CVE-2008-0138

PHP remote file inclusion vulnerability in xoopsgallery/initbasic.php in the modgallery module for XOOPS, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERYBASEDIR parameter...

CVE-2008-0143

CVE-2008-0143 describes a PHP remote file inclusion vulnerability in samPHPweb’s common/db.php (potentially version 4.2.2 and later) as packaged with SAM Broadcaster. An attacker can supply a URL via the commonpath parameter to cause arbitrary PHP code execution. Public CVSS v2 data in the record...

CVE-2008-0139

CVE-2008-0139 affects Loudblog 0.8.0 and earlier. An Eval injection in loudblog/inc/parse_old.php via the template parameter allows remote attackers to execute arbitrary PHP code. CVSS2 base metrics indicate Network access, no authentication, and partial impact to confidentiality, integrity, and ...

CVE-2008-0144: Improper Neutralization of Special Elements used in an SQL Command

PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged for local file inclusion using directory traversal sequences...

XoopsGallery init_basic.php GALLERY_BASEDIR Parameter Remote File Inclusion

The remote host is running XoopsGallery, a third-party module for Xoops. The version of XoopsGallery installed on the remote host fails to sanitize user-supplied input to the 'GALLERYBASEDIR' parameter of the 'modules/xoopsgallery/initbasic.php' script before using it to include PHP code. Provide...

DCP-Portal <= 6.11 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/php -q ?php echo "DCP Portal = 6.11 Remote SQL Injection Exploit\r\n"; echo "Coded by x0kster -x0ksterATgmailDOTcom - \r\n"; / Note : Magic Quotes = 0 Script Download : http://www.dcp-portal.org/ Bug in index.php : ?php //index.php ... 60. $sql = "SELE...

halflife-dos.txt

---- Counter Strike 1.6 Denial Of Service POC ... ITDefence.ru Antichat.ru Counter Strike 1.6 Denial Of Service POC Eugene Minaev [email protected] Bug was found by Maxim Suhanov THE FUF works only with no-steam servers / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ /...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the configrootordner parameter...

CVE-2007-6642

Multiple cross-site request forgery CSRF vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to 1 add a Super Admin, 2 upload an extension containing arbitrary PHP code, and 3 modify the configuration as administrators via unspecified vectors...

CVE-2007-6642

Multiple cross-site request forgery CSRF vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to 1 add a Super Admin, 2 upload an extension containing arbitrary PHP code, and 3 modify the configuration as administrators via unspecified vectors...

CVE-2007-6642

Multiple cross-site request forgery CSRF vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to 1 add a Super Admin, 2 upload an extension containing arbitrary PHP code, and 3 modify the configuration as administrators via unspecified vectors...

CVE-2007-6642: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to 1 add a Super Admin, 2 upload an extension containing arbitrary PHP code, and 3 modify the configuration as administrators via unspecified vectors...

CVE-2007-6614: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/frontpageright.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542...

Directory traversal

Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. dot dot in 1 the s parameter to the admin page or 2 the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under...

CVE-2007-6604

Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. dot dot in 1 the s parameter to the admin page or 2 the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under...

CVE-2007-6604

Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. dot dot in 1 the s parameter to the admin page or 2 the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under...

CVE-2007-6604

CVE-2007-6604 affects XCMS 1.82 and earlier. The vulnerability is in index.php, where directory traversal via a dot-dot sequence in two parameters (s on the admin page, or pg for an arbitrary module) lets remote attackers read arbitrary files. Demonstrations include reading a password hash from a...

XCMS 1.83 - Remote Command Execution

Name : XCMS So the xcms allow you to modify the footer throught a bugged page called cpie.php included in the admin panel. So let's take a look to the bugged code. So with a simple html form we can change the footer. Ex: /textarea...

jPORTAL 2.3.1 & UserPatch - 'forum.php' Remote Code Execution

 $host = $argv1; $path = $argv2; $phpcode = $argv3; $info = "\n\n". " jPORTAL 2.3.1 & UserPatch forum.php Remote PHP Code Execution Exploit\n". "\n". " author: irk4zatyahoo.pl\n". " http://irk4z.wordpress.com\n". "\n". "\n". " greetz: str0ke, wacky, polish under :\n"...

Remote file inclusion

PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the output parameter...