deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3272
Published: 2006-06-28
Description: Cross-site request forgery (CSRF) vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user, such as changing usernames and passwords, via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20770; https://exchange.xforce.ibmcloud.com/vulnerabilities/27307; http://secunia.com/advisories/20770
CVE: CVE-2006-3273
Published: 2006-06-28
Description: Cross-site scripting (XSS) vulnerability in menu.php in Some Chess 1.5 rc1 allows remote attackers to inject arbitrary web script or HTML via the user parameter ("New Name" field).
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20770; http://securityreason.com/securityalert/1162; http://securitytracker.com/id?1016360
CVE: CVE-2006-3274
Published: 2006-06-28
Description: Directory traversal vulnerability in Webmin before 1.280, when run on Windows, allows remote attackers to read arbitrary files via \ (backslash) characters in the URL to certain directories under the web root, such as the image directory.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/20777; http://securityreason.com/securityalert/1161
CVE: CVE-2006-3275
Published: 2006-06-28
Description: SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4221&w=2; http://secunia.com/advisories/20780; http://www.securityfocus.com/bid/18625
CVE: CVE-2006-3276
Published: 2006-06-28
Description: Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via (1) a long User-Agent HTTP header in the RTSP service and (2) unspecified vectors involving the "parsing of HTTP URL schemes".
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0600.html; http://labs.musecurity.com/advisories/MU-200606-01.txt; http://secunia.com/advisories/20784
CVE: CVE-2006-3277
Published: 2006-06-28
Description: The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument, possibly triggering a length inconsistency or a missing argument.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/20790; http://securitytracker.com/id?1016376; http://www.divisionbyzero.be/?p=173
CVE: CVE-2006-3278
Published: 2006-06-28
Description: Cross-site scripting (XSS) vulnerability in H-Sphere 2.5.1 Beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) next_template, (2) start, (3) curr_menu_id, and (4) arid parameters in psoft/servlet/resadmin/psoft.hsphere.CP when using the mailman/massmail.html template_name.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/h-sphere-25x-xss-vuln.html; http://secunia.com/advisories/20798; http://www.osvdb.org/26863
CVE: CVE-2006-3279
Published: 2006-06-28
Description: Cross-site scripting (XSS) vulnerability in aeDating 4.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Sex parameter in index.php, (2) ProfileType parameter in join_form.php, and (3) Email parameter in forgot.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20820; http://www.osvdb.org/26830; http://www.osvdb.org/26831
CVE: CVE-2006-3280
Published: 2006-06-28
Description: Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047398.html; http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060627/3d930eda/PLEBO-2006.06.16-IE_ONE_MINOR_ONE_MAJOR.obj; http://secunia.com/advisories/20825
CVE: CVE-2006-3281
Published: 2006-06-28
Description: Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ (%2e%2e%5c) sequences and whose extension contains the CLSID Key identifier for HTML Applications (HTA), aka "Folder GUID Code Execution Vulnerability."  NOTE: directory traversal sequences were used in the original exploit, although their role is not clear.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047398.html; http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060627/3d930eda/PLEBO-2006.06.16-IE_ONE_MINOR_ONE_MAJOR.obj; http://secunia.com/advisories/20825
CVE: CVE-2006-3282
Published: 2006-06-28
Description: requirements.php in Dating Agent PRO 4.7.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20833; http://securityreason.com/securityalert/1164; http://www.securityfocus.com/archive/1/438160/100/100/threaded
CVE: CVE-2006-3283
Published: 2006-06-28
Description: SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the (1) pid parameter in picture.php, (2) mid parameter in mem.php, and the (3) sex and (4) relationship parameters in search.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1164; http://www.securityfocus.com/archive/1/438160/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27342
CVE: CVE-2006-3284
Published: 2006-06-28
Description: Cross-site scripting (XSS) vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in (1) webmaster/index.php and (2) search.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20833; http://securityreason.com/securityalert/1164; http://www.securityfocus.com/archive/1/438160/100/100/threaded
CVE: CVE-2006-3285
Published: 2006-06-28
Description: The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) uses an undocumented, hard-coded username and password, which allows remote authenticated users to read, and possibly modify, sensitive configuration data (aka bugs CSCsd15955).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20870; http://securitytracker.com/id?1016398; http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
CVE: CVE-2006-3286
Published: 2006-06-28
Description: The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(63) stores a hard-coded username and password in plaintext within unspecified files, which allows remote authenticated users to access the database (aka bug CSCsd15951).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20870; http://securitytracker.com/id?1016398; http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
CVE: CVE-2006-3287
Published: 2006-06-28
Description: Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier uses a default administrator username "root" and password "public," which allows remote attackers to gain access (aka bug CSCse21391).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20870; http://securitytracker.com/id?1016398; http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
CVE: CVE-2006-3288
Published: 2006-06-28
Description: Unspecified vulnerability in the TFTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51), when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20870; http://securitytracker.com/id?1016398; http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
CVE: CVE-2006-3289
Published: 2006-06-28
Description: Cross-site scripting (XSS) vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a "malicious URL".
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20870; http://securitytracker.com/id?1016398; http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
CVE: CVE-2006-3290
Published: 2006-06-28
Description: HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20870; http://securitytracker.com/id?1016398; http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
CVE: CVE-2006-3291
Published: 2006-06-28
Description: The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password configurations and allows remote attackers to access the system.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/20860; http://securitytracker.com/id?1016399; http://www.cisco.com/warp/public/707/cisco-sa-20060628-ap.shtml
CVE: CVE-2006-3292
Published: 2006-06-28
Description: SQL injection vulnerability in the Search gadget in Jaws 0.6.2 allows remote attackers to execute arbitrary SQL commands via queries with the "LIKE" keyword in the searchdata parameter (search field).
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/JAWS_062_sql.html; http://secunia.com/advisories/20842; http://securityreason.com/securityalert/1165
CVE: CVE-2006-3293
Published: 2006-06-29
Description: parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20805; http://secunia.com/advisories/20837; http://www.energymech.net/versions-3.0.html
CVE: CVE-2006-3294
Published: 2006-06-29
Description: PHP remote file inclusion vulnerability in mod_cbsms_messages.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20823; http://www.osvdb.org/26862; http://www.securityfocus.com/bid/18660
CVE: CVE-2006-3295
Published: 2006-06-29
Description: Cross-site scripting (XSS) vulnerability in header.php in Open Guestbook 0.5 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20796; http://securityreason.com/securityalert/1166; http://www.securityfocus.com/archive/1/438381/100/0/threaded
CVE: CVE-2006-3296
Published: 2006-06-29
Description: SQL injection vulnerability in view.php in Open Guestbook 0.5 allows remote attackers to execute arbitrary SQL commands via the offset parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20796; http://securityreason.com/securityalert/1166; http://www.securityfocus.com/archive/1/438381/100/0/threaded
CVE: CVE-2006-3297
Published: 2006-06-29
Description: Cross-site scripting (XSS) vulnerability in error.php in UebiMiau Webmail 2.7.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the icq parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/2513; https://exchange.xforce.ibmcloud.com/vulnerabilities/27371; http://www.vupen.com/english/advisories/2006/2513
CVE: CVE-2006-3298
Published: 2006-06-29
Description: Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters, which triggers the crash in jscript.dll.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20773; http://www.security.nnov.ru/Gnews281.html; http://www.securityfocus.com/bid/18622
CVE: CVE-2006-3299
Published: 2006-06-29
Description: Cross-site scripting (XSS) vulnerability in index.php in Usenet Script 0.5 allows remote attackers to inject arbitrary web script or HTML via the group parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20872; http://securityreason.com/securityalert/1170; http://www.securityfocus.com/archive/1/438443/100/0/threaded
CVE: CVE-2006-3300
Published: 2006-06-29
Description: PHP remote file inclusion vulnerability in sms_config/gateway.php in PhpMySms 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20799; http://www.osvdb.org/26885; http://www.securityfocus.com/bid/18633
CVE: CVE-2006-3301
Published: 2006-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpQLAdmin 2.2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) user_add.php or (2) unit_add.php.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/phpqladmin-vuln.html; http://secunia.com/advisories/20788; http://www.securityfocus.com/bid/18658
CVE: CVE-2006-3302
Published: 2006-06-29
Description: PHP remote file inclusion vulnerability in mod_cbsms.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosC_a_path parameter.  NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/2528; https://exchange.xforce.ibmcloud.com/vulnerabilities/27374; http://www.vupen.com/english/advisories/2006/2528
CVE: CVE-2006-3303
Published: 2006-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in pm.php in DeluxeBB 1.07 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) to parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/deluxebb-107-xss-vuln.html; http://secunia.com/advisories/20813; http://securitytracker.com/id?1016380
CVE: CVE-2006-3304
Published: 2006-06-29
Description: SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20813; http://securityreason.com/securityalert/1180; http://securitytracker.com/id?1016384
CVE: CVE-2006-3305
Published: 2006-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in UebiMiau Webmail 2.7.10, and 2.7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) f_user parameter in index.php, the (2) pag parameter in messages.php, or the (3) lid, (4) tid, and (5) sid parameters in error.php.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/06/uebimiau-webmail-xss-vuln.html; http://secunia.com/advisories/20804; http://www.securityfocus.com/bid/18643
CVE: CVE-2006-3306
Published: 2006-06-29
Description: Cross-site scripting (XSS) vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20[PII_REDACTED]-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20760; http://www.securityfocus.com/bid/18627; http://www.vupen.com/english/advisories/2006/2503
CVE: CVE-2006-3307
Published: 2006-06-29
Description: Multiple SQL injection vulnerabilities in Project EROS bbsengine before bbsengine-20[PII_REDACTED]-jam allow remote attackers to execute arbitrary SQL commands via (1) unspecified parameters in the php/comment.php and (2) the getpartialmatches method in php/aolbonics.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20760; http://www.securityfocus.com/bid/18627; http://www.vupen.com/english/advisories/2006/2503
CVE: CVE-2006-3308
Published: 2006-06-29
Description: Unspecified vulnerability in the wpprop code for Project EROS bbsengine before 20[PII_REDACTED] has unknown impact and remote attack vectors via [img] tags, possibly cross-site scripting (XSS).
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/20760; http://sourceforge.net/project/shownotes.php?release_id=427430&group_id=86388; http://www.securityfocus.com/bid/18627
CVE: CVE-2006-3309
Published: 2006-06-29
Description: SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20857; http://www.osvdb.org/26870; http://www.securityfocus.com/bid/18688
CVE: CVE-2006-3268
Published: 2006-06-29
Description: Unspecified vulnerability in the Windows Client API in Novell GroupWise 5.x through 7 might allow users to obtain "random programmatic access" to other email within the same post office.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20888; http://securitytracker.com/id?1016404; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2973921.htm
CVE: CVE-2006-3312
Published: 2006-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in ashmans and Bill Echlin QaTraq 6.5 RC and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) link_print, (2) link_upgrade, (3) link_sql, (4) link_next, (5) link_prev, and (6) link_list parameters in top.inc as included by queries_view_search.php; the (7) msg, (8) component_name, and (9) component_desc parameters in (a) components_copy_content.php, (b) components_modify_content.php, and (c) components_new_content.php; the (10) title, (11) version, and (12) content parameters in design_copy_content.php; the (13) plan_title and (14) plan_content parameters in design_copy_plan_search.php; the (15) title, (16) minor_version, (17) new_version, and (18) content parameters in design_modify_content.php; the (19) title, (20) version, and (21) content parameters in design_new_content.php; the (22) plan_name and (23) plan_desc parameters in design_new_search.php; the (24) file_name parameter in download.php; the (25) username and (26) password parameters in login.php; the (27) title, (28) version, and (29) content parameters in phase_copy_content.php; the (30) content parameter in phase_delete_search.php; the (31) title, (32) minor_version, (33) new_version, and (34) content parameters in phase_modify_content.php; the (35) content, (36) title, (37) version, and (38) content parameters in phase_modify_search.php; the (39) content parameter in phase_view_search.php; the (40) msg, (41) product_name, and (42) product_desc parameters in products_copy_content.php; and possibly the (43) product_name and (44) product_desc parameters in (d) products_copy_search.php, and a large number of additional parameters and executables.  NOTE: the vendor notified CVE via e-mail that this issue has been fixed in the 6.8 RC release.
CVSS Score: 4.3 (MEDIUM)
References: http://seclab.tuwien.ac.at/advisories/TUVSA-0606-001.txt; http://securityreason.com/securityalert/1169; http://securitytracker.com/id?1016381
CVE: CVE-2006-3313
Published: 2006-06-29
Description: Cross-site scripting (XSS) vulnerability in search.jsp in Netsoft smartNet 2.0 allows remote attackers to inject arbitrary web script or HTML via the keyWord parameter.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1168; http://securitytracker.com/id?1016367; http://www.kil13r.info/sa/Kil13r-SA-20060622-1.txt
CVE: CVE-2006-3314
Published: 2006-06-29
Description: PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the pageid parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1167; http://securitytracker.com/id?1016346; http://www.securityfocus.com/archive/1/437836/100/0/threaded
CVE: CVE-2006-3315
Published: 2006-06-29
Description: PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the osCsid parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0387.html; http://securityreason.com/securityalert/1176; http://www.securityfocus.com/bid/18435
CVE: CVE-2006-3115
Published: 2006-06-29
Description: SQL injection vulnerability in view.php in phpRaid 3.0.4, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the raid_id parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20200; http://secunia.com/secunia_research/2006-47/advisory/; https://exchange.xforce.ibmcloud.com/vulnerabilities/27457
CVE: CVE-2006-3116
Published: 2006-06-29
Description: Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.4 and 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) configuration.php, (3) guilds.php, (4) index.php, (5) locations.php, (6) login.php, (7) lua_output.php, (8) permissions.php, (9) profile.php, (10) raids.php, (11) register.php, (12) roster.php, and (13) view.php.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0824.html; http://secunia.com/advisories/20200; http://secunia.com/secunia_research/2006-47/advisory/
CVE: CVE-2006-3316
Published: 2006-06-29
Description: Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) logs.php and (2) users.php, a different set of vectors than CVE-2006-3116.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20200; http://secunia.com/secunia_research/2006-47/advisory/; http://www.osvdb.org/26903
CVE: CVE-2006-3317
Published: 2006-06-29
Description: PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcements.php and (2) rss.php, a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0824.html; http://secunia.com/advisories/20865; http://secunia.com/secunia_research/2006-47/advisory/
CVE: CVE-2006-3318
Published: 2006-06-29
Description: SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/20865; http://secunia.com/secunia_research/2006-47/advisory/; http://securityreason.com/securityalert/1173