CVE Vulnerability Catalog

PHP remote file inclusion vulnerability in data/header.php in CMS Faethon 1.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter.

Directory traversal vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to read arbitrary files via a '..' (dot dot) sequence in the uid parameter on the rss page.

SQL injection vulnerability in CS-Forum before 0.82 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) debut parameters in (a) read.php, and the (3) search and (4) debut parameters in (b) index.php.

PHP remote file inclusion vulnerability in Admin/rtf_parser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter.

SQL injection vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to execute arbitrary SQL commands via the browse parameter.

Content*Builder 0.7.5 contains multiple PHP remote file inclusion vulnerabilities in libraries/comment/postComment.php, modules/poll/poll.php, modules/archive/overview.inc.php, and modules/forum/showThread.inc.php. Remote attackers can inject a URL via the path[cb], rel, or actualModuleDir parameters, leading to arbitrary PHP code execution.

Virtual War (VWar) 1.5.0 R14 and earlier contains multiple SQL injection vulnerabilities in war.php. Remote attackers can execute arbitrary SQL commands via the s, showgame, sortorder, and sortby parameters.

A vulnerability in index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload. A remote attacker can bypass security checks and upload or execute arbitrary PHP code via the add action.

SQL injection vulnerability in misc.php in SaphpLesson 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the action parameter.

SQL injection vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability, possibly in search.inc.php, in Open-Realty 2.3.1 allows remote attackers to execute arbitrary SQL commands via the sorttype parameter to index.php.

PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier allows remote attackers to execute arbitrary PHP code via a URL in the microcms_path parameter. It was later reported that this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.

phpTRADER 4.9 SP5 and earlier contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via parameters such as sectio, an, who, and adnr in various script files.

Remote file inclusion (RFI) vulnerability in include/inc_foot.php in SmartSiteCMS 1.0 and earlier. A remote attacker can execute arbitrary PHP code by supplying a malicious URL in the root parameter.

IMGallery 2.4 and earlier contains multiple SQL injection vulnerabilities in galeria.php. A remote attacker can execute arbitrary SQL commands via the start or sort parameters.

SQL injection vulnerability in category.php in TPL Design tplShop 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the first_row parameter.

SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.

SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter.

SQL injection vulnerability in index.php in openCI 1.0 BETA 0.20.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.