CVE-2006-4011

Kayako eSupport vulnerable to PHP remote file inclusion (CVE-2006-4011) in esupport/admin/autoclose.php for 2.3.1 and earlier when register_globals is enabled. An attacker can specify a URL in the subd parameter to execute arbitrary PHP code. Affected product/version: Kayako eSupport 2.3.1 and ea...

CVE-2006-3947

CVE-2006-3947 is a PHP remote file inclusion vulnerability in the Mambatstaff component for Mambo (version 3.1b and earlier). The issue allows an attacker to cause arbitrary PHP code execution by supplying a crafted URL to the mosConfig_absolute_path parameter, enabling code execution on the web ...

CVE-2006-3930

PHP remote file inclusion vulnerability in admin.a6mambohelpdesk.php in a6mambohelpdesk Mambo Component 18RC1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2006-3928

WMNews

CVE-2006-3930

The CVE affects the a6mambohelpdesk Mambo Component (18RC1 and earlier). The vulnerability is a PHP remote file inclusion in admin.a6mambohelpdesk.php that allows an attacker to execute arbitrary PHP code by supplying a URL in the mosConfig_live_site parameter. Impact is remote code execution wit...

EUVD-2006-3916

PHP remote file inclusion vulnerability in modmembre/inscription.php in PortailPHP 1.7 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter...

security flaw

Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass openbasedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function...

CVE-2006-3850

Vanilla CMS 1.0.1 and earlier contains a remote file inclusion vulnerability in upgrader.php when /conf/old_settings.php exists. An attacker can dereference a URL in the RootDirectory parameter to execute arbitrary PHP code. The issue has been disputed for version 1.0 (some sources state the Root...

CVE-2006-3793

PHP remote file inclusion vulnerability in constants.php in SiteDepth CMS 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SDDIR parameter...

CVE-2006-3556

PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

security flaw

zendhashdelkeyorindex in zendhash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zendhashdel to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations...

CVE-2006-3421

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in 1 comment.php, 2 admin/comedit.php, 3 admin/test.php, 4 admin/index.php, and 5 admin/include/incadminfoot.php, ...

CVE-2006-3422

CVE-2006-3422 describes a PHP remote file inclusion vulnerability in WonderEdit Pro CMS . An attacker can trigger arbitrary PHP code execution by supplying a crafted value to the config[template_path] parameter in user_bottom.php , affecting multiple templates (rwb, gwb, blues, bluwhi, grns). The...

GeekLog 1.4.0sr3 - f(u)ckeditor Remote Code Execution

GeekLog 1.4.0sr3 - fuckeditor Remote Code Execution !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n";...

EUVD-2006-3174

PHP remote file inclusion vulnerability in Admin/rtfparser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter...

CVE-2006-3177

PHP remote file inclusion vulnerability in Admin/rtfparser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter...

CVE-2006-3162

PHP remote file inclusion vulnerability in include/incfoot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2006-3076

PHP remote file inclusion vulnerability in softwareupload/publicincludes/pubtemplates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter...

CVE-2006-2877

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the includeprefix parameter in 1 inc/dbase.php, 2 inc/config.php, 3 inc/common.php, and 4 inc/function.php. NOTE: it has been reported that the inc directory is...

Remote file inclusion

PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the filepath parameter in 1 index.php, 2 feedback.php, and 3 printfriendly.php...