EUVD-2006-3337

Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the 1 phpbbrootpath parameter in a includes/functionscms.php and the 2 GlobalSettingstemplatesDirectory parameter i...

CVE-2006-3340

CVE-2006-3340 affects the Pearl For Mambo module 1.6 for Mambo. It describes multiple PHP remote file inclusion flaws when register_globals is enabled, allowing remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter in includes/functions_cms.php and GlobalSettings[templa...

CVE-2006-3302

The CVE describes a PHP remote file inclusion in CBSMS Mambo Module 1.0 and earlier. When register_globals is enabled, an attacker can inject a URL via the mosC_a_path parameter to execute arbitrary PHP code on the affected system. Connected documents corroborate the vulnerability class and note ...

QaTraq 6.5 RC: Multiple XSS Vulnerabilities

=========================================================== QaTraq 6.5 RC: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0606-001, June 23, 2006...

MagNet BeeHive CMS (header) - Remote File Inclusion

MagNet BeeHive CMS header - Remote File Inclusion --------------------------------------------------------------------------- Beehive CMS header Remote File Include Vulnerabilities --------------------------------------------------------------------------- Discovered By Kw3RLn Romanian Security...

CVE-2006-3193

Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 includes/content/contactcontent.php; multiple files in adminpanel/includes/addforms/...

CVE-2006-3174

Cross-site scripting XSS vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter...

CVE-2006-3174

CVE-2006-3174 is a cross-site scripting (XSS) vulnerability in SquirrelMail up to version 1.5.1, triggered in search.php when register_globals is enabled. An attacker could inject arbitrary HTML via the mailbox parameter, potentially affecting users who view the affected page. Connected documents...

[SA20713] CMS Faethon "mainpath" File Inclusion and Cross-Site Scripting Vulnerabilities

---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...

CVE-2006-3069

DoubleSpeak 0.1 is affected by a PHP remote file inclusion when register_globals is enabled, allowing an attacker to execute arbitrary PHP code via config[private] in multiple files (index.php, faq.php, hardware.php). The root cause is the handling of config[private] in those files; third-party r...

FreeBSD : WebCalendar -- information disclosure vulnerability (09c92f3a-fd49-11da-995c-605724cdf281)

Secunia reports : socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information. Input passed to the 'includedir' parameter isn't properly verified, before it is used in an 'fopen' call...

CVE-2006-2997

Cross-site scripting XSS vulnerability in ZMS 2.9 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the raw parameter in the search field...

DSA-1096-1 webcalendar - uninitialised variable

Bulletin has no description...

[MajorSecurity #11]OpenCMS<= 6.2.1 - XSS

MajorSecurity 11OpenCMS= 6.2.1 - XSS ------------------------------------------ Software: OpenCMS Version: =6.2.1 Type: Cross site scripting Date: June, 10th 2006 Vendor: Alkacon Software GmbH Page: http://www.alkacon.com http://www.opencms.org/opencms/en/ Credits: ----------------------------...

Remote file inclusion

PHP remote file inclusion vulnerability in cmproheader.inc.php in Clan Manager Pro CMPRO 1.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the 1 cmextserver and 2 sitepath parameters...

CVE-2006-2921

CVE-2006-2921 affects Clan Manager Pro (CMPRO) 1.1 and earlier. The vulnerability is a PHP remote file inclusion in cmpro_header.inc.php when register_globals is enabled, enabling an attacker to run arbitrary PHP code via a URL in the (1) cm_ext_server and (2) sitepath parameters. The provided do...

CVE-2006-2928

CMS-Bandits 2.5 and earlier are affected by multiple PHP remote file inclusion vulnerabilities when register_globals is enabled. The issue allows remote attackers to execute arbitrary PHP code by supplying a crafted URL in the spaw_root parameter of dialogs/img.php and dialogs/td.php. Root cause:...

OpenEMR C_FormEvaluation.class.php fileroot Parameter Remote File Inclusion

The remote host is running OpenEMR, a web-based medical records application written in PHP. The version of OpenEMR installed on the remote host fails to sanitize input to the 'fileroot' parameter before using it in the 'contrib/forms/evaluation/CFormEvaluation.class.php' script to include PHP cod...

CVE-2006-2881

Multiple PHP remote file inclusion vulnerabilities in DreamAccount 3.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dapath parameter in the 1 auth.cookie.inc.php, 2 auth.header.inc.php, or 3 auth.sessions.inc.php scripts...

CVE-2006-2881

DreamAccount 3.1 and earlier are affected by multiple PHP remote file inclusion vulnerabilities. When register_globals is enabled, an attacker can cause arbitrary PHP code execution by supplying a URL to the da_path parameter in one of three scripts: auth.cookie.inc.php, auth.header.inc.php, or a...