7259 matches found
CVE-2004-1421
Multiple PHP remote file inclusion vulnerabilities 1 stepone.php, 2 steponetables.php, 3 steptwotables.php in WHM AutoPilot 2.4.6.5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the serverinc parameter to reference a URL on a remote web server that contains the cod...
CVE-2004-1505
Directory traversal vulnerability in index.php in Just Another Flat file JAF CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. dot dot in the show parameter...
CVE-2004-1746
Cross-site scripting XSS vulnerability in index.php in PHP Code Snippet Library allows remote attackers to inject arbitrary web script or HTML via the 1 catselect or 2 show parameters...
PHProjekt: Remote code execution vulnerability
Background PHProjekt is a modular groupware web application used to coordinate group activities and share files. Description cYon discovered that the authform.inc.php script allows a remote user to define the global variable $pathpre. Impact A remote attacker can exploit this vulnerability to for...
CVE-2004-1227
CVE-2004-1227 affects SugarCRM Sugar Sales 2.0.1c and earlier. The vulnerability is a directory traversal flaw allowing remote attackers to read arbitrary files and potentially execute PHP code via dot-dot sequences in several parameters to index.php and Login.php (and possibly other scripts). Ro...
alexPHP.txt
Informations : °°°°°°°°°°°°°° Website : http://www.alexphpteam.com Version : all Problem : Include file PHP Code/Location : °°°°°°°°°°°°°°°°°°° ./include/livreinclude.php ------------------------------------------------------------------ if !$noconnect.... some include functions...
Debian DSA-346-1 : phpsysinfo - directory traversal
Albert Puigsech Galicia reported that phpsysinfo, a web-based program to display status information about the system, contains two vulnerabilities which could allow local files to be read, or arbitrary PHP code to be executed, under the privileges of the web server process usually www-data. These...
CVE-2002-1211
Prometheus 6.0 and earlier is vulnerable to remote PHP code execution via a tainted PROMETHEUS_LIBRARY_BASE that can be set to a remote server and loaded by index.php, install.php, or test_*.php. The underlying flaw is the conditional inclusion of files (autoload.lib, prometheus-lib.path) based o...
CVE-2002-1113
CVE-2002-1113 affects Mantis Control/issue tracker: summary_graph_functions.php in Mantis ≤ 0.17.3 allows remote code execution by altering g_jpgraph_path to point to PHP code. The root cause is the g_jpgraph_path parameter not being validated, enabling an attacker to reference arbitrary PHP as c...
CVE-2002-1113
summarygraphfunctions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the gjpgraphpath parameter to reference the location of the PHP code...
CVE-2002-1435
class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allowurlfopen' setting is enabled via a URL in the configatkroot parameter that points to the code...
PHP Code Snippet Library index.php Multiple Parameter XSS
The remote host is running PHP Code Snippet Library PHP-CSL, a library written in PHP. The remote version of this software fails to sanitize input to the 'catselect' parameter of the 'index.php' script. This can be used to take advantage of the trust between a client and server allowing the...
Gallery save_photos.php Arbitrary Command Execution
The version of Gallery hosted on the remote web server is affected by an arbitrary command execution vulnerability. This could allow an attacker to execute arbitrary commands on the remote host by uploading a file containing arbitrary PHP code. When the temp directory is web accessible, the...
Mantis Bugtracker Remote PHP Code Execution Vulnerability
--------------------------------------------------------------------------- Mantis Bugtracker Remote PHP Code Execution Vulnerability --------------------------------------------------------------------------- Author: Joxean Koret Date: 08-01-2004 Location: Basque Country...
PHP Code Snippet Library 'index.php' XSS
Binary data 2149.prm...
Coppermine Gallery < 1.1 Beta 2 PHP Code Execution (deprecated)
Binary data 1567.prm...
[UNIX] YaPiG add_comment.php PHP Code Injection
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
CVE-2004-0490
cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...