Page 4 of 29 results (0.007 seconds)

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

PHP remote file inclusion vulnerability in groupcp.php in phpBB 2.0.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: CVE and the vendor dispute this vulnerability because $phpbb_root_path is defined before use ** IMPUGNADA ** Vulnerabilidad PHP de inclusión remota de archivo en groupcp.php en phpBB 2.0.10 y anteriores permite a un atacante remoto ejecutar código PHP de su elección a través de una URL en el parámeto phpbb_root_path. NOTA: el CVE y el fabricante niegan esta vulnerabilidad porque $phpbb_root_path se define antes de usarlo. • http://www.securityfocus.com/archive/1/449114/100/0/threaded http://www.securityfocus.com/archive/1/449232/100/0/threaded •

CVSS: 5.1EPSS: 6%CPEs: 1EXPL: 2

PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. Vulnerabilidad PHP de inclusión remota de archivo en includes/functions_static_topics.php en the Nivisec Static Topics module para phpBB 1.0 y anteriores permite a un atacante remoto ejecutar código PHP de su elección mediante una URL en el parámetro phpbb_root_path. • https://www.exploit-db.com/exploits/2477 http://secunia.com/advisories/22269 http://www.nivisec.com/article.php?l=vi&ar=20 http://www.osvdb.org/29506 http://www.securityfocus.com/bid/20353 http://www.vupen.com/english/advisories/2006/3916 https://exchange.xforce.ibmcloud.com/vulnerabilities/29347 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 5.1EPSS: 6%CPEs: 16EXPL: 2

PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. • https://www.exploit-db.com/exploits/1728 http://secunia.com/advisories/19892 http://www.securityfocus.com/bid/17763 http://www.vupen.com/english/advisories/2006/1585 https://exchange.xforce.ibmcloud.com/vulnerabilities/26279 •

CVSS: 5.0EPSS: 0%CPEs: 30EXPL: 2

phpBB 2.0.13 and earlier allows remote attackers to obtain sensitive information via a direct request to oracle.php, which reveals the path in a PHP error message. • http://marc.info/?l=bugtraq&m=110996579900134&w=2 http://neosecurityteam.net/Advisories/Advisory-09.txt http://neosecurityteam.tk/index.php?pagina=advisories&id=9 http://securitytracker.com/id?1013377 •

CVSS: 7.5EPSS: 4%CPEs: 29EXPL: 3

sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie. • https://www.exploit-db.com/exploits/897 https://www.exploit-db.com/exploits/871 https://www.exploit-db.com/exploits/889 http://marc.info/?l=bugtraq&m=110970201920206&w=2 http://marc.info/?l=bugtraq&m=110999268130739&w=2 http://secunia.com/advisories/14413 http://www.phpbb.com/phpBB/viewtopic.php?t=267563 •