CVE-2006-4630

CVE-2006-4630 describes a PHP remote file inclusion in jscript.php for Sky GUNNING MySpeach 3.0.2 and earlier. When register_globals is enabled, an attacker can cause arbitrary PHP code execution via a URL in the my_ms[root] parameter. Affected versions are 3.0.2 and earlier; impact is remote cod...

CVE-2007-1895

CVE-2007-1895 describes a PHP remote file inclusion in Sky GUNNING MySpeach (3.0.7 and earlier) when run with PHP 5. An FTP URL placed in the my_ms[root] cookie enables remote attackers to execute arbitrary PHP code. Connected documents corroborate variants of this vulnerability across MySpeach 3...

CVE-2007-1896

CVE-2007-1896 is a directory-traversal flaw in Sky GUNNING MySpeach 3.0.7 and earlier, affecting the file chat.php . The root cause is improper handling of a cookie parameter my_ms[root], allowing a attacker to trigger local file inclusion by using a double dot (“..”) path traversal with a traili...

CVE-2007-0498

MySpeach 2.1 beta (and possibly earlier) is affected by CVE-2007-0498 via up.php, allowing remote PHP code execution through a URL parameter my[root]. This is a PHP remote file inclusion vulnerability with a base score of 7.5 (HIGH) and network attack vector, per NVD, and the documents do not pro...

CVE-2007-0491

CVE-2007-0491 is a PHP remote file inclusion vulnerability in Sky GUNNING MySpeach 3.0.6 and earlier, exploitable via a URL in the my_ms[root] parameter of up.php. The issue is a separate vector from CVE-2006-4630 and affects MySpeach components prior to 3.0.6. The connected records confirm relat...