Aesthetico

A remote file inclusion issue in index.php allows remote attackers to execute arbitrary code via a URL in the `inc dir` parameter.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `path` parameter to API endpoints such as "functions.php" and "members.php".

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This is achieved via the `pass` and `pass2` parameters in "add.php" or the `id` parameter in "members/index.php".

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `SD DIR` parameter. This is a result of a PHP remote file inclusion vulnerability in the constants.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `i cat` or `method` parameters in the "index.php" file.

The issue allows remote attackers to conduct PHP remote file inclusion and directory traversal attacks when register globals is enabled. This can be achieved via URLs or ".." sequences in the `dir abs src` parameter in files such as "check entry.php", "admin album.php", "admin image.php", and "admin util.php", and the `dir abs admin src` parameter in "admin album.php" and "admin image.php". This issue can also be leveraged to conduct cross-site scripting (XSS) attacks.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary script code or HTML via the `page` parameter in the list.php file.

The issue allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the `template` parameter. This is a directory traversal vulnerability in the detail.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `raw` parameter in the search field when `register globals` is enabled.

The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved by providing a URL in the `da path` parameter within specific scripts, including `auth.cookie.inc.php`, `auth.header.inc.php`, and `auth.sessions.inc.php`.

The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This can be achieved via a URL in the `file path` parameter in several API endpoints, including "index.php", "feedback.php", and "printfriendly.php".

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `rootagenda` parameter in the agenda.php3 file.

The issue allows remote attackers to execute arbitrary code via a URL in the `rf` parameter. This is a result of a remote file inclusion vulnerability in the direct.php file.