deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3011
Published: 2006-06-26
Description: The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?diff_format=u&view=log&pathrev=PHP_4_4; http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.9&r2=1.543.2.51.2.10&pathrev=PHP_4_4&diff_format=u; http://secunia.com/advisories/20818
CVE: CVE-2006-3229
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in Open WebMail (OWM) 2.52, and other versions released before 05/12/2006, allows remote attackers to inject arbitrary web script or HTML via the (1) To and (2) From fields in openwebmail-main.pl, and possibly (3) other unspecified vectors related to "openwebmailerror calls that need to display HTML."
CVSS Score: 4.3 (MEDIUM)
References: http://openwebmail.acatysmoof.com/dev/svn/index.pl/openwebmail/diff/trunk/src/cgi-bin/openwebmail/openwebmail-main.pl?rev1=235%3Brev2=236; http://openwebmail.org/openwebmail/doc/changes.txt; http://secunia.com/advisories/20714
CVE: CVE-2006-3230
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in index.tmpl in Azureus Tracker 2.4.0.2 and earlier (Java BitTorrent Client Tracker) allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/azureus-2402-xss-vuln.html; http://secunia.com/advisories/20755; http://securitytracker.com/id?1016357
CVE: CVE-2006-3231
Published: 2006-06-27
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.11, when fileServingEnabled is true, allows remote attackers to obtain JSP source code and other sensitive information via "URIs with special characters."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20732; http://secunia.com/advisories/24478; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876
CVE: CVE-2006-3232
Published: 2006-06-27
Description: Unspecified vulnerability in IBM WebSphere Application Server before 6.0.2.11 has unknown impact and attack vectors because the "UserNameToken cache was improperly used."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/20732; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876
CVE: CVE-2006-3233
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in openwebmail-read.pl in Open WebMail (OWM) 2.52, and other versions released before 06/18/2006, allows remote attackers to inject arbitrary web script or HTML via the from field.  NOTE: some third party sources have mentioned the "to" and "from" fields, although CVE analysis shows that these are associated with the previous version, a different executable, and a different CVE.
CVSS Score: 4.3 (MEDIUM)
References: http://openwebmail.acatysmoof.com/dev/svn/index.pl/openwebmail/diff/trunk/src/cgi-bin/openwebmail/openwebmail-read.pl?rev1=236%3Brev2=237; http://openwebmail.org/openwebmail/doc/changes.txt; http://secunia.com/advisories/20714
CVE: CVE-2006-3234
Published: 2006-06-27
Description: Multiple SQL injection vulnerabilities in index.php in FineShop 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) produkt, (2) id_produc, and (3) id_kat parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/fineshop-vuln.html; http://secunia.com/advisories/20901; http://securitytracker.com/id?1016350
CVE: CVE-2006-3235
Published: 2006-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in FineShop 3.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) promocja, (2) wysw, or (3) id_produc parameters.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/fineshop-vuln.html; http://secunia.com/advisories/20901; http://securitytracker.com/id?1016350
CVE: CVE-2006-3236
Published: 2006-06-27
Description: Multiple SQL injection vulnerabilities in thinkWMS 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) index.php or (b) printarticle.php, and the (2) catid parameter in index.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/thinkwms-sql-injection-vuln.html; http://secunia.com/advisories/20747; http://securitytracker.com/id?1016355
CVE: CVE-2006-3237
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in index.php in Enterprise Groupware System (EGS) 1.2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/enterprise-groupware-system-xss-vuln.html; http://secunia.com/advisories/20757; http://securitytracker.com/id?1016358
CVE: CVE-2006-3238
Published: 2006-06-27
Description: Multiple SQL injection vulnerabilities in VBZooM 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) MemberID parameter to rank.php, and the (2) QuranID parameter to lng.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20701/; http://securityreason.com/securityalert/1149; http://www.securityfocus.com/archive/1/437651/100/100/threaded
CVE: CVE-2006-3239
Published: 2006-06-27
Description: SQL injection vulnerability in message.php in VBZooM 1.11 and earlier allows remote attackers to execute arbitrary SQL commands via the UserID parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1148; http://www.securityfocus.com/archive/1/437655; http://www.securityfocus.com/bid/18497
CVE: CVE-2006-3240
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in classes/ui.class.php in dotProject 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dotproject.cvs.sourceforge.net/dotproject/dotproject/classes/ui.class.php?r1=1.113&r2=1.114; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/20822
CVE: CVE-2006-3241
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in messages.php in XennoBB 1.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the tid parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/xennobb-xss-vuln.html; http://secunia.com/advisories/20797; http://www.securityfocus.com/bid/18652
CVE: CVE-2006-3242
Published: 2006-06-27
Description: Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U; http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git%3Ba=commit%3Bh=dc0272b749f0e2b102973b7ac43dbd[PII_REDACTED]; http://dev.mutt.org/cgi-bin/viewcvs.cgi/mutt/imap/browse.c?r1=1.34.2.2&r2=1.34.2.3
CVE: CVE-2006-3243
Published: 2006-06-27
Description: SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter.
CVSS Score: 7.5 (HIGH)
References: http://community.mybboard.net/showthread.php?tid=9955; http://myimei.com/security/2006-06-21/mybb113option-update-for-code-buttonssql-injection-admin-access.html; http://secunia.com/advisories/20795
CVE: CVE-2006-3244
Published: 2006-06-27
Description: Multiple SQL injection vulnerabilities in Anthill 0.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order parameter in buglist.php and the (2) bug parameter in query.php.
CVSS Score: 5.1 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/anthill-sql-injection-vuln.html; http://secunia.com/advisories/20838; http://www.securityfocus.com/bid/18661
CVE: CVE-2006-3245
Published: 2006-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in activatemember in mvnForum 1.0 GA and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) member and (2) activatecode parameters.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/mvnforum-xss-vuln.html; http://secunia.com/advisories/20803; http://www.securityfocus.com/bid/18663
CVE: CVE-2006-3246
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in show.php in GL-SH Deaf Forum 6.4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/gl-sh-deaf-forum-xss-vuln.html; http://secunia.com/advisories/20781; http://www.osvdb.org/26804
CVE: CVE-2006-3247
Published: 2006-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in show.php in GL-SH Deaf Forum 6.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search, (2) page, and (3) action parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/gl-sh-deaf-forum-xss-vuln.html; http://secunia.com/advisories/20781; http://www.osvdb.org/26804
CVE: CVE-2006-3248
Published: 2006-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4011.  Reason: This candidate is a duplicate of CVE-2005-4011.  Notes: All CVE users should reference CVE-2005-4011 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-3249
Published: 2006-06-27
Description: SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.  NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results.  It IS NOT however a sql injection error."  While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html; http://www.osvdb.org/27165; http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview
CVE: CVE-2006-3134
Published: 2006-06-27
Description: Buffer overflow in GraceNote CDDBControl ActiveX Control, as used by multiple products that use Gracenote CDDB, allows remote attackers to execute arbitrary code via a long option string.
CVSS Score: 9.3 (HIGH)
References: http://europe.nokia.com/nokia/0%2C%2C93034%2C00.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047420.html; http://secunia.com/advisories/20861
CVE: CVE-2006-3250
Published: 2006-06-27
Description: Heap-based buffer overflow in Windows Live Messenger 8.0 allows user-assisted attackers to execute arbitrary code via a crafted Contact List (.ctt) file, which triggers the overflow when it is imported by the user.
CVSS Score: 5.1 (MEDIUM)
References: http://securitydot.net/xpl/exploits/vulnerabilities/articles/1108/exploit.html; http://securitytracker.com/id?1016373; http://www.jaascois.com/exploits/18602016/
CVE: CVE-2006-3251
Published: 2006-06-27
Description: Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/20800; http://secunia.com/advisories/20846; http://secunia.com/advisories/21146
CVE: CVE-2006-3252
Published: 2006-06-27
Description: Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20812; http://securityreason.com/securityalert/1152; http://securitytracker.com/id?1016382
CVE: CVE-2006-1468
Published: 2006-06-27
Description: Unspecified vulnerability in Apple File Protocol (AFP) server in Apple Mac OS X 10.4 up to 10.4.6 includes the names of restricted files and folders within search results, which might allow remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html; http://secunia.com/advisories/20877; http://securitytracker.com/id?1016395
CVE: CVE-2006-3223
Published: 2006-06-27
Description: Format string vulnerability in CA Integrated Threat Management (ITM), eTrust Antivirus (eAV), and eTrust PestPatrol (ePP) r8 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a scan job with format strings in the description field.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047423.html; http://secunia.com/advisories/20856; http://securitytracker.com/id?1016391
CVE: CVE-2006-3258
Published: 2006-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.html in BNBT TrinEdit and EasyTracker 7.7r3.2004.10.27 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) filter or (2) sort parameters.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/bnbt-trinedit-vuln.html; http://secunia.com/advisories/20774; http://securitytracker.com/id?1016368
CVE: CVE-2006-3259
Published: 2006-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a comment).
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20727; http://securityreason.com/securityalert/1151; http://www.securityfocus.com/archive/1/437649/100/0/threaded
CVE: CVE-2006-3260
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in index.php in vlbook 1.02 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://colander.altervista.org/advisory/vlbook.txt; http://secunia.com/advisories/20776; http://securityreason.com/securityalert/1150
CVE: CVE-2006-3261
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in Trend Micro Control Manager (TMCM) 3.5 allows remote attackers to inject arbitrary web script or HTML via the username field on the login page, which is not properly sanitized before being displayed in the error log.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20794; http://securityreason.com/securityalert/1159; http://securitytracker.com/id?1016372
CVE: CVE-2006-3262
Published: 2006-06-27
Description: SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/mambo_46rc1_sql.html; http://secunia.com/advisories/20745; http://securityreason.com/securityalert/1158
CVE: CVE-2006-3263
Published: 2006-06-27
Description: SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.mamboserver.com/?option=com_content&task=view&id=207; http://www.mamboserver.com/?option=com_content&task=view&id=207
CVE: CVE-2006-3264
Published: 2006-06-27
Description: Cross-site scripting (XSS) vulnerability in mclient.cgi in Namo DeepSearch 4.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20821; http://securityreason.com/securityalert/1156; http://securitytracker.com/id?1016366
CVE: CVE-2006-3265
Published: 2006-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Qdig before 1.2.9.3, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pre_gallery or (2) post_gallery parameters.
CVSS Score: 2.6 (LOW)
References: http://qdig.sourceforge.net/News/News2006-06-24-1; http://secunia.com/advisories/20808; http://securityreason.com/securityalert/538
CVE: CVE-2006-3266
Published: 2006-06-27
Description: Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) header parameter to (a) conad/include/rootGui.inc.php and (b) include/rootGui.inc.php; (2) mysqlCall parameter to (c) conad/changeEmail.inc.php, (d) conad/changeUserDetails.inc.php, (e) conad/checkPasswd.inc.php, (f) conad/login.inc.php and (g) conad/logout.inc.php; (3) mysqlcall parameter to (h) include/listall.inc.php; (4) prefix parameter to (i) show/index.php; and (5) config parameter to (j) conad/include/mysqlCall.inc.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20814; http://www.osvdb.org/26815; http://www.osvdb.org/26816
CVE: CVE-2006-3267
Published: 2006-06-27
Description: SQL injection vulnerability in index.php in Infinite Core Technologies (ICT) 1.0 Gold and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/ict-infinite-core-technologies-vuln.html; http://secunia.com/advisories/20806; http://www.securityfocus.com/bid/18644
CVE: CVE-2006-1469
Published: 2006-06-27
Description: Stack-based buffer overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.6 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html; http://secunia.com/advisories/20877; http://securitytracker.com/id?1016394
CVE: CVE-2006-1470
Published: 2006-06-27
Description: OpenLDAP in Apple Mac OS X 10.4 up to 10.4.6 allows remote attackers to cause a denial of service (crash) via an invalid LDAP request that triggers an assert error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html; http://secunia.com/advisories/20877; http://securitytracker.com/id?1016396
CVE: CVE-2006-1471
Published: 2006-06-27
Description: Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a syslog call in the logging facility, as demonstrated by using a crafted plist file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html; http://secunia.com/advisories/20877; http://securitytracker.com/id?1016397
CVE: CVE-2006-0456
Published: 2006-06-27
Description: The strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/20914; http://secunia.com/advisories/21465; http://secunia.com/advisories/22417
CVE: CVE-2006-2200
Published: 2006-06-28
Description: Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577; http://secunia.com/advisories/20749; http://secunia.com/advisories/20948
CVE: CVE-2006-3253
Published: 2006-06-28
Description: Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter.  NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1155; http://securitytracker.com/id?1016348; http://www.osvdb.org/27508
CVE: CVE-2006-3254
Published: 2006-06-28
Description: SQL injection vulnerability in newthread.php in Woltlab Burning Board (WBB) 2.0 RC2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1154; http://securitytracker.com/id?1016374; http://www.securityfocus.com/archive/1/438252
CVE: CVE-2006-3255
Published: 2006-06-28
Description: SQL injection vulnerability in showmods.php in Woltlab Burning Board (WBB) 1.2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1153; http://securitytracker.com/id?1016374; http://www.securityfocus.com/archive/1/438184
CVE: CVE-2006-3256
Published: 2006-06-28
Description: SQL injection vulnerability in report.php in Woltlab Burning Board (WBB) 2.3.1 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/lists/bugtraq/2006/Jun/0614.html; http://securitytracker.com/id?1016374; http://www.securityfocus.com/bid/18597
CVE: CVE-2006-3257
Published: 2006-06-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including (1) calendar/myagenda.php, (2) document/document.php, (3) phpbb/newtopic.php, (4) tracking/userLog.php, and (5) wiki/page.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20817; http://securityreason.com/securityalert/1160; http://securitytracker.com/id?1016387
CVE: CVE-2006-3269
Published: 2006-06-28
Description: PHP remote file inclusion vulnerability in includes/functions_cms.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20815; http://www.osvdb.org/26937; http://www.securityfocus.com/bid/18637
CVE: CVE-2006-3270
Published: 2006-06-28
Description: SQL injection vulnerability in cms_admin.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via multiple unspecified parameters, such as the add_link_mid parameter.  NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/2527; https://exchange.xforce.ibmcloud.com/vulnerabilities/27377; http://www.vupen.com/english/advisories/2006/2527
CVE: CVE-2006-3271
Published: 2006-06-28
Description: Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the (1) country and (2) sort_by parameters in (a) search_results.php; (3) browse parameter in (b) featured_photos.php; (4) cid parameter in (c) products.php, (d) index.php, and (e) news_desc.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20802; http://securityreason.com/securityalert/1163; http://www.securityfocus.com/archive/1/438245/100/0/threaded