Description
Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dir[plugins] parameter to (a) HTMLSax3.php and (b) safehtml.php in plugins/safehtml/ and the (2) sIncPath parameter to (c) ray/modules/global/inc/content.inc.php. NOTE: vector 1 might be a problem in SafeHTML instead of Dolphin.
Remediation
References
Related Vulnerabilities
WordPress Plugin Advertisement Management Multiple Vulnerabilities (1.0)
WordPress Plugin Media Library Assistant SQL Injection (2.84)
WordPress 4.9.x Arbitrary File Deletion Vulnerability (4.9 - 4.9.6)
WordPress Plugin vSlider Multi Image Slider for WordPress Multiple Vulnerabilities (4.1.2)
WordPress Plugin External Links-nofollow, noopener & new window Cross-Site Request Forgery (2.57)