Bd0Rk

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `q` parameter in the inc/tesmodrewite.php file.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `script pfad` parameter in the guestbook/gbook.php file.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `script pfad` parameter in the formmailer.php file.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `inc ordner` parameter. This is a result of a PHP remote file inclusion vulnerability in the index inc.php file.

The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the gastbuch.php file. This is achieved by using a .. (dot dot) in the `start` parameter.

A directory traversal issue exists, allowing remote attackers to read arbitrary files by using a .. (dot dot) in the `file` parameter of the gallery/comment.php script.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `mx root path` parameter in the includes/functions weblog.php file.

The issue allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the `phpEx` parameter of the admin/admin xs.php file. This is a directory traversal vulnerability.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `root path` parameter in the includes/function.php file.

The issue allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the `mx root path` parameter. This is due to a critical security check being placed within a comment because of a missing comment delimiter in the contrib/mx glance sdesc.php file.

The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the `language` parameter of the activateuser.php file.

Name of the Vulnerable Software and Affected Versions: phpBB SupaNav module version 1.0.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the `phpbb root path` parameter in the link main.php file of the SupaNav module for phpBB. Recommendations: For version 1.0.0, consider restricting access to the link main.php file or the `phpbb root path` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `module root path` parameter in the faq.php file of the FAQ & RULES module for mxBB.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the ` APP RELATIVE PATH` parameter to specific API endpoints: "include.php", "dbcommon/include.php", and "exception/include.php".

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `mx root path` parameter in the getinfo1.php file of the Shotcast module for mxBB.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `phpbb root path` parameter in the admin/admin album otf.php file. This can be exploited by providing a malicious URL.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `script path` parameter in the include/default header.php file.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `phpbb root path` parameter in the mutant functions.php file.

A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the `GLOBALS[name]` parameter.

Name of the Vulnerable Software and Affected Versions: phpBB Forum picture and META tags module version 1.7 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the `phpbb root path` parameter in the MOD forum fields parse.php file. Recommendations: For phpBB Forum picture and META tags module version 1.7, avoid using the `phpbb root path` parameter in the MOD forum fields parse.php file until the issue is resolved. Restrict access to the MOD forum fields parse.php file to minimize the risk of exploitation.