CVE-2007-1908

The CVE-2007-1908 entry describes a PHP file inclusion flaw in PHP121 Instant Messenger 2.2. An attacker can trigger arbitrary PHP code execution by passing a UNC share pathname or a local file pathname to the php121dir parameter, which is checked with file_exists. This is a remote-code-execution...

CVE-2006-1828

CVE-2006-1828 affects PHP121 1.4, specifically php121language.php. The vulnerability arises from SQL injection through the sess_username value set by the php121un HTTP COOKIE parameter, which is used in multiple files including php121login.php. The code execution occurs because the SQL query resu...