CVE-2002-0451

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

filemanager_forms.php in PHProjekt 3.1 and 3.1a allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_path parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.iss.net/security_center/static/8448.phpPatch, Vendor Advisory
http://www.phprojekt.com/modules.php?op=modload&name=News&file=article&sid=19&mode=&order=
http://www.securityfocus.com/archive/1/261676Vendor Advisory
http://www.securityfocus.com/bid/4284Exploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/8448.phpPatch, Vendor Advisory
http://www.phprojekt.com/modules.php?op=modload&name=News&file=article&sid=19&mode=&order=
http://www.securityfocus.com/archive/1/261676Vendor Advisory
http://www.securityfocus.com/bid/4284Exploit, Patch, Vendor Advisory

Timeline

Published: Aug 12, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-04527.5Foundry Networks ServerIron switches do not decode URIs when applying "url-map" rules, which could make it easier for attackers to cause the CVE-2002-04537.5The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, which makes it CVE-2002-04545.0Qpopper (aka in.qpopper or popper) 4.0.3 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a very large CVE-2002-04555.0IncrediMail stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in othe CVE-2002-04565.0Eudora 5.1 and earlier versions stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vul CVE-2002-04577.6Cross-site scripting vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded CVE-2002-04587.6Cross-site scripting vulnerability in News-TNK 1.2.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB paramet CVE-2002-04597.6Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parame CVE-2002-04605.0Bitvise WinSSHD before 2002-03-16 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of incomplet CVE-2002-04615.0Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that CVE-2002-04626.4bigsam_guestbook.php for Big Sam (Built-In Guestbook Stand-Alone Module) 1.1.08 and earlier allows remote attackers to cause a denial of ser CVE-2002-04635.0home.php in ARSC (Really Simple Chat) 1.0.1 and earlier allows remote attackers to determine the full pathname of the web server via an inva