Carsten Eilers

**Name of the Vulnerable Software and Affected Versions** mcLinksCounter version 1.1 **Description** The issue allows remote attackers to potentially execute arbitrary PHP code via a URL in the `langfile` parameter in several PHP files, including "login.php", "stats.php", "detail.php", and "erase.php". However, it's noted that the `langfile` parameter is set to "english.php" in each file, which may mitigate the issue. **Recommendations** For mcLinksCounter version 1.1, consider restricting access to the `langfile` parameter in the affected PHP files to minimize the risk of exploitation. As a temporary workaround, ensure the `langfile` parameter is set to a trusted file, such as "english.php", to prevent arbitrary PHP code execution.

**Name of the Vulnerable Software and Affected Versions** Calendarix versions prior to 0.7.20060401 **Description** A remote file inclusion issue allows attackers to execute arbitrary PHP code via a URL in the `calpath` parameter. However, this issue has been disputed by a third party, who claims that the affected `$calpath` variable is set to a constant value at the beginning of the script. **Recommendations** For Calendarix versions prior to 0.7.20060401, as a temporary workaround, consider restricting the use of the `calpath` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.