CVE-2008-4358

Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors, probably related to directory traversal sequences in the theme name...

CVE-2008-4358

Technical details for CVE-2008-4358 are not publicly available in the provided documents; monitor for updates.

Remote file inclusion

PHP remote file inclusion vulnerability in admin/spaw/spawcontrol.class.php in the XT-Conteudo module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

xoops module tinycontent 1.5 - Remote File Inclusion

XOOPS Module TinyContent Remote File Inclusion version: 1.5 source: http://prdownloads.sourceforge.net/xoops/xoops2-mod-tinycontent15.zip Discovered by SpLo1T from hTTP://hacking.3Xforum.Ro BUG: http://www.site.com/modules/tinycontent/admin/spaw/spawcontrol.class.php?spawroot=evilcode.txt? Vuln...

xoops module tinycontent 1.5 - Remote File Inclusion

xoops module tinycontent 1.5 - Remote File Inclusion XOOPS Module TinyContent Remote File Inclusion version: 1.5 source: http://prdownloads.sourceforge.net/xoops/xoops2-mod-tinycontent15.zip Discovered by SpLo1T from hTTP://hacking.3Xforum.Ro BUG:...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insertlink.php in download engine Download-Engine 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the spawroot parameter, a different vector than CVE-2007-2255. NOTE: this may be an issue in...

CVE-2007-2289

CVE-2007-2289 describes a PHP remote file inclusion in Download-Engine.1.4.1, via the spaw_root parameter in admin/includes/spaw/dialogs/insert_link.php, allowing remote authenticated users to execute arbitrary PHP code. This is a different vector than CVE-2007-2255. No remediation or fix details...

CVE-2007-2289

PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insertlink.php in download engine Download-Engine 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the spawroot parameter, a different vector than CVE-2007-2255. NOTE: this may be an issue in...

CVE-2007-2255

Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 engdir parameter to addmember.php, 2 langpath parameter to admin/enginelib/class.phpmailer.php, and the 3 spawroot parameter to...

CVE-2007-2255

Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 engdir parameter to addmember.php, 2 langpath parameter to admin/enginelib/class.phpmailer.php, and the 3 spawroot parameter to...

bloofoxCMS 0.2.2 Cross Site Scripting

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

spaw-rfi.txt

Remote IInclude File : SPAW Editor PHP Edition upgrade version 1.2.3 to 1.2.4 Discovered By : Hasadya Raed Contact Me : RaeDatBsdMaildotCom Download Script: http://heanet.dl.sourceforge.net/sourceforge/spaw/spaw-php-123-to-124.zip B.File :imglibrary.php : include $spawroot.'class/util.class.php';...

SPAW Editor PHP Edition

Remote IInclude File : SPAW Editor PHP Edition upgrade version 1.2.3 to 1.2.4 Discovered By : Hasadya Raed Contact Me : RaeDatBsdMaildotCom Download Script: http://heanet.dl.sourceforge.net/sourceforge/spaw/spaw-php-123-to-124.zip B.File :imglibrary.php : include $spawroot.'class/util.class.php';...

SPAW PHP Editor 远程文件包含漏洞

SPAW PHP Editor是一款基于PHP的WEB应用程序。 SPAW PHP Editor不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是多个脚本对用户提交的'spawdir'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 SOLMETRA SPAW PHP Editor 1.0.7 SOLMETRA SPAW PHP Editor 1.0.6 http://www.solmetra.com/en/disp.php/enproducts/enspaw/enspawabout...

phpwcms <= 1.1-RC4 (spaw) Remote File Include Vulnerability

No description provided by source. PhpwCMS 1.2.6 = Multiple Remote file inclusion vulnerabilities Discovered by : |/| . .. | || ||| | | Vuln In : include $spawroot.'class/lang.class.php'; Affected Files : include/incext/spaw/dialogs/table.php include/incext/spaw/dialogs/a.php...

CVE-2006-5291

PHP remote file inclusion vulnerability in admin/includes/spaw/spawcontrol.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PH...

CVE-2006-5291

The vulnerability CVE-2006-5291 affects Download-Engine 1.4.2 through a PHP remote file inclusion in admin/includes/spaw/spaw_control.class.php, exploitable via a URL in the spaw_root parameter to execute arbitrary PHP code on the server. The issue is noted as potentially in the third-party SPAW ...

Download-Engine 1.4.2 - spaw Remote File Inclusion

Download-Engine 1.4.2 - spaw Remote File Inclusion ====================================================================================== Download-Engine Remote File Include ====================================================================================== Info:- Scripts: Download-Engine...

Download-Engine <= 1.4.2 (spaw) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================= Download-Engine = 1.4.2 spaw Remote File Include Vulnerability =================================================================...

Download-Engine 1.4.2 - 'spaw' Remote File Inclusion

====================================================================================== Download-Engine Remote File Include ====================================================================================== Info:- Scripts: Download-Engine Download:...