EUVD-2006-6445

PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter...

EUVD-2006-6409

PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the templatefile parameter...

Moskool Component Admin.Moskool.PHP远程文件包含漏洞

MamboXChange Moskool是一款基于Mambo的应用模块程序。 MamboXChange Moskool不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'admin.moskool.php'脚本对用户提交的"mosConfigabsolutepath"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码 MamboXChange Moskool 1.5 http://mamboxchange.com/projects/moskool/...

CVE-2006-6295

PHP remote file inclusion vulnerability in includes/mxcommon.php in the mxtinies 1.3.0 Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

CVE-2006-6282

Vulnerability: Vikingboard 0.1b is affected by CVE-2006-6282 (and related CVE-2006-4709) due to a SQL injection in topic.php via the s parameter. The issue can allow remote attackers to trigger a forced SQL error or execute arbitrary SQL commands. Affected component/file: topic.php in Vikingboard...

EUVD-2006-5878

PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

EUVD-2006-5772

PHP remote file inclusion vulnerability in 1 index.php and 2 admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to execute arbitrary PHP code via a URL in the p parameter...

CVE-2006-5678

PHP remote file inclusion vulnerability in common/visiteurs/include/library.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences phpMyConference 8.0.2 and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the lvcmodulesdir paramete...

CVE-2006-5673

PHP remote file inclusion vulnerability in bbfunctxt.php in miniBB 2.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter...

CVE-2006-5670

PHP remote file inclusion vulnerability in forgotpass.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ADBODYTEMP parameter...

EUVD-2006-5650

PHP remote file inclusion vulnerability in admin/modulesdata.php in the phpBB module Spider Friendly 1.3.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

EUVD-2006-5605

PHP remote file inclusion vulnerability in include/menubuilder.php in MiniBILL 2006-10-10 1.2.3 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the configpagedir parameter, a different vector than CVE-2006-4489...

EUVD-2006-5575

PHP remote file inclusion vulnerability in index.php in ArticleBeach Script 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

php-exec.txt

Hello, This is not a new problem see http://www.securityfocus.com/bid/9302. However, we also "discovered" this a few weeks ago and contacted Apache and PHP about it. According to Stefan Esser PHP its due to Apache's failure to open file descriptors with the close on exec flag. However, according ...

EUVD-2006-5524

PHP remote file inclusion vulnerability in login/secure.php in UeberProject Management System 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfghomepath parameter...

CVE-2006-5497

PHP remote file inclusion vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter...

CVE-2006-5439

The CVE-2006-5439 issue affects Comdev Misc Tools 4.1: PHP remote file inclusion in adminfoot.php when register_globals is enabled. An attacker can execute arbitrary PHP code by supplying a crafted URL in the path[docroot] parameter. The NVD description confirms the vulnerability and impact (part...

CVE-2006-5401

PHP remote file inclusion vulnerability in template/barnraiser01/pnewpassword.tpl.php in AROUNDMe 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the templatePath parameter...

EUVD-2006-5299

PHP remote file inclusion vulnerability in ftag.php in TribunaLibre 3.12 Beta allows remote attackers to execute arbitrary PHP code via a URL in the mostrar parameter...

CVE-2006-5280

PHP remote file inclusion vulnerability in includes/import-archive.php in Leicestershire communityPortals 1.0 build 20051018 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cprootpath parameter...