 lib/email.inc.php, 3 lib/document.class.php or 4...

CVE-2006-4060

PHP remote file inclusion vulnerability in calendar.php in Visual Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfgdir parameter...

CVE-2006-4036: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/usercpregister.php in ZoneMetrics ZoneX Publishers Gold Edition 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-4026: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in SAPID CMS 123 rc3 allows remote attackers to execute arbitrary PHP code via a URL in the 1 rootpath parameter in usr/extensions/getinfochannel.inc.php and the 2 GLOBALS"rootpath" parameter in usr/extensions/gettree.inc.php...

CVE-2006-3689

PHP remote file inclusion vulnerability in user-func.php in Codeworks Gnomedia SubberZLite allows remote attackers to execute arbitrary PHP code via a URL in the myadmindir parameter. NOTE: this issue has been disputed by a third party that claims that " the myadmindir variable is set before any...

CVE-2006-3773: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in smf.php in the SMF-Forum 1.3.1.3 Bridge Component comsmf For Joomla! and Mambo 4.5.3+ allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-3340

Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the 1 phpbbrootpath parameter in a includes/functionscms.php and the 2 GlobalSettingstemplatesDirectory parameter i...

CVE-2006-3317

PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraiddir parameter to 1 announcements.php and 2 rss.php, a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116...