PHP remote file inclusion vulnerability in admin/code/index.php in All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadpage parameter.

Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topid, (2) forid, and (3) catid parameters to code/cpforumview.php; (4) choosedlanguage parameter to cpdpage.php; (5) orderdir parameter to cplinkssearch.php; (6) orderfield parameter to (a) cpshowecproducts.php and (b) cpusersonline.php; and the (7) signature and (8) fiscal code fields in the user profile.

All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cpdpage.php, possibly involving the aiocpdp[] parameter, (2) public/code/cpshowecproducts.php, possibly involving the orderfield[] parameter, and (3) public/code/cpshowpagehelp.php, possibly involving the hp[] parameter, which reveal the path in various error messages.

Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosedlanguage parameter to (a) cpdpage.php, (b) cpnews.php, (c) cpforumview.php, (d) cpedituser.php, (e) cpnewsletter.php, (f) cplinks.php, (g) cpcontactus.php, (h) cplogin.php, and (i) cpcodicefiscale.php in public/code/; (2) newscategory parameter to public/code/cpnews.php; (3) nlmsgnlcatid parameter to public/code/cpnewsletter.php; (4) linkscategory parameter to public/code/cplinks.php; (5) productcategoryid parameter to public/code/cpshowecproducts.php; (6) orderfield parameter to public/code/cpshowecproducts.php; (7) firstrow parameter to public/code/cpusersonline.php; and (8) orderdir parameter to public/code/cplinkssearch.php.

Cross-site scripting (XSS) vulnerability in public/code/cpdpage.php in All In One Control Panel (AIOCP) before 1.3.017 allows remote attackers to inject arbitrary web script or HTML via the aiocpdp parameter. NOTE: some of these details are obtained from third party information.

Dynamic variable evaluation vulnerability in shared/config/cpconfig.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks via the SERVER superglobal array. NOTE: some of these details are obtained from third party information.

Cross-site scripting (XSS) vulnerability in shared/code/cpauthorization.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. NOTE: some of these details are obtained from third party information.

SQL injection vulnerability in public/code/cppollsresults.php in All In One Control Panel (AIOCP) 1.4 allows remote attackers to execute arbitrary SQL commands via the pollid parameter.