CVE-2006-5674

Multiple PHP remote file inclusion vulnerabilities in miniBB 2.0.2 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter to 1 bbfuncforums.php, 2 bbfunctions.php, or 3 the RSS plugin...

CVE-2006-5674

CVE-2006-5674 describes multiple PHP remote file inclusion vulnerabilities in miniBB 2.0.2 and earlier. When register_globals is enabled, an attacker can cause arbitrary PHP code execution by supplying a URL in the pathToFiles parameter to one of: bb_func_forums.php, bb_functions.php, or the RSS ...

CVE-2006-5612

CVE-2006-5612 describes a PHP remote file inclusion in GestArt beta 1, specifically in aide.php3 (also known as aide.php). When register_globals is enabled, the aide parameter can be exploited to execute arbitrary PHP code, i.e., a remote code execution vulnerability. The issue is tied to GestArt...

CVE-2006-5613

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler mp3SDS 3.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the fullpath parameter...

EUVD-2006-5598

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler mp3SDS 3.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the fullpath parameter...

[ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability

ECHOADV53$2006 ----------------------------------------------------------------------------------------- ECHOADV53$2006 QnECMS = 2.5.6 adminfolderpath Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran...

TextPattern <=1.19 Remote File Inclusion Vulnerability

---------------------------------------------------------------------------- TextPattern =g1.19 txpcfgtxpath Remote File Inclusion Vulnerability ---------------------------------------------------------------------------- Author : Zeni Susanto A.K.A Bithedz Date Found : October, 25th 2006 Locatio...

phpPowerCards 2.10 (txt.inc.php) Remote Code Execution Vulnerability

No description provided by source. +------------------------------------------------------------------------------------------- + phpPowerCards 2.10 txt.inc.php Remote Code Execution Vulnerability +------------------------------------------------------------------------------------------- +...

Segue CMS themesettings.inc.php themesdir Parameter Remote File Inclusion

The remote web server is running Segue CMS, an open source content management system tailored for educational institutions. The version of Segue CMS installed on the remote host fails to sanitize input to the 'themesdir' parameter before using it in the 'themes/program/themesettings.inc.php' scri...

CVE-2006-5533

CVE-2006-5533 pertains to multiple PHP remote file inclusion vulnerabilities in AROUNDMe 0.6.9 (and possibly earlier) where, when register_globals is enabled, an attacker can cause arbitrary PHP code execution via a URL in the templatePath parameter of template/barnraiser_01/pol_view.tpl.php and ...

CVE-2006-5511

Direct static code injection vulnerability in delete.php in JaxUltraBB JUBB 2.0, when registerglobals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter...

MambelFish组件mambelfish.class.php远程文件包含漏洞

MambelFish是一个Mambo组件，用于支持手工翻译过程。 MambelFish在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 模块的administrator/components/commambelfish/mambelfish.class.php脚本没有正确地验证mosConfigabsolutepath的输入： requireonce quot;$mosConfigabsolutepath/administrator/classes/minixml/minixml.inc.phpquot; ;...

TextPattern 1.19 - 'publish.php' Remote File Inclusion

---------------------------------------------------------------------------- TextPattern =g1.19 txpcfgtxpath Remote File Inclusion Vulnerability ---------------------------------------------------------------------------- Author : Zeni Susanto A.K.A Bithedz Date Found : October, 25th 2006 Locatio...

CMS Faethon <= 2.0 (mainpath) Remote File Include Exploit

No description provided by source. !/usr/bin/perl CMS Faethon 2.0 Ultimate Class: Remote/Local File Include Vulnerability Date: 2006/10/24 Remote: Yes Type: Highly critical Vendor: www.cmsfaethon.org...

CMS Faethon 2.0 - 'mainpath' Remote File Inclusion

!/usr/bin/perl CMS Faethon 2.0 Ultimate Class: Remote/Local File Include Vulnerability Date: 2006/10/24 Remote: Yes Type: Highly critical Vendor: www.cmsfaethon.org Download: http://cmsfaethon.org/downloads/...

Lou Portail 1.4.1 Remote|Local File Include Vulnerability

Lou Portail 1.4.1 Class: Remote|Local File Include Vulnerability Patch: Unavailable Published 2006/10/18 Remote: Yes Local: No Type: High Site: http://louportail.free.fr/ Author: MP Contact: [email protected] Vuln Code admin/adminmodule.php: ?... include "$gadminrep/adminutils.$gext"; ...? Vuln 1...

CVE-2006-5441

CVE-2006-5441 : In Comdev Web Blogger 4.1, the adminfoot.php file is vulnerable to PHP remote file inclusion when register_globals is enabled. An attacker can supply a URL in the path[docroot] parameter to execute arbitrary PHP code. This is exercised via a remote inclusion vector and is describe...

CVE-2006-5438

PHP remote file inclusion vulnerability in adminfoot.php in Comdev Forum 4.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter. NOTE: the provenance of this information is unknown; the details are obtained from third par...

EUVD-2006-5417

Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when registerglobals is enabled, allow remote attackers to create or overwrite arbitrary files via the 1 emailto, 2 emailfrom, 3 nameto, 4 namefrom, 5 picture, 6 comment, or 7 sessionID parameter, as...

CVE-2006-5440

The CVE-2006-5440 entry describes a PHP remote file inclusion in Comdev Form Designer 4.1, specifically in adminfoot.php. The root cause is the use of register_globals, enabling an attacker to supply a URL in the path[docroot] parameter to execute arbitrary PHP code on the server. This results in...