CVE-2009-2634

PHP remote file inclusion vulnerability in toolbarext.php in the MediaLibrary commedialibrary component 1.5.3 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2009-2641

PHP remote file inclusion vulnerability in appandreadme/navigator/index.php in School Data Navigator allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. dot dot sequences...

CVE-2009-2396

PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITYFILE parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASEDIRjaxformmailer parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in install/di.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtoserverdata parameter. NOTE: the installation instructions specify deleting the install/ folder...

CVE-2009-2228

Cross-site scripting XSS vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web script or HTML via the url parameter in a redirect action...

CVE-2009-2218

Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the home parameter to 1 ihead.php, 2 inav.php, 3 usernew2.php, or 4 house/myrents.php; or 5 allbooks.php, 6 home.php,...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 adpopup.php, 2 camphtml.php, 3 initcontent.php, 4 logout.php, 5 menu.php, and 6 set-author.php in admin-files/; 7...

Design/Logic Flaw

pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message...

CVE-2009-1779

PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the formincludetemplate parameter...

CVE-2009-1450

PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the pagecontent parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in html/admin/modules/pluginadmin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the settingspluginpath parameter...

CVE-2008-6740

PHP remote file inclusion vulnerability in html/admin/modules/pluginadmin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the settingspluginpath parameter...

CVE-2008-6740

PHP remote file inclusion vulnerability in html/admin/modules/pluginadmin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the settingspluginpath parameter...

CVE-2009-1315

Multiple cross-site scripting XSS vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 gid parameter to groupsprofile.php, 2 catid and 3 razdid parameters to advcat.php, and the 4 URL to blogsfull.php...

Remote file inclusion

PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dirinc parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the themedirectory parameter to 1 container.php and 2 header.php in themes/...

CVE-2008-6584

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

Design/Logic Flaw

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

CVE-2008-6584

The affected software is TorrentFlux 2.3 (html/index.php). The vulnerability arises from the url_upload parameter, which accepts a URL to a file with an executable extension; TorrentFlux downloads this file and it can be accessed directly in the html/downloads/ user directory. This enables remote...