deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4399
Published: 2006-10-03
Description: User interface inconsistency in Workgroup Manager in Apple Mac OS X 10.4 through 10.4.7 appears to allow administrators to change the authentication type from crypt to ShadowHash passwords for accounts in a NetInfo parent, when such an operation is not actually supported, which could result in less secure password management than intended.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html; http://secunia.com/advisories/22187; http://securitytracker.com/id?1016958
CVE: CVE-2006-5100
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS (aka webnews) 1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the WN_BASEDIR parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22076; http://securityreason.com/securityalert/1659; http://securitytracker.com/id?1016938
CVE: CVE-2006-5101
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, and (12) Comdev eCommerce 3.1, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter.  NOTE: it has been reported that 4.1 versions might also be affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/22133; http://secunia.com/advisories/22134; http://secunia.com/advisories/22135
CVE: CVE-2006-5102
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in include/editfunc.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.42 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NWCONF_SYSTEM[server_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37965; http://www.securityfocus.com/bid/20237; http://www.vupen.com/english/advisories/2006/3816
CVE: CVE-2006-5103
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in admin/index2.php in bbsNew 2.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the "right" parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-10/0244.html; http://www.securityfocus.com/archive/1/450027/100/100/threaded; http://www.securityfocus.com/bid/20204
CVE: CVE-2006-5104
Published: 2006-10-03
Description: SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1661; http://www.securityfocus.com/archive/1/447010/100/0/threaded; http://www.securityfocus.com/bid/20214
CVE: CVE-2006-5105
Published: 2006-10-03
Description: Multiple PHP remote file inclusion vulnerabilities in SyntaxCMS 1.1.1 through 1.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the init_path parameter to admin/testing/tests/0030_init_syntax.php, or (2) an unspecified parameter to admin/testing/index.php.  NOTE: the 0004_init_urls.php vector is already covered by CVE-2006-5055.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22067; http://www.syntaxcms.org/content/article/detail/513; https://exchange.xforce.ibmcloud.com/vulnerabilities/29122
CVE: CVE-2006-5106
Published: 2006-10-03
Description: Cross-site scripting (XSS) vulnerability in FacileForms before 1.4.7 for Mambo and Joomla!, when either register_globals or RG_EMULATION is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22125; http://www.facileforms.biz/content/view/108/140/; http://www.osvdb.org/29237
CVE: CVE-2006-5107
Published: 2006-10-03
Description: Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter in admin/forgot_pass.php, (2) the order_id parameter in view_order.php, (3) the view_doc parameter in view_doc.php, and (4) the order_id parameter in admin/print_order.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1662; http://www.securityfocus.com/archive/1/447009/100/0/threaded; http://www.securityfocus.com/bid/20215
CVE: CVE-2006-5108
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the order_id parameter in (1) admin/print_order.php and (2) view_order.php; the (3) site_url and (4) la_search_home parameters and (5) certain language parameters in admin/nav.php; the (6) image parameter in admin/image.php; the (7) site_name, (8) la_adm_header, (9) charset, and (10) certain other parameters in admin/header.inc.php; the (12) la_pow_by parameter in footer.inc.php; and the (13) site_name parameter and (14) certain other parameters in header.inc.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22175; http://securityreason.com/securityalert/1662; http://www.osvdb.org/29246
CVE: CVE-2006-5109
Published: 2006-10-03
Description: Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link_navi.php or (2) spotlight.php, which reveals the path in various error messages.  NOTE: the information.php, language.php, list_docs.php, popular_prod.php, sale.php, check_sum.php, and cat_navi.php vectors are already covered by CVE-2005-0607.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1662; http://www.securityfocus.com/archive/1/447009/100/0/threaded; http://www.securityfocus.com/bid/20215
CVE: CVE-2006-5110
Published: 2006-10-03
Description: Cross-site scripting (XSS) vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2006-5074.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33389; http://secunia.com/advisories/22123; http://www.vupen.com/english/advisories/2006/3795
CVE: CVE-2006-5111
Published: 2006-10-03
Description: The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a denial of service (application crash) via a malformed X.509 certificate in a signature.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22423; http://secunia.com/advisories/22445; http://secunia.com/advisories/22473
CVE: CVE-2006-5112
Published: 2006-10-03
Description: Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22124; http://www.kb.cert.org/vuls/id/693992; http://www.securityfocus.com/bid/20250
CVE: CVE-2006-5113
Published: 2006-10-03
Description: Directory traversal vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to include and execute local files via a .. (dot dot) in the lan parameter to includes.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.org/0610-exploits/Exporia-0.3.0.txt; http://secunia.com/advisories/22146; http://www.osvdb.org/29218
CVE: CVE-2006-5114
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in wgate in SAP Internet Transaction Server (ITS) 6.1 and 6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) ~urlmime or (2) ~command parameter, different vectors than CVE-2003-0749.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22171; http://securityreason.com/securityalert/1665; http://www.securityfocus.com/archive/1/447262/100/0/threaded
CVE: CVE-2006-5115
Published: 2006-10-03
Description: Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the engine parameter, as demonstrated by uploading a file containing PHP code with an image/jpeg content type, and then referencing this file through the engine parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22152; http://www.securityfocus.com/bid/20258; http://www.vupen.com/english/advisories/2006/3844
CVE: CVE-2006-5116
Published: 2006-10-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php.  NOTE: the PHP unset function vector is covered by CVE-2006-3017.
CVSS Score: 5.1 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-October/001067.html; http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html; http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download
CVE: CVE-2006-5117
Published: 2006-10-03
Description: phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html; http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download; http://secunia.com/advisories/22126
CVE: CVE-2006-5118
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in index.php3 in the PDD package for PHPSelect Web Development Division allows remote attackers to execute arbitrary PHP code via a URL in the Application_Root parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1666; http://www.securityfocus.com/archive/1/447177/100/0/threaded; http://www.securityfocus.com/bid/20231
CVE: CVE-2006-5119
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_name or (2) admin_pass parameter in (a) admin/login.php, or the (3) admin_email parameter in (b) admin/password_forgotten.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/22118; http://securityreason.com/securityalert/1667; http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0003
CVE: CVE-2006-5120
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Scott Metoyer Red Mombin 0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) index.php and (2) process_login.php.
CVSS Score: 4.0 (MEDIUM)
References: http://securityreason.com/securityalert/1668; http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0002; http://www.securityfocus.com/archive/1/447255/100/0/threaded
CVE: CVE-2006-5121
Published: 2006-10-03
Description: SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter.
CVSS Score: 7.5 (HIGH)
References: http://community.postnuke.com/index.php?name=News&file=article&sid=2783; http://secunia.com/advisories/22197; http://securityreason.com/securityalert/1669
CVE: CVE-2006-5122
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mercury SiteScope 8.2 (8.1.2.0) allow remote authenticated users to inject arbitrary web script or HTML via (1) "any field create name field" except "create new group name" or (2) any description field.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/22215; http://securityreason.com/securityalert/1670; http://www.securityfocus.com/archive/1/447397/100/0/threaded
CVE: CVE-2006-5123
Published: 2006-10-03
Description: Multiple PHP remote file inclusion vulnerabilities in Albrecht Guenther PHProjekt 5.1.x before 5.1.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lib_path or (2) lang_path parameter in unspecified files, related to code changes intended to fix inclusion, a different vulnerability than CVE-2002-0451, CVE-2006-4204, and CVE-2006-4609.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22167; http://securityreason.com/securityalert/1672; http://www.hardened-php.net/advisory_062006.129.html
CVE: CVE-2006-5124
Published: 2006-10-03
Description: Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) target and (2) action parameters in window.php, and possibly the (3) target parameter in home.php.
CVSS Score: 7.5 (HIGH)
References: http://kernel-32.blogspot.com/2006/09/php-mywebmin-10-remote-file-include.html; http://secunia.com/advisories/22178; http://www.securityfocus.com/bid/20264
CVE: CVE-2006-5125
Published: 2006-10-03
Description: Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remote attackers to obtain sensitive information via a directory name in the target parameter, which triggers a directory listing through the opendir function.
CVSS Score: 5.0 (MEDIUM)
References: http://kernel-32.blogspot.com/2006/09/php-mywebmin-10-remote-file-include.html; http://secunia.com/advisories/22178; http://www.securityfocus.com/bid/20264
CVE: CVE-2006-5126
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in index.php in John Himmelman (aka DaRk2k1) PowerPortal 1.3a allows remote attackers to execute arbitrary PHP code via a URL in the file_name[] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22209; http://www.securityfocus.com/bid/20262; https://exchange.xforce.ibmcloud.com/vulnerabilities/29264
CVE: CVE-2006-5127
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Bartels Schoene ConPresso before 4.0.5a allow remote attackers to inject arbitrary web script or HTML via (1) the nr parameter in detail.php, (2) the msg parameter in db_mysql.inc.php, and (3) the pos parameter in index.php.
CVSS Score: 6.8 (MEDIUM)
References: http://download.compresso.de/compresso-4.0.5a.zip; http://secunia.com/advisories/22145; http://securityreason.com/securityalert/1671
CVE: CVE-2006-5128
Published: 2006-10-03
Description: SQL injection vulnerability in index.php in Bartels Schoene ConPresso before 4.0.5a allows remote attackers to execute arbitrary SQL commands via the nr parameter.
CVSS Score: 7.5 (HIGH)
References: http://download.compresso.de/compresso-4.0.5a.zip; http://secunia.com/advisories/22145; http://securityreason.com/securityalert/1671
CVE: CVE-2006-5129
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) the message parameter, and possibly other parameters, in module/shout/jafshout.php (aka the shoutbox); and (2) the message body in a forum post in module/forum/topicwin.php, related to the name, email, title, date, ldate, and lname variables.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22143; http://securityreason.com/securityalert/1674; http://www.securityfocus.com/archive/1/447081/100/0/threaded
CVE: CVE-2006-5130
Published: 2006-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) url, (3) title, and (4) about parameters in a forum post.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22143; http://secunia.com/advisories/22143
CVE: CVE-2006-5131
Published: 2006-10-03
Description: module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "<?php" and "?>", possibly due to a static code injection vulnerability involving admin/data_inc.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22143; http://securityreason.com/securityalert/1674; http://www.securityfocus.com/archive/1/447081/100/0/threaded
CVE: CVE-2006-5132
Published: 2006-10-03
Description: Multiple PHP remote file inclusion vulnerabilities in phpMyAgenda 3.0 Final and earlier allow remote attackers to execute arbitrary PHP code via a URL in the rootagenda parameter to (1) agendaplace.php3, (2) agendaplace2.php3, (3) infoevent.php3, and (4) agenda2.php3, different vectors than CVE-2006-2009.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/ref/29/2914x-phpmyagenda.txt; http://sourceforge.net/forum/forum.php?forum_id=569237; http://www.osvdb.org/29148
CVE: CVE-2006-5133
Published: 2006-10-03
Description: Buffer overflow in GuildFTPd 0.999.13 allows remote attackers to have an unknown impact, possibly code execution related to input containing "globbing chars."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0139.html; http://forums.guildftpd.com/viewtopic.php?t=452; http://securityreason.com/securityalert/1675
CVE: CVE-2006-5134
Published: 2006-10-03
Description: Mercury SiteScope 8.2 (8.1.2.0) allows remote authenticated users to cause a denial of service (loss of connectivity to the classic interface) via attempted HTML injection into the "new monitor description" field.
CVSS Score: 4.0 (MEDIUM)
References: http://securityreason.com/securityalert/1670; http://www.securityfocus.com/archive/1/447397/100/0/threaded; http://www.securityfocus.com/bid/20275
CVE: CVE-2006-5135
Published: 2006-10-03
Description: Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) open_box, (2) middle_box, and (3) close_box parameters in (a) sources/myaccount.php; the (4) navigation_end parameter in (b) navigation/search.php and (c) navigation/donation.php; and the (6) navigation_start and (7) navigation_middle parameters in navigation/donation.php, (d) navigation/latestnews.php, and (e) navigation/links.php; different vectors than CVE-2006-5092.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20238; https://exchange.xforce.ibmcloud.com/vulnerabilities/29218; https://www.exploit-db.com/exploits/2442
CVE: CVE-2006-5136
Published: 2006-10-03
Description: Multiple PHP remote file inclusion vulnerabilities in ubbt.inc.php in Groupee UBB.threads 6.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[thispath] or (2) GLOBALS[configdir] parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1676; http://www.securityfocus.com/archive/1/447359/100/0/threaded; http://www.securityfocus.com/bid/20266
CVE: CVE-2006-5137
Published: 2006-10-03
Description: Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array parameter to admin/doeditconfig.php, and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the config[path] parameter, and then execute the code via (3) dorateuser.php, (4) calendar.php, and unspecified other scripts.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1676; http://www.securityfocus.com/archive/1/447359/100/0/threaded; http://www.securityfocus.com/bid/20266
CVE: CVE-2006-5138
Published: 2006-10-03
Description: Groupee UBB.threads 6.5.1.1 allows remote attackers to obtain sensitive information via a direct request for cron/php/subscriptions.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1676; http://www.securityfocus.com/archive/1/447359/100/0/threaded; http://www.securityfocus.com/bid/20266
CVE: CVE-2006-5139
Published: 2006-10-03
Description: Unspecified vulnerability in MkPortal allows remote attackers to corrupt web site content, and possibly have other impact, via a certain long Message that affects "Tables," related to the Urlobox.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1673; http://www.securityfocus.com/archive/1/447309/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33469
CVE: CVE-2006-5140
Published: 2006-10-03
Description: SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20270; https://exchange.xforce.ibmcloud.com/vulnerabilities/29270; https://www.exploit-db.com/exploits/2456
CVE: CVE-2006-5141
Published: 2006-10-03
Description: PHP remote file inclusion vulnerability in script.php in Kevin A. Gordon Open Geo Targeting (aka geotarget) allows remote attackers to execute arbitrary PHP code via a URL in the anp_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37969; http://www.securityfocus.com/bid/20272; http://osvdb.org/37969
CVE: CVE-2006-4511
Published: 2006-10-05
Description: Messenger Agents (nmma.exe) in Novell GroupWise 2.0.2 and 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted HTTP POST request to TCP port 8300 with a modified val parameter, which triggers a null dereference related to "zero-size strings in blowfish routines."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22244; http://securitytracker.com/id?1016974; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974452.htm
CVE: CVE-2006-5144
Published: 2006-10-05
Description: Cross-site scripting (XSS) vulnerability in userupload.php in OlateDownload 3.4.0 allows remote attackers to inject arbitrary web script or HTML via the description_small parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22241; http://securityreason.com/securityalert/1680; http://www.securityfocus.com/archive/1/447424/100/0/threaded
CVE: CVE-2006-5145
Published: 2006-10-05
Description: Multiple SQL injection vulnerabilities in OlateDownload 3.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter in details.php or the (2) query parameter in search.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22241; http://securityreason.com/securityalert/1680; http://www.securityfocus.com/archive/1/447424/100/0/threaded
CVE: CVE-2006-5146
Published: 2006-10-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Yblog allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) funk.php, or the (2) action parameter in (b) tem.php and (c) uss.php.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1679; http://www.attrition.org/pipermail/vim/2006-October/001065.html; http://www.securityfocus.com/archive/1/447427/100/0/threaded