CVE Vulnerability Catalog

A vulnerability in preview_email.cgi in Barracuda Spam Firewall (versions 3.3.01.001 through 3.3.03.053) allows remote attackers to execute arbitrary commands via shell metacharacters (the "|" pipe symbol) in the file parameter. The attack can be extended to arbitrary commands due to the presence of CVE-2006-4000.

A vulnerability in pm.php (the PM system) in DeluxeBB 1.08 and possibly earlier allows remote attackers to bypass authentication by providing an arbitrary username in the 'membercookie' cookie parameter. An attacker can gain access to another user's account without knowing the password.

PHP remote file inclusion vulnerability in CheckUpload.php in Vincenzo Valvano Comet WebFileManager (CWFM) 0.9.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the Language parameter.

Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbitrary PHP code via a URL in the base_dir parameter to login.php, reactivate.php, or register.php.

ME Download System 1.3 contains multiple PHP remote file inclusion vulnerabilities. A remote attacker can execute arbitrary PHP code by supplying a malicious URL in the Vb8878b936c2bd8ae0cab parameter to inc/sett_style.php or inc/sett_smilies.php, or in the Vb6c4d0e18a204a63b38f, V18a78b93c3adaaae84e2, or V9ae5d2ca9e9e787969ff parameters to inc/datei.php.

PHP remote file inclusion vulnerability in auto_check_renewals.php in phpAutoMembersArea (phpAMA) 3.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter.

Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) admin/index.php, (2) admin/adminindex.php, (3) admin/adminglobal.php, (4) admin/login.php, (5) admin/menu.php or (6) admin/header.php.

PHP remote file inclusion vulnerability in index.php in Thomas Pequet phpPrintAnalyzer 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rep_par_rapport_racine parameter. The issue has been disputed by third party researchers, stating that the rep_par_rapport_racine variable is initialized before use.

Multiple PHP remote file inclusion vulnerabilities in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter to include/colorswitch.php, contentimages.class.php, ipfunctions.php, configfunctions.php, printpagedetails.php, or log.class.php.

YenerTurk Haber Script 1.0 and earlier, as well as 2.0, contains a SQL injection vulnerability in default.asp. An unauthenticated remote attacker can execute arbitrary SQL commands via the id parameter.

Multiple PHP remote file inclusion vulnerabilities in Csaba Godor SAPID Blog Beta 2 and earlier allow remote attackers to execute arbitrary PHP code by manipulating the root_path or GLOBALS[root_path] parameter in several .inc.php files.

Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.

PHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter.

Multiple PHP remote file inclusion vulnerabilities exist in USOLVED NEWSolved Lite 1.9.2, and possibly earlier versions. An attacker can supply a malicious URL in the abs_path parameter to one of five files, leading to arbitrary PHP code execution on the server.

Buffer overflow vulnerability in the preview_create function in gui.cpp in Mitch Murray Eremove 1.4. A remote attacker can cause a denial of service (application crash) and possibly execute arbitrary code via a large email attachment.

PHP remote file inclusion vulnerability in calendar.php in Visual Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_dir parameter.

SQL injection vulnerability in Pike before 7.6.86, when using a Postgres database server, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.

A PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP code by supplying a URL in the pfad parameter.

A PHP remote file inclusion vulnerability in myevent.php in myWebland myEvent 1.3 and earlier allows remote attackers to execute arbitrary PHP code by supplying a URL in the myevent_path parameter.

Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the title, url, excerpt, or blog_name parameters.