deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3140
Published: 2006-06-22
Description: SQL injection vulnerability in index.php in openCI 1.0 BETA 0.20.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/openci-sql-inj.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27147; http://pridels0.blogspot.com/2006/06/openci-sql-inj.html
CVE: CVE-2006-3141
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in details.cfm in Tradingeye Shop R4 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/tradingeye-shop-r4-xss.html; http://secunia.com/advisories/20736; http://www.osvdb.org/26637
CVE: CVE-2006-3142
Published: 2006-06-22
Description: SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1122; http://www.securityfocus.com/archive/1/437575/100/0/threaded; http://www.securityfocus.com/bid/18472
CVE: CVE-2006-3143
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in icue_login.asp in Maximus SchoolMAX 4.0.1 and earlier iCue and iParent applications allows remote attackers to inject arbitrary web script or HTML via the error_msg parameter.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/20752; http://securityreason.com/securityalert/1121; http://www.securityfocus.com/archive/1/437640/100/0/threaded
CVE: CVE-2006-3144
Published: 2006-06-22
Description: PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier allows remote attackers to execute arbitrary PHP code via a URL in the microcms_path parameter.  NOTE: it was later reported that this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/20758; http://www.osvdb.org/26677; http://www.securityfocus.com/archive/1/456721/100/0/threaded
CVE: CVE-2006-3145
Published: 2006-06-22
Description: Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code when assembling the header, possibly related to an off-by-one error.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20729; http://secunia.com/advisories/20775; http://sourceforge.net/project/shownotes.php?release_id=425770
CVE: CVE-2006-3146
Published: 2006-06-22
Description: The TOSRFBD.SYS driver for Toshiba Bluetooth Stack 4.00.29 and earlier on Windows allows remote attackers to cause a denial of service (reboot) via a L2CAP echo request that triggers an out-of-bounds memory access, similar to "Ping o' Death" and as demonstrated by BlueSmack.  NOTE: this issue was originally reported for 4.00.23.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2; http://attrition.org/pipermail/vim/2006-October/001085.html; http://briankrebswatch.blogspot.com/2006/10/more-on-toshiba-patches.html
CVE: CVE-2006-3147
Published: 2006-06-22
Description: Unspecified vulnerability in Hosting Controller before 6.1 (aka Hotfix 3.2) allows remote authenticated attackers to gain host admin privileges, list all resellers, or change resellers' passwords via unspecified vectors.  NOTE: due to the lack of precise details, it is not clear whether this is related to a previously disclosed issue such as CVE-2005-1788.
CVSS Score: 6.5 (MEDIUM)
References: http://hostingcontroller.com/english/logs/hotfixlogv61_3_2.html; http://secunia.com/advisories/20743; http://securitytracker.com/id?1016444
CVE: CVE-2006-3148
Published: 2006-06-22
Description: SQL injection vulnerability, possibly in search.inc.php, in Open-Realty 2.3.1 allows remote attackers to execute arbitrary SQL commands via the sorttype parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/open-realty-sql-injection-vuln.html; http://secunia.com/advisories/20704; http://www.osvdb.org/26694
CVE: CVE-2006-3149
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in topic.php in phpMyForum 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/phpmyforum-413-xss-vuln.html; http://secunia.com/advisories/20678; http://www.osvdb.org/26678
CVE: CVE-2006-3150
Published: 2006-06-22
Description: SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/cavoxcms-sql-injection-vuln.html; http://secunia.com/advisories/20600; http://www.osvdb.org/26658
CVE: CVE-2006-3151
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in index.php in AssoCIateD (aka ACID) 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the menu parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/associated-xss-vuln.html; http://secunia.com/advisories/20725; http://www.osvdb.org/26672
CVE: CVE-2006-3152
Published: 2006-06-22
Description: Multiple SQL injection vulnerabilities in phpTRADER 4.9 SP5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) sectio parameter in (a) login.php, (b) write_newad.php, (c) newad.php, (d) printad.php, (e) askseller.php, (f) browse.php, (g) showmemberads.php, (h) note_ad.php, (i) abuse.php, (j) buynow.php, (k) confirm_newad.php, (2) an parameter in (l) printad.php, (m) note_ad.php, (3) who parameter in (n) showmemberads.php, and (4) adnr parameter in (o) buynow.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/phptrader-multiple-sql-injection-vuln.html; http://secunia.com/advisories/20740; http://securitytracker.com/id?1016356
CVE: CVE-2006-3153
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/ultimate-estate-vuln.html; http://secunia.com/advisories/20761; http://www.osvdb.org/26741
CVE: CVE-2006-3154
Published: 2006-06-22
Description: SQL injection vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/ultimate-estate-vuln.html; http://secunia.com/advisories/20761; http://securitytracker.com/id?1016353
CVE: CVE-2006-3155
Published: 2006-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in (a) emailtofriend.pl or (b) violation.pl, (2) seller parameter in (c) vsoa.pl, (3) user parameter in (d) userask.pl or (e) leavefeed.pl, (4) itemnum parameter in userask.pl, (5) category parameter in (f) itemlist.pl, and the (6) query parameter in (g) search.pl.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/ultimate-auction-xss-vuln.html; http://securitytracker.com/id?1016351; https://exchange.xforce.ibmcloud.com/vulnerabilities/27276
CVE: CVE-2006-3156
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in index.cgi in Ultimate eShop 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the subid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/ultimate-eshop-xss-vuln.html; http://secunia.com/advisories/20737; http://securitytracker.com/id?1016354
CVE: CVE-2006-3157
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in index.php in Thinkfactory UltimateGoogle 1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the REQ parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/ultimategoogle-xss-vuln.html; http://secunia.com/advisories/20742; http://securitytracker.com/id?1016352
CVE: CVE-2006-3158
Published: 2006-06-22
Description: index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypass security checks and upload or execute arbitrary php code via the add action.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20731; http://www.biyosecurity.be/bugs/meeting.txt; http://www.osvdb.org/26627
CVE: CVE-2006-3159
Published: 2006-06-22
Description: pipe_master in Sun ONE/iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003) allows local users to read portions of restricted files via a symlink attack on msg.conf in a directory identified by the CONFIGROOT environment variable, which returns the first line of the file in an error message.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046920.html; http://secunia.com/advisories/20919; http://securitytracker.com/id?1016312
CVE: CVE-2006-3160
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in fm.php in ONEdotOH Simple File Manager (SFM) 0.24a and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20668; http://www.osvdb.org/26665; http://www.securityfocus.com/archive/1/437671/100/100/threaded
CVE: CVE-2006-3161
Published: 2006-06-22
Description: SQL injection vulnerability in misc.php in SaphpLesson 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the action parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1123; http://securitytracker.com/id?1016342; http://www.securityfocus.com/archive/1/437659/100/0/threaded
CVE: CVE-2006-3162
Published: 2006-06-22
Description: PHP remote file inclusion vulnerability in include/inc_foot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20769; http://www.securityfocus.com/bid/18628; http://www.vupen.com/english/advisories/2006/2478
CVE: CVE-2006-3163
Published: 2006-06-22
Description: Multiple SQL injection vulnerabilities in galeria.php in IMGallery 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start or (2) sort parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/imgallery-vuln.html; http://secunia.com/advisories/20763; http://securitytracker.com/id?1016349
CVE: CVE-2006-3164
Published: 2006-06-22
Description: SQL injection vulnerability in category.php in TPL Design tplShop 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the first_row parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/tplshop-v-20-vuln.html; http://secunia.com/advisories/20738; http://www.osvdb.org/26631
CVE: CVE-2006-3165
Published: 2006-06-22
Description: SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/free-realty-vuln.html; http://secunia.com/advisories/20705; http://www.osvdb.org/26667
CVE: CVE-2006-3166
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in propview.php in Free Realty 2.9-0.6 and earlier allows remote attackers to execute arbitrary web script or HTML via the sort parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/free-realty-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27253; http://pridels0.blogspot.com/2006/06/free-realty-vuln.html
CVE: CVE-2006-3167
Published: 2006-06-22
Description: Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/free-realty-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27254; http://pridels0.blogspot.com/2006/06/free-realty-vuln.html
CVE: CVE-2006-3168
Published: 2006-06-23
Description: SQL injection vulnerability in CS-Forum before 0.82 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) debut parameters in (a) read.php, and the (3) search and (4) debut parameters in (b) index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20534; http://securityreason.com/securityalert/1124; http://www.acid-root.new.fr/advisories/csforum081.txt
CVE: CVE-2006-3169
Published: 2006-06-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in CS-Forum 0.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) msg_result and (2) rep_titre parameters in (a) read.php; and the (3) id and (4) parent parameters and (5) CSForum_nom, (6) CSForum_mail, and (7) CSForum_url cookie parameters in (b) ajouter.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20534; http://securityreason.com/securityalert/1124; http://www.acid-root.new.fr/advisories/csforum081.txt
CVE: CVE-2006-3170
Published: 2006-06-23
Description: CS-Forum before 0.82 allows remote attackers to obtain sensitive information via unspecified manipulations, possibly involving an empty collapse[] or readall parameter to index.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20534; http://securityreason.com/securityalert/1124; http://www.acid-root.new.fr/advisories/csforum081.txt
CVE: CVE-2006-3171
Published: 2006-06-23
Description: CRLF injection vulnerability in CS-Forum before 0.82 allows remote attackers to inject arbitrary email headers via a newline character in the email parameter to ajouter.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20534; http://www.acid-root.new.fr/advisories/csforum081.txt; http://www.comscripts.com/scripts/php.cs-forum.643.html
CVE: CVE-2006-3172
Published: 2006-06-23
Description: Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash (/) character in the (1) lang_path parameter to (a) cms/plugins/col_man/column.inc.php, (b) cms/plugins/poll/poll.inc.php, (c) cms/plugins/user_managment/usrPortrait.inc.php, (d) cms/plugins/user_managment/user.inc.php, (e) cms/plugins/media_manager/media.inc.php, (f) cms/plugins/events/permanent.eventMonth.inc.php, (g) cms/plugins/events/events.inc.php, and (h) cms/plugins/newsletter2/newsletter.inc.php; (2) path[cb] parameter to (i) modules/guestbook/guestbook.inc.php, (j) modules/shoutbox/shoutBox.php, and (k) modules/sitemap/sitemap.inc.php; and the (3) rel parameter to (l) modules/download/overview.inc.php, (m) modules/download/detailView.inc.php, (n) modules/article/fullarticle.inc.php, (o) modules/article/comments.inc.php, (p) modules/article2/overview.inc.php, (q) modules/article2/fullarticle.inc.php, (r) modules/article2/comments.inc.php, (s) modules/headline/headlineBox.php, and (t) modules/headline/showHeadline.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6696&w=2; http://secunia.com/advisories/20557; http://www.osvdb.org/26344
CVE: CVE-2006-3173
Published: 2006-06-23
Description: Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) path[cb] parameter to (a) libraries/comment/postComment.php and (b) modules/poll/poll.php, (2) rel parameter to (c) modules/archive/overview.inc.php, and the (3) actualModuleDir parameter to (d) modules/forum/showThread.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20557; http://www.securityfocus.com/archive/1/481435/100/0/threaded; http://www.securityfocus.com/bid/25914
CVE: CVE-2006-3174
Published: 2006-06-23
Description: Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter.
CVSS Score: 2.6 (LOW)
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://pridels0.blogspot.com/2006/06/squirrelmail-151-xss-vuln.html
CVE: CVE-2006-3175
Published: 2006-06-23
Description: Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) admin.php, (2) ecrire.php, and (3) lire.php. NOTE: it was later reported that the ecrire.php vector also affects 1.2.  NOTE: this issue might be limited to a race condition during installation or an improper installation, since a completed installation creates an include file that prevents external control of the $lang variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/1125; http://www.osvdb.org/27460; http://www.osvdb.org/27461
CVE: CVE-2006-3176
Published: 2006-06-23
Description: SQL injection vulnerability in xarancms_haupt.php in xarancms 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/xarancms-v20-vuln.html; http://secunia.com/advisories/20739; http://www.osvdb.org/26632
CVE: CVE-2006-3177
Published: 2006-06-23
Description: PHP remote file inclusion vulnerability in Admin/rtf_parser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20680; http://www.osvdb.org/26598; http://www.securityfocus.com/bid/18494
CVE: CVE-2006-3178
Published: 2006-06-23
Description: Directory traversal vulnerability in extract_chmLib example program in CHM Lib (chmlib) before 0.38 allows remote attackers to overwrite arbitrary files via a CHM archive containing files with a .. (dot dot) in their filename.
CVSS Score: 5.0 (MEDIUM)
References: http://morte.jedrea.com/~jedwin/projects/chmlib/; http://secunia.com/advisories/20734; http://secunia.com/advisories/21406
CVE: CVE-2006-3179
Published: 2006-06-23
Description: Cross-site scripting (XSS) vulnerability in tools_ftp_pwaendern.php in Confixx Pro 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the account parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20728; http://securityreason.com/securityalert/1126; http://www.osvdb.org/26628
CVE: CVE-2006-3180
Published: 2006-06-23
Description: Cross-site scripting (XSS) vulnerability in ftp_index.php in Confixx Pro 3.0 allows remote attackers to inject arbitrary web script or HTML via the path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0383.html; http://secunia.com/advisories/20728; http://www.osvdb.org/26629
CVE: CVE-2006-3181
Published: 2006-06-23
Description: SQL injection vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to execute arbitrary SQL commands via the browse parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0115.html; http://secunia.com/advisories/20611; http://securityreason.com/securityalert/1128
CVE: CVE-2006-3182
Published: 2006-06-23
Description: Directory traversal vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to read arbitrary files via a ..  (dot dot) in the uid parameter in the rss page.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0115.html; http://secunia.com/advisories/20611; http://securityreason.com/securityalert/1128
CVE: CVE-2006-3183
Published: 2006-06-23
Description: Cross-site scripting (XSS) vulnerability in index.php in MobeScripts Mobile Space Community 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) browse parameter, which is not filtered in the resulting error message, and multiple unspecified input fields, including those involved when (2) updating a profile, (3) posting comments or entries in a blog, (4) uploading files, (5) picture captions, and (6) sending a private message (PM).
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0115.html; http://secunia.com/advisories/20611; http://securityreason.com/securityalert/1128
CVE: CVE-2006-3184
Published: 2006-06-23
Description: Direct static code injection vulnerability in ASP Stats Generator before 2.1.2 allows remote authenticated attackers to execute arbitrary ASP code via the strAsgSknPageBgColour parameter to settings_skin.asp, which is stored in inc_skin_file.asp.
CVSS Score: 4.0 (MEDIUM)
References: http://blog.asp-stats.com/index.php/2006/06/18/asp-stats-generator-v212/; http://secunia.com/advisories/20721; http://www.hamid.ir/security/aspstats.txt
CVE: CVE-2006-3185
Published: 2006-06-23
Description: PHP remote file inclusion vulnerability in data/header.php in CMS Faethon 1.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv33-K-159-2006.txt; http://secunia.com/advisories/20713; http://securityreason.com/securityalert/1127
CVE: CVE-2006-3186
Published: 2006-06-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Faethon 1.3.2 allow remote attackers to inject arbitrary web script or HTML via the mainpath parameter to (1) data/footer.php and (2) admin/header.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20713; http://www.osvdb.org/26630; http://www.osvdb.org/26634
CVE: CVE-2006-3187
Published: 2006-06-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sharky e-shop 3.05 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) maingroup and (2) secondgroup parameters to (a) search_prod_list.asp, and the (3) maingroup parameter to (b) meny2.asp.  NOTE: it is possible that this is resultant from SQL injection or a forced SQL error.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/sharky-e-shop-xss.html; http://www.securityfocus.com/bid/18530; http://www.securityfocus.com/bid/18532
CVE: CVE-2006-3188
Published: 2006-06-23
Description: Multiple SQL injection vulnerabilities in Sharky e-shop 3.05 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) maingroup and (2) secondgroup parameters to (a) search_prod_list.asp, and the (3) maingroup parameter to (b) meny2.asp.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/2426; https://exchange.xforce.ibmcloud.com/vulnerabilities/27499; http://www.vupen.com/english/advisories/2006/2426
CVE: CVE-2006-3189
Published: 2006-06-23
Description: Cross-site scripting (XSS) vulnerability in administration/tblcontent/login1.php in HotPlug CMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3385&w=2; http://securitytracker.com/id?1016321; http://www.securityfocus.com/bid/18454