deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2635
Published: 2006-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<scr<script>ipt>" in (1) offset and (2) days parameters in (a) tiki-lastchanges.php, the (3) find and (4) offset parameters in (b) tiki-orphan_pages.php, the (5) offset and (6) initial parameters in (c) tiki-listpages.php, and (7) an unspecified field in (d) tiki-remind_password.php; and allow remote authenticated users with admin privileges to inject arbitrary web script or HTML via (8) an unspecified field in a metatags action in (e) tiki-admin.php, the (9) offset parameter in (f) tiki-admin_rssmodules.php, the (10) offset and (11) max parameters in (g) tiki-syslog.php, the (12) numrows parameter in (h) tiki-adminusers.php, (13) an unspecified field in (i) tiki-adminusers.php, (14) an unspecified field in (j) tiki-admin_hotwords.php, unspecified fields in (15) "Assign new module" and (16) "Create new user module" in (k) tiki-admin_modules.php, (17) an unspecified field in "Add notification" in (l) tiki-admin_notifications.php, (18) the offset parameter in (m) tiki-admin_notifications.php, the (19) Name and (20) Dsn fields in (o) tiki-admin_dsn.php, the (21) offset parameter in (p) tiki-admin_content_templates.php, (22) an unspecified field in "Create new template" in (q) tiki-admin_content_templates.php, and the (23) offset parameter in (r) tiki-admin_chat.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20334; http://securityreason.com/securityalert/976; http://tikiwiki.org/tiki-read_article.php?articleId=131
CVE: CVE-2006-2636
Published: 2006-05-30
Description: newsadmin.asp in Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ".
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/20294; http://securityreason.com/securityalert/974; http://www.bugreport.ir/index_62.htm
CVE: CVE-2006-2637
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in view.php in TuttoPhp (1) Morris Guestbook 1, (2) Pretty Guestbook 1, and (3) Smile Guestbook 1 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the pagina parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20320; http://secunia.com/advisories/20321; http://secunia.com/advisories/20322
CVE: CVE-2006-2638
Published: 2006-05-30
Description: SQL injection vulnerability in member.asp in qjForum allows remote attackers to execute arbitrary SQL commands via the uName parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20309; http://securityreason.com/securityalert/972; http://www.securityfocus.com/archive/1/435120/100/0/threaded
CVE: CVE-2006-2639
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in the input forms in prattmic and Master5006 PHPSimpleChoose 0.3 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20306; http://securityreason.com/securityalert/971; http://www.securityfocus.com/archive/1/435165/100/0/threaded
CVE: CVE-2006-2640
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in OmegaMw7a.ASP in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allows remote attackers to inject arbitrary web script or HTML via the WCE parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20319; http://securityreason.com/securityalert/970; http://www.securityfocus.com/archive/1/435109/100/0/threaded
CVE: CVE-2006-2641
Published: 2006-05-30
Description: ** UNVERIFIABLE **  NOTE: this issue does not contain any verifiable or actionable details.  Cross-site scripting (XSS) vulnerability in John Frank Asset Manager (AssetMan) 2.4a and earlier allows remote attackers to inject arbitrary web script or HTML via "any of its input."  NOTE: the original disclosure is based on vague researcher claims without vendor acknowledgement; therefore this identifier cannot be linked with any future identifier that identifies more specific vectors.  Perhaps this should not be included in CVE.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20285; http://securityreason.com/securityalert/979; http://www.securityfocus.com/archive/1/435139/100/0/threaded
CVE: CVE-2006-2642
Published: 2006-05-30
Description: ** UNVERIFIABLE **  NOTE: this issue does not contain any verifiable or actionable details.  Cross-site scripting (XSS) vulnerability in Marco M. F. De Santis Php-residence 0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via "any of its input."  NOTE: the original disclosure is based on vague researcher claims without vendor acknowledgement; therefore this identifier cannot be linked with any future identifier that identifies more specific vectors.  Perhaps this should not be included in CVE.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20311; http://securityreason.com/securityalert/978; http://www.securityfocus.com/archive/1/435131/100/0/threaded
CVE: CVE-2006-2643
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in index.php in Monster Top List (MTL) 1.4 allows remote attackers to inject arbitrary web script or HTML via the user_error_message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/977; http://www.securityfocus.com/archive/1/435113/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26806
CVE: CVE-2006-2644
Published: 2006-05-30
Description: AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365910; http://secunia.com/advisories/20164; http://secunia.com/advisories/20283
CVE: CVE-2006-2645
Published: 2006-05-30
Description: PHP remote file inclusion vulnerability in manager/frontinc/prepend.php for Plume 1.0.3 allows remote attackers to execute arbitrary code via a URL in the _PX_config[manager_path] parameter.  NOTE: this is a different executable and affected version than CVE-2006-0725.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/20310; http://securityreason.com/securityalert/975; http://securitytracker.com/id?1016165
CVE: CVE-2006-2646
Published: 2006-05-30
Description: Buffer overflow in Alt-N MDaemon, possibly 9.0.1 and earlier, allows remote attackers to execute arbitrary code via a long A0001 argument that begins with a '"' (double quote).
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2151&w=2; http://securitytracker.com/id?1016167; http://www.securityfocus.com/bid/18129
CVE: CVE-2006-2647
Published: 2006-05-30
Description: Untrusted search path vulnerability in update_flash for IBM AIX 5.1, 5.2 and 5.3 allows local users to execute arbitrary commands via unknown vectors involving lsmcode and possibly other commands.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/20325; http://securitytracker.com/id?1016166; http://www-1.ibm.com/support/search.wss?rs=0&q=IY85517&apar=only
CVE: CVE-2006-2648
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in perform_search.asp for ASPBB 0.52 and earlier allows remote attackers to inject arbitrary HTML or web script via the search parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20360; http://securityreason.com/securityalert/983; http://securitytracker.com/id?1016169
CVE: CVE-2006-2649
Published: 2006-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, as demonstrated by the (1) query parameter in search.php and the (2) data parameter in search_cat.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0683.html; http://secunia.com/advisories/20272; http://securitytracker.com/id?1016164
CVE: CVE-2006-2650
Published: 2006-05-30
Description: SQL injection vulnerability in cosmicshop/search.php in CosmicShoppingCart allows remote attackers to execute arbitrary SQL commands via the max parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0683.html; http://secunia.com/advisories/20272; http://securitytracker.com/id?1016164
CVE: CVE-2006-2651
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in index.php in Vacation Rental Script 1.0 allows remote attackers to inject arbitrary web script or HTML via the obj parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20324; http://securityreason.com/securityalert/982; http://www.securityfocus.com/archive/1/435167/100/0/threaded
CVE: CVE-2006-2652
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in WikiNi 0.4.2 and earlier allows remote attackers to inject arbitrary HTML and web script by editing a Wiki page to contain the script.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20366; http://securityreason.com/securityalert/981; http://www.osvdb.org/25802
CVE: CVE-2006-2653
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in login_error.shtml for D-Link DSA-3100 allows remote attackers to inject arbitrary HTML or web script via an encoded uname parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20343; http://securityreason.com/securityalert/980; http://securitytracker.com/id?1016173
CVE: CVE-2006-2656
Published: 2006-05-30
Description: Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename.  NOTE: tiffsplit is not setuid.  If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]6909&w=2; http://secunia.com/advisories/20501
CVE: CVE-2006-2659
Published: 2006-05-30
Description: libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause a denial of service (CPU consumption) via unknown vectors involving usernames that contain the "=" (equals) character, which is not properly handled during encoding.
CVSS Score: 7.8 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=368834; http://secunia.com/advisories/20519; http://secunia.com/advisories/20548
CVE: CVE-2006-2661
Published: 2006-05-30
Description: ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U; http://lists.suse.com/archive/suse-security-announce/2006-Jun/0012.html; http://secunia.com/advisories/20525
CVE: CVE-2006-2663
Published: 2006-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in iFlance 1.1 allow remote attackers to inject arbitrary web script or HTML via certain inputs to (1) acc_verify.php or (2) project.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20282; http://securityreason.com/securityalert/984; http://www.osvdb.org/26043
CVE: CVE-2006-2664
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in iFdate 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) password fields, or certain other input text boxes.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20287; http://securityreason.com/securityalert/991; http://www.osvdb.org/25778
CVE: CVE-2006-2665
Published: 2006-05-30
Description: PHP remote file inclusion vulnerability in includes/mailaccess/pop3/core.php in V-Webmail 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20297; http://securitytracker.com/id?1016160; http://www.securityfocus.com/bid/30164
CVE: CVE-2006-2666
Published: 2006-05-30
Description: PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20297; http://securitytracker.com/id?1016160; http://www.securityfocus.com/bid/30164
CVE: CVE-2006-2667
Published: 2006-05-30
Description: Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which is appended after a special comment sequence into files in (1) wp-content/cache/userlogins/ (2) wp-content/cache/users/ which are later included by cache.php, as demonstrated using the displayname argument.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/wordpress_202_xpl.html; http://secunia.com/advisories/20271; http://secunia.com/advisories/20608
CVE: CVE-2006-2668
Published: 2006-05-30
Description: Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) modules/credits/business.php, (2) modules/credits/credits.php, or (3) modules/credits/help.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20298; http://securitytracker.com/id?1016159; http://www.securityfocus.com/archive/1/435110/30/4710/threaded
CVE: CVE-2006-2669
Published: 2006-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pre Shopping Mall 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter in search.php (the "search box"), (2) the prodid parameter in detail.php, and the (3) cid parameter in products.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20295; http://securityreason.com/securityalert/990; http://www.osvdb.org/26080
CVE: CVE-2006-2670
Published: 2006-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in ChatPat 1.0 allow remote attackers to inject arbitrary web script or HTML via a chat message in (1) fastchat.php and (2) fastshow.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20290; http://securityreason.com/securityalert/989; http://www.securityfocus.com/archive/1/435006/100/0/threaded
CVE: CVE-2006-2671
Published: 2006-05-30
Description: SQL injection vulnerability in ChatPat 1.0 allows remote attackers to execute arbitrary SQL commands via the nickname field.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20290; http://securityreason.com/securityalert/989; http://www.securityfocus.com/archive/1/435006/100/0/threaded
CVE: CVE-2006-2672
Published: 2006-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Realty Pro One allow remote attackers to inject arbitrary web script or HTML via the (1) listingid parameter to (a) images.php, (b) index_other.php, or (c) request_info.php; (2) propertyid parameter to (d) searchlookup.php, (3) id parameter to (e) images.php, or (4) agentid parameter to (f) request_info.php.  NOTE: some of these issues might be resultant from SQL injection.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20286; http://securityreason.com/securityalert/988; http://www.osvdb.org/25772
CVE: CVE-2006-2673
Published: 2006-05-30
Description: Cross-site scripting (XSS) vulnerability in search.html in Bulletin Board Elite-Board (E-Board) 1.1 allows remote attackers to inject arbitrary web script or HTML via the search box.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20289; http://securityreason.com/securityalert/987; http://www.securityfocus.com/archive/1/435013/100/0/threaded
CVE: CVE-2006-2674
Published: 2006-05-30
Description: Multiple SQL injection vulnerabilities in Tamber Forum 1.9.13 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) frm_id parameter to (a) show_forum.asp, (2) a search field to (b) forum_search.asp, (3) Email address or (4) Password to (c) admin/index.asp, (5) frm_cat_id parameter to (d) browse_forum_cat.asp, or (6) Message Subject or (7) Message Text field to (e) post_message.asp.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/986; http://www.osvdb.org/26564; http://www.osvdb.org/26565
CVE: CVE-2006-2675
Published: 2006-05-30
Description: PHP remote file inclusion vulnerability in ubbt.inc.php in UBBThreads 5.x and 6.x allows remote attackers to execute arbitrary PHP code via a URL in the (1) thispath or (2) configdir parameters.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/985; http://www.securityfocus.com/archive/1/435288/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26866
CVE: CVE-2006-1175
Published: 2006-05-31
Description: The WeOnlyDo! SFTP (wodSFTP) ActiveX control is marked as safe for scripting, which allows remote attackers to read and write files in arbitrary locations by accessing the control from a web page.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/20361; http://www.kb.cert.org/vuls/id/378604; http://www.securityfocus.com/bid/18192
CVE: CVE-2006-2676
Published: 2006-05-31
Description: Dispatch.cgi/_user/uservCard/ in SiteScape Forum 7.2 and possibly earlier generates different responses in a way that allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20266; http://www.uniras.gov.uk/niscc/docs/br-20[PII_REDACTED]4.html?lang=en; https://exchange.xforce.ibmcloud.com/vulnerabilities/26672
CVE: CVE-2006-2677
Published: 2006-05-31
Description: SiteScape Forum 7.2 and possibly earlier stores the avf.rc configuraiton file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive path information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20266; http://www.uniras.gov.uk/niscc/docs/br-20[PII_REDACTED]4.html?lang=en; https://exchange.xforce.ibmcloud.com/vulnerabilities/26671
CVE: CVE-2006-2678
Published: 2006-05-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pre News Manager 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) index.php, and the (2) nid parameter to (b) news_detail.php, (c) email_story.php, (d) thankyou.php, (e) printable_view.php, (f) tella_friend.php, and (g) send_comments.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20284; http://securityreason.com/securityalert/996; http://www.osvdb.org/26066
CVE: CVE-2006-2679
Published: 2006-05-31
Description: Unspecified vulnerability in the VPN Client for Windows Graphical User Interface (GUI) (aka the VPN client dialer) in Cisco VPN Client for Windows 4.8.00.* and earlier, except for 4.7.00.0533, allows local authenticated, interactive users to gain privileges, possibly due to privileges of dialog boxes, aka bug ID CSCsd79265.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/20261; http://securitytracker.com/id?1016156; http://www.cisco.com/en/US/products/products_security_advisory09186a008069a323.shtml
CVE: CVE-2006-2680
Published: 2006-05-31
Description: Cross-site scripting (XSS) vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or HTML via the gazpart parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20291; http://securityreason.com/securityalert/992; http://www.securityfocus.com/archive/1/435003/100/0/threaded
CVE: CVE-2006-2681
Published: 2006-05-31
Description: PHP remote file inclusion vulnerability in SocketMail Lite and Pro 2.2.6 and earlier, when register_globals and magic_quotes are enabled, allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter to (1) index.php and (2) inc-common.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/20273; http://securitytracker.com/id?1016228; http://www.majorsecurity.de/advisory/major_rls6.txt
CVE: CVE-2006-2682
Published: 2006-05-31
Description: PHP remote file inclusion vulnerability in BE_config.php in Back-End CMS 0.7.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _PSL[classdir] parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20292; http://www.vupen.com/english/advisories/2006/1979; https://exchange.xforce.ibmcloud.com/vulnerabilities/26699
CVE: CVE-2006-2683
Published: 2006-05-31
Description: PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary PHP code via a URL in the REDSYS[MYPATH][TEMPLATES] parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20301; http://www.vupen.com/english/advisories/2006/1977; https://exchange.xforce.ibmcloud.com/vulnerabilities/26773
CVE: CVE-2006-2684
Published: 2006-05-31
Description: Cross-site scripting (XSS) vulnerability in the search module in CMS Mundo 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20296; http://securityreason.com/securityalert/994; http://www.securityfocus.com/archive/1/435017/100/0/threaded
CVE: CVE-2006-2685
Published: 2006-05-31
Description: PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASE_path parameter to (1) base_qry_common.php, (2) base_stat_common.php, and (3) includes/base_include.inc.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370576; http://secunia.com/advisories/20300; http://sourceforge.net/forum/forum.php?forum_id=577228
CVE: CVE-2006-2686
Published: 2006-05-31
Description: PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/20299; http://www.osvdb.org/27253; http://www.osvdb.org/27254
CVE: CVE-2006-2687
Published: 2006-05-31
Description: Cross-site scripting (XSS) vulnerability in adduser.php in PHP-AGTC Membership System 1.1a and earlier allows remote attackers to inject arbitrary web script or HTML via the email address (useremail parameter).
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/20305; http://securityreason.com/securityalert/995; http://www.securityfocus.com/archive/1/435134