CVE-2006-4271: Undefined Security Weakness

PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the...

CVE-2006-4269: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component comx-shop 1.7 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: this issue has been disputed by third party researchers...

CVE-2006-4242: Undefined Security Weakness

PHP remote file inclusion vulnerability in install.jim.php in the JIM 1.0.1 component for Joomla or Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-4277: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIBDIR parameter to 1 include/novalib/class.novaAdmin.mysql.php and 2 novalib/class.novaRead.mysql.php. NOTE: the provenance of this information...

CVE-2006-4263: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Product Scroller Module and other modules in mambo-phpshop comphpshop for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter in 1 modphpshop.php, 2 modphpshopallinone.php...

tikiwiki -- multiple vulnerabilities

Secunia reports: Thomas Pollet has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "highlight" parameter in tiki-searchindex.php is not properly sanitised before being returned to the user. This can be...

CVE-2006-4278: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the mainnav parameter...

CVE-2006-4239: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool OPT Max 1.2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CRMinc parameter...

Mambo Component Display MOSBot Manager - 'MosConfig_absolute_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/19621/info The Mambo Display MOSBot Manager component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PH...

Mambo Component EstateAgent 1.0.2 - MosConfig_absolute_path Remote File Inclusion

source: https://www.securityfocus.com/bid/19625/info The Mambo EstateAgent component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and...

DieselScripts Smart Traffic - 'index.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/19630/info Smart Traffic is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the...

ToendaCMS 0.x/1.0.x - 'TCMS_Administer' Remote File Inclusion

source: https://www.securityfocus.com/bid/19626/info ToendaCMS is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the conte...

Mambo Component LMTG Myhomepage 1.2 - Multiple Remote File Inclusions

Mambo Component LMTG Myhomepage 1.2 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/19584/info The lmtgmyhomepage component for Mambo is prone multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploi...

Echo Security Advisory 2006.44

ECHOADV44$2006 ------------------------------------------------------------------------------ ECHOADV44$2006 PHP Simple Shop = 2.0 abspath Remote File Inclusion ------------------------------------------------------------------------------ Author : Ahmad Maulana a.k.a Matdhule Date Found : August...

CVE-2006-4230: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in index.php in Lizge V.20 Web Portal allow remote attackers to execute arbitrary PHP code via a URL in the 1 lizge or 2 bade parameters...

CVE-2006-4229: Undefined Security Weakness

PHP remote file inclusion vulnerability in archive.php in the mosListMessenger Component comlm before 20060719 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

Mambo Component LMTG Myhomepage 1.2 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/19584/info The lmtgmyhomepage component for Mambo is prone multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing maliciou...

CVE-2006-4196

PHP remote file inclusion vulnerability in index.php in WEBInsta CMS 0.3.1 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the templatesdir parameter...

CVE-2006-4198

PHP remote file inclusion vulnerability in includes/session.php in Wheatblog wB 1.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wbclassdir parameter...

CVE-2006-4215

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig9990loadFile parameter...