CVE-2008-6499

security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows remote attackers to spoof critical variables, as demonstrated by setting the REMOTEADDR variable to 127.0.0.1...

CVE-2008-5113

WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery CSRF attacks via crafted cookies, as demonstrated by attacks that 1 delete user accounts or 2 cause a...

Cross site request forgery (csrf)

WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery CSRF attacks via crafted cookies, as demonstrated by attacks that 1 delete user accounts or 2 cause a...

CVE-2008-5113

CVE-2008-5113 affects WordPress 2.6.3, where reliance on the REQUEST superglobal in certain dangerous situations enables remote attackers to perform delayed, persistent CSRF via crafted cookies, potentially deleting user accounts or causing denial of service. The description notes an independent ...

CVE-2007-4342

PHP remote file inclusion vulnerability in include.php in PHPCentral Login 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the SERVERDOCUMENTROOT parameter. NOTE: a third party disputes this vulnerability because of the special nature of the SERVER superglobal array...

CVE-2007-2624

Dynamic variable evaluation vulnerability in shared/config/cpconfig.php in All In One Control Panel AIOCP before 1.3.016 allows remote attackers to conduct cross-site scripting XSS and possibly other attacks via the SERVER superglobal array. NOTE: some of these details are obtained from third par...

CVE-2007-2624

The CVE-2007-2624 entry concerns All In One Control Panel (AIOCP) before 1.3.016, where a dynamic variable evaluation vulnerability in shared/config/cp_config.php enables remote XSS via the SERVER superglobal array. The issue stems from processing user-supplied data in SERVER-related variables, a...

Design/Logic Flaw

Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the REQUEST superglobal array...

CVE-2007-0975

Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the REQUEST superglobal array...