CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2007(File Inclusion)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-6585 94 Exec Code File Inclusion 2007-12-28 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the output parameter.
2 CVE-2007-6568 94 Exec Code File Inclusion 2007-12-28 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
3 CVE-2007-6555 94 Exec Code File Inclusion 2007-12-27 2017-09-28
9.3
 None Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter.
4 CVE-2007-6553 94 Exec Code File Inclusion 2007-12-27 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONF[app_root] parameter to (1) tcuser.class.php, (2) absencecount.inc.php, (3) avatar.inc.php, (4) csvhandler.class.php, (5) functions.tcpro.php, (6) header.html.inc.php, (7) joomlajack.tcpro.php, (8) menu.inc.php, (9) other.inc.php, (10) tcabsence.class.php, (11) tcabsencegroup.class.php, (12) tcallowance.class.php, (13) tcannouncement.class.php, (14) tcconfig.class.php, (15) tcdaynote.class.php, (16) tcgroup.class.php, (17) tcholiday.class.php, (18) tclogin.class.php, (19) tcmonth.class.php, (20) tctemplate.class.php, (21) tcusergroup.class.php, or (22) tcuseroption.class.php in includes/, possibly a related issue to CVE-2006-4845.
5 CVE-2007-6542 94 Exec Code File Inclusion 2007-12-27 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Arcadem LE 2.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.
6 CVE-2007-6539 94 File Inclusion 2007-12-27 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
PHP local file inclusion vulnerability in index.php in IDevspot iSupport 1.8 allows remote attackers to include local files via the include_file parameter.
7 CVE-2007-6488 20 Exec Code File Inclusion 2007-12-20 2017-09-28
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the dir[classes] parameter to sitemap.xml.php or (2) the error parameter to errors.php.
8 CVE-2007-6485 94 Exec Code File Inclusion 2007-12-20 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in the fileOreonConf parameter to (1) MakeXML.php or (2) MakeXML4statusCounter.php in include/monitoring/engine/.
9 CVE-2007-6464 94 Exec Code File Inclusion 2007-12-19 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in the g_root_dir parameter to (1) admin_page_open.php and (2) client_page_open.php in global/templates/.
10 CVE-2007-6348 94 Exec Code File Inclusion 2007-12-14 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP remote file inclusion vulnerability, which allows remote attackers to execute arbitrary code.
11 CVE-2007-6347 94 Exec Code File Inclusion 2007-12-13 2017-10-18
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in blocks/block_site_map.php in ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Shop Evaluation 3.3.2, and (4) Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the root_folder_path parameter. NOTE: some of these details are obtained from third party information.
12 CVE-2007-6325 20 Exec Code File Inclusion 2007-12-13 2017-09-28
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitrary PHP code via a URL in the config[fsBase] parameter, a different vector than CVE-2006-2726.
13 CVE-2007-6324 94 Exec Code File Inclusion 2007-12-13 2017-09-28
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in head.php in CityWriter 0.9.7 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
14 CVE-2007-6296 94 Exec Code File Inclusion 2007-12-10 2018-10-15
5.0
 None Remote Low Not required None Partial None
PHP remote file inclusion vulnerability in users_popupL.php3 in phpMyChat 0.14.5 allows remote attackers to execute arbitrary PHP code via a URL in the From parameter.
15 CVE-2007-6289 94 Exec Code File Inclusion 2007-12-10 2017-09-28
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in SerWeb 2.0.0 dev1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SERWEB[configdir] parameter to load_lang.php, (2) _SERWEB[functionsdir] parameter to main_prepend.php, and the (3) _PHPLIB[libdir] parameter to load_phplib.php, different vectors than CVE-2007-3359 and CVE-2007-3358.
16 CVE-2007-6233 22 Dir. Trav. File Inclusion 2007-12-04 2017-09-28
4.9
 None Remote Medium Single system Partial Partial None
Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
17 CVE-2007-6231 94 Exec Code File Inclusion 2007-12-04 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/. NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
18 CVE-2007-6229 94 Exec Code File Inclusion 2007-12-04 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the CFG[site][project_path] parameter.
19 CVE-2007-6218 20 Exec Code File Inclusion 2007-12-04 2008-11-15
5.0
 None Remote Low Not required None None Partial
Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) level parameter to (a) install_module.php and (b) uninstall_module.php in upload/xax/admin/modules/, (c) upload/xax/admin/patch/index.php, and (d) install_module.php and (e) uninstall_module.php in upload/xax/ossigeno/admin/; and the (2) ossigeno parameter to (f) ossigeno_modules/ossigeno-catalogo/xax/ossigeno/catalogo/common.php, different vectors than CVE-2007-5234.
20 CVE-2007-6191 94 Exec Code File Inclusion 2007-11-29 2017-07-28
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Armin Burger p.mapper 3.2.0 beta3 allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[PM_INCPHP] parameter to (1) incphp/globals.php or (2) plugins/export/mc_table.php. NOTE: it could be argued that this vulnerability is caused by a problem in PHP and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in p.mapper.
21 CVE-2007-6179 20 Exec Code File Inclusion 2007-11-29 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccms_library_path parameter to (1) markdown.php and (2) gallery.php in decoder/.
22 CVE-2007-6178 20 Exec Code File Inclusion 2007-11-29 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu (EHCP) 0.22.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the confdir parameter to (1) dbutil.bck.php and (2) dbutil.php in config/.
23 CVE-2007-6177 94 Exec Code File Inclusion 2007-11-29 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the webappcfg[APPPATH] parameter.
24 CVE-2007-6147 94 Exec Code File Inclusion 2007-11-27 2017-10-18
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (a) php_root_path and sometimes the (b) privilege_root_path parameter to various PHP scripts under (1) admin/includes/, (2) admin/phase/, (3) includes/, (4) includes/page_includes/, (5) reviewer/includes/, (6) reviewer/phase/, and (7) user/phase/.
25 CVE-2007-6139 94 Exec Code File Inclusion 2007-11-27 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skin_file parameter.
26 CVE-2007-6133 20 Exec Code File Inclusion 2007-11-27 2017-10-18
5.8
 None Remote Medium Not required Partial Partial None
PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfm_base_path parameter.
27 CVE-2007-6129 20 Dir. Trav. File Inclusion 2007-11-26 2018-10-15
5.8
 None Remote Medium Not required Partial Partial None
Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
28 CVE-2007-6105 94 Exec Code File Inclusion 2007-11-23 2018-10-15
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in TalkBack 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) language_file parameter to (a) comments-display-tpl.php and (b) addons/separate-comments-mod/my-comments-display-tpl.php and the (2) config[comments_form_tpl] parameter to comments-display-tpl.php.
29 CVE-2007-6089 94 Exec Code File Inclusion 2007-11-21 2017-09-28
9.3
 Admin Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in index.php in meBiblio 0.4.5 allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
30 CVE-2007-6088 94 Exec Code File Inclusion 2007-11-21 2017-09-28
9.3
 Admin Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBBViet 02.03.07 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
31 CVE-2007-6057 94 Exec Code File Inclusion 2007-11-20 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.
32 CVE-2007-6042 94 Exec Code File Inclusion 2007-11-20 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in fehler.inc.php in SWSoft Confixx Professional 3.2.1 allows remote attackers to execute arbitrary PHP code via a URL in an unspecified parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
33 CVE-2007-6038 94 Exec Code File Inclusion 2007-11-20 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
34 CVE-2007-6027 94 Exec Code File Inclusion 2007-11-19 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
35 CVE-2007-5995 94 Exec Code File Inclusion 2007-11-15 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in examples/patExampleGen/bbcodeSource.php in patBBcode 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the example parameter.
36 CVE-2007-5994 94 1 Exec Code File Inclusion 2007-11-15 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in check_noimage.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the config[path_src_include] parameter.
37 CVE-2007-5889 Exec Code File Inclusion 2007-11-07 2018-10-15
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple PHP remote file inclusion vulnerabilities in IDMOS 1.0 Alpha (aka Phoenix) allow remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter to (1) admin.php, (2) menu_add.php, and (3) menu_operation.php in administrator/, different vectors than CVE-2007-5294.
38 CVE-2007-5844 22 Dir. Trav. File Inclusion 2007-11-06 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the selskin parameter to index.php. NOTE: this can be leveraged for remote file inclusion by including inc/boxleft.inc and specifying a URL in the xposbox[L][] array parameter.
39 CVE-2007-5843 94 Exec Code File Inclusion 2007-11-06 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute arbitrary PHP code via a URL in the pathdot parameter.
40 CVE-2007-5842 94 Exec Code File Inclusion 2007-11-06 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter to (1) admincp/auth/secure.php or (2) admincp/auth/checklogin.php.
41 CVE-2007-5841 94 Exec Code File Inclusion 2007-11-06 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/index.php in nuBoard 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.
42 CVE-2007-5840 94 Exec Code File Inclusion 2007-11-06 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter, a different vector than CVE-2006-4920.2.
43 CVE-2007-5800 94 Exec Code File Inclusion 2007-11-02 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to execute arbitrary PHP code via a URL in the bkpwp_plugin_path parameter to (1) plugins/BackUp/Archive.php; and (2) Predicate.php, (3) Writer.php, (4) Reader.php, and other unspecified scripts under plugins/BackUp/Archive/.
44 CVE-2007-5786 94 Exec Code File Inclusion 2007-11-01 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) HTML_oben.php, (2) inc_freigabe.php, (3) inc_freigabe1.php, or (4) inc_freigabe3.php in include/; (5) inc_group.php; (6) inc_manager.php; (7) inc_newgroup.php; (8) inc_smb_conf.php; (9) inc_user.php; or (10) main.php.
45 CVE-2007-5784 94 Exec Code File Inclusion 2007-11-01 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
46 CVE-2007-5781 94 Exec Code File Inclusion 2007-11-01 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in inc/sige_init.php in Sige 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the SYS_PATH parameter.
47 CVE-2007-5780 94 Exec Code File Inclusion 2007-11-01 2018-10-15
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.
48 CVE-2007-5754 94 Exec Code File Inclusion 2007-10-31 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the dir_ws parameter.
49 CVE-2007-5721 94 Exec Code File Inclusion 2007-10-30 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the rootBase parameter.
50 CVE-2007-5697 94 Exec Code File Inclusion 2007-10-29 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the xarg parameter to (1) xarg_corner.php, (2) xarg_corner_bottom.php, and (3) xarg_corner_top.php.
Total number of vulnerabilities : 700   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.