Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (comfeederator) component 1.0.5 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) mosConfigabsolutepath parameter to (a) addtmsp.php, (b) edittmsp.php and (c) tmsp.php in includes/tmsp/; and the (2) GLOBALS[mosConfigabsolutepath] parameter to (d) includes/tmsp/subscription.php.