CVE-2007-2182

The CVE concerns an unrestricted file upload vulnerability in Maran PHP Forum’s forum_write.php. The issue arises from allowing a trailing %00 in a filename in the page parameter, enabling remote attackers to upload and execute arbitrary PHP files. The documented impact is partial confidentiality...

AjPortal2Php (PagePrefix) Remote File Inclusion Vulnerabilities

No description provided by source. AjPortal2Php Class: File Include Vulnerability Remote: Yes Site: http://www.ajlopez.com/downloads/AjPortal2Php.zip Author: Alkomandoz Hacker Contact: [email protected] file ; begin.inc.php connection.inc.php events.inc.php footer.inc.php header.inc.p...

CVE-2007-2024

Unrestricted file upload vulnerability in the UpLoad feature lib/plugin/UpLoad.php in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a 1 php3, 2 php4, or 3 php5 extension...

Unrestricted file upload

Unrestricted file upload vulnerability in the UpLoad feature lib/plugin/UpLoad.php in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a 1 php3, 2 php4, or 3 php5 extension...

CVE-2007-2024

Unrestricted file upload vulnerability in the UpLoad feature lib/plugin/UpLoad.php in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a 1 php3, 2 php4, or 3 php5 extension...

Integer overflow

Multiple vulnerabilities in 1 bank.php, 2 landfill.php, 3 outposts.php, 4 tribes.php, 5 house.php, 6 tribearmor.php, 7 tribeastral.php, 8 tribeware.php, and 9 includes/head.php in Bartek Jasicki Vallheru before 1.3 beta have unknown impact and remote attack vectors, probably related to large...

CVE-2007-1408

Multiple vulnerabilities in 1 bank.php, 2 landfill.php, 3 outposts.php, 4 tribes.php, 5 house.php, 6 tribearmor.php, 7 tribeastral.php, 8 tribeware.php, and 9 includes/head.php in Bartek Jasicki Vallheru before 1.3 beta have unknown impact and remote attack vectors, probably related to large...

ActiveCalendar 1.2.0, Multiple vulnerabilities

ActiveCalendar 1.2.0, Multiple vulnerabilities Vendor site : http://www.micronetwork.de/activecalendar/ Global risk : Critical Multiples XSS : --------------- /activecalendar/data/page.php?css="scriptalertdocument.cookie/script In : /data/ flatevents.php js.php mysqlevents.php m2.php m3.php m4.ph...

CVE-2006-7049

The Method method in WikkaWiki Wikka Wiki before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files...

CVE-2006-7049

The Method method in WikkaWiki Wikka Wiki before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files...

Discloser远程文件包含漏洞

Discloser是一款基于PHP的WEB应用程序。 Discloser不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'content.php'和'indexhead.php'脚本对用户提交的'fileloc'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Discloser Discloser 0.0.4 http://optusnet.dl.sourceforge.net/sourceforge/discloser/...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

PT-2006-6801 · Active Php · Active Php Bookmarks

Name of the Vulnerable Software and Affected Versions: Active PHP Bookmarks version 1.1.02 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the APB SETTINGS'apb path' parameter in 1 apb common.php or 2 apb.php. However, it is noted that the PHP scripts exi...

XSS in script Mobile

Discovered : SwEET-DeViL & HaCkEr sUn Product: http://www.ac4p.com tame : AL-garnei :::::::::::::::::::::::::::::::::::::::::: /1/ index.php http://www.site.com/path/index.php?Bloks=XSS http://www.site.com/path/index.php?Newnews=XSS http://www.site.com/path/index.php?lBlok=XSS...

AFGB GUESTBOOK 2.2 (Htmls) Remote File Include Vulnerabilities

No description provided by source. afgb GUESTBOOK V2.2 Htmls Remote File Include Vulnerability Turkish Hacker's Discovered By : mdX ------------------------------------------------------ Cyber-Warrior TIM Ay ve YIldIzlar Geceye YakISIr... the moon and the stars suit the night Class : REmote File...

CVE-2006-5027

CVE-2006-5027 affects JevonCMS (possibly pre-alpha). An attacker can remotely obtain sensitive information by directly requesting specific PHP include files (php/main/phplib files: db_msql.inc, db_mssql.inc, db_mysql.inc, db_oci8.inc, db_odbc.inc, db_oracle.inc, db_pgsql.inc, and db_sybase.inc). ...

PT-2006-5603 · Hitweb · Hitweb

Name of the Vulnerable Software and Affected Versions: Hitweb versions 3.0 Description: The issue concerns remote file inclusion vulnerabilities in Hitweb 3.0, allowing remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the REP CLASS parameter to various PHP...

CVE-2006-4743

CVE-2006-4743 affects WordPress 2.0.2 through 2.0.5, allowing remote attackers to obtain sensitive information by requesting specific PHP files (e.g., 404.php, akismet.php, archive.php, etc.), which causes error messages that reveal internal paths. The connected documents corroborate the list of ...

PT-2006-5352 · Yacs · Yacs Cms

Name of the Vulnerable Software and Affected Versions: YACS CMS version 6.6.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the contextpath to root parameter in several PHP files, including "articles/populate.php", "categories/category.php",...

Tons of SQL-injections and XSS in Eichhorn Portal and vendor page

Hi list. There are lots of SQL injections and XSS in the 'Eichhorn Portal' by 'Guder und Koch Netzwerktechnik' and their own website. Input passed to multiple parameters in different PHP-files isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary...