201 matches found
Pligg settemplate.php template Parameter Local File Inclusion
The remote host is running Pligg, an open source content management system. The installed version of Pligg fails to sanitize the 'template' cookie before using it in 'config.php' to include PHP code. An unauthenticated, remote attacker can exploit this issue to view arbitrary files or even execut...
Directory traversal
Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitrary local files, and probably remote files, via a .. dot dot in the template parameter...
CVE-2008-0139
Eval injection vulnerability in loudblog/inc/parseold.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the template parameter...
Sql injection
Eval injection vulnerability in loudblog/inc/parseold.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the template parameter...
CVE-2008-0139
CVE-2008-0139 affects Loudblog 0.8.0 and earlier. An Eval injection in loudblog/inc/parse_old.php via the template parameter allows remote attackers to execute arbitrary PHP code. CVSS2 base metrics indicate Network access, no authentication, and partial impact to confidentiality, integrity, and ...
CVE-2007-6268
Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...
Directory traversal
Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...
CVE-2007-6268
In CVE-2007-6268, Absolute News Manager.NET 5.1 is vulnerable via directory traversal in pages/default.aspx, allowing an attacker to read arbitrary files by manipulating the template parameter (..). The underlying issue is a path traversal in the template parameter; no exploitation details are pr...
CVE-2007-4863
SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via the template parameter...
Sql injection
SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via the template parameter...
CVE-2003-1425
The CVE affects cPanel 5.0’s guestbook.cgi, where the template parameter is not properly filtered, enabling remote command execution. An attacker could run arbitrary commands on the host with the web server’s privileges via the /guestbook.cgi?template=... input. Exploitation details in connected ...
Directory traversal
Directory traversal vulnerability in Ada Image Server ImgSvr 0.6.5 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE...
PT-2007-4165 · Saxon · Saxon
Name of the Vulnerable Software and Affected Versions: SAXON version 4.6 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the template parameter to specific PHP files, including 1 "news.php", 2 "preview.php", or 3 "archive-display.php". Recommendations: Fo...
Directory traversal
Directory traversal vulnerability in H-Sphere SiteStudio 1.6 allows remote attackers to read, or include and execute, arbitrary local files via a .. dot dot in the template parameter...
Directory traversal
Directory traversal vulnerability in includes/footer.php in News Manager Deluxe NMDeluxe 1.0.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...
Directory traversal
Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...
CVE-2006-4428
PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to execute arbitrary PHP code via a URL in the template parameter. NOTE: CVE disputes this claim, since the $template variable is defined as a static value before it is referenced in an include...
PT-2006-5229 · Jupiter · Jupiter Cms
Name of the Vulnerable Software and Affected Versions: Jupiter CMS version 1.1.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the template parameter in the index.php file. However, it's noted that the $template variable is defined as a static value...
CVE-2006-3611
Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALStemplate parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php...