Remote file inclusion

PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter part of the $pagemenu variable...

Remote file inclusion

PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter...

CVE-2005-4734

Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web aka SecurID Web Agent 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method...

CVE-2006-1281

Cross-site scripting XSS vulnerability in member.php in MyBulletinBoard MyBB 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable...

Code injection

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1256

The CVE-2006-1256 entry corresponds to a cross-site scripting (XSS) vulnerability in Skull-Splitter’s PHP Guestbook (guestbook.php). Affected versions are 2.6 (and 2.7 per incident data) of Skull-Splitter’s PHP Guestbook. The root cause is improper sanitization of the url parameter, allowing remo...

horde -- "url" disclosure of sensitive information vulnerability

Secunia advisory SA19246: Paul Craig has discovered a vulnerability in Horde, which can be exploited by malicious people to disclose sensitive information. Input passed to the "url" parameter in "services/go.php" isn't properly verified, before it is used in a "readfile" call. This can be exploit...

Remote file inclusion

PHP remote file inclusion vulnerability in lib/OWLAPI.php in OWL Intranet Engine 0.82, when registerglobals is enabled, allows remote attackers to include arbitrary files via a URL in the xrmsfileroot parameter, which is not initialized before use...

CVE-2006-1099

PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Remote file inclusion

PHP remote file include vulnerability in solmenu.php in PeHePe Uyelik Sistemi aka PeHePe MemberShip Management System 3 allows remote attackers to include and execute arbitrary PHP code via a URL in the uyeklasor parameter, along with a misafir parameter that is set to UYESEVIYE...

CVE-2006-0188

webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the rightframe parameter. NOTE: this has been called a cross-site scripting XSS issue, but it is different than what is normally identified as XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2006-0776

Cross-site scripting XSS vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2006-0706

Cross-site scripting vulnerability in eintrag.php in Gästebuch Gastebuch before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the URL, which is used in the homepage parameter...

Remote file inclusion

PHP remote file include vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the basepath parameter...

CVE-2006-0565

PHP remote file include vulnerability in inc/backendsettings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALSpath parameter...

Code injection

Unspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via "evilcode" in the key parameter, possibly a PHP remote file include vulnerability in which the attack vector is a URL in t...

CVE-2006-0502

PHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with registerglobals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter...