deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1148
Published: 2006-03-10
Description: Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/19169; http://secunia.com/advisories/19291; http://security.gentoo.org/glsa/glsa-200603-17.xml
CVE: CVE-2006-1149
Published: 2006-03-10
Description: PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19142; http://www.osvdb.org/23734; http://www.securityfocus.com/bid/17021
CVE: CVE-2006-1150
Published: 2006-03-10
Description: Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1, automatically appends an _ (underscore) to the end of duplicate nicknames, which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long, identical nicknames, which triggers an off-by-one error.
CVSS Score: 7.8 (HIGH)
References: http://aluigi.altervista.org/adv/tegob1-adv.txt; http://secunia.com/advisories/19134; http://www.securityfocus.com/bid/16982
CVE: CVE-2006-1151
Published: 2006-03-10
Description: Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://biyosecurity.be/bugs/mphorum.txt; http://secunia.com/advisories/19121; http://securityvulns.com/Ldocument750.html
CVE: CVE-2006-1152
Published: 2006-03-10
Description: PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19121; http://www.osvdb.org/23740; http://www.securityfocus.com/bid/16977
CVE: CVE-2006-1153
Published: 2006-03-10
Description: SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board (IPB).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19132; http://www.securityfocus.com/bid/16984; http://www.vupen.com/english/advisories/2006/0865
CVE: CVE-2006-1154
Published: 2006-03-10
Description: PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable.  NOTE: 2.1.4 was also reported to be vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21807; http://secunia.com/advisories/23519; http://sx02.coresec.de/advisories/152.txt
CVE: CVE-2006-1155
Published: 2006-03-12
Description: Cross-site scripting (XSS) vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in (1) login.asp and (2) default.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19156; http://www.manastungare.com/projects/site-membership/; http://www.osvdb.org/23753
CVE: CVE-2006-1156
Published: 2006-03-12
Description: SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19156; http://www.manastungare.com/projects/site-membership/; http://www.osvdb.org/23755
CVE: CVE-2006-1157
Published: 2006-03-12
Description: Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the Subject field (possibly messaggio parameter) when posting a new message in post.php.
CVSS Score: 4.3 (MEDIUM)
References: http://biyosecurity.be/bugs/adpforum2.txt; http://www.osvdb.org/23961; http://www.securityfocus.com/archive/1/427171/100/0/threaded
CVE: CVE-2006-1158
Published: 2006-03-12
Description: Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19150; http://securitytracker.com/id?1015748; http://www.kerio.com/kms_history.html
CVE: CVE-2006-0557
Published: 2006-03-12
Description: sys_mbind in mempolicy.c in Linux kernel 2.6.16 and earlier does not sanity check the maxnod variable before making certain computations for the get_nodes function, which has unknown impact and attack vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://lkml.org/lkml/2006/2/27/355; http://rhn.redhat.com/errata/RHBA-2007-0304.html; http://secunia.com/advisories/19955
CVE: CVE-2006-1159
Published: 2006-03-12
Description: Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19178; http://www.osvdb.org/23792; http://www.securityfocus.com/archive/1/427158/100/0/threaded
CVE: CVE-2006-1160
Published: 2006-03-12
Description: Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to inject arbitrary web script or HTML via the Description field in creating a folder or uploading a file.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19178; http://www.osvdb.org/23793; http://www.securityfocus.com/archive/1/427158/100/0/threaded
CVE: CVE-2006-1161
Published: 2006-03-12
Description: Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execute arbitrary code by uploading a malicious file to the Windows startup folder.
CVSS Score: 6.5 (MEDIUM)
References: http://www.osvdb.org/23791; http://www.securityfocus.com/archive/1/427158/100/0/threaded; http://www.securityfocus.com/bid/17046
CVE: CVE-2006-1162
Published: 2006-03-12
Description: Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a ..  (dot dot) in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://hamid.ir/security/nodez.txt; http://secunia.com/advisories/19165; http://securitytracker.com/id?1015747
CVE: CVE-2006-1163
Published: 2006-03-12
Description: Cross-site scripting (XSS) vulnerability in Nodez 4.6.1.1 allows remote attackers to inject arbitrary web script or HTML via the op parameter.  NOTE: it is possible that this issue is resultant from the directory traversal vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: http://hamid.ir/security/nodez.txt; http://secunia.com/advisories/19165; http://securitytracker.com/id?1015747
CVE: CVE-2006-1164
Published: 2006-03-12
Description: Nodez 4.6.1.1 and earlier stores sensitive data in the list.gtdat file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing list.gtdat.
CVSS Score: 7.5 (HIGH)
References: http://hamid.ir/security/nodez.txt; http://www.osvdb.org/23775; http://www.securityfocus.com/bid/17066
CVE: CVE-2006-1165
Published: 2006-03-12
Description: Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19186; http://wiki.splitbrain.org/wiki%3Achanges; http://www.securityfocus.com/bid/17065
CVE: CVE-2006-1166
Published: 2006-03-12
Description: Monotone 0.25 and earlier, when a user creates a file in a directory called "mt", and when checking out that file on a case-insensitive file system such as Windows or Mac OS X, places the file into the "MT" bookkeeping directory, which could allow context-dependent attackers to execute arbitrary Lua programs as the user running monotone.
CVSS Score: 3.7 (LOW)
References: http://lists.gnu.org/archive/html/monotone-devel/2006-03/msg00062.html; http://secunia.com/advisories/19260; http://www.securityfocus.com/bid/17139
CVE: CVE-2006-1183
Published: 2006-03-13
Description: The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/19200; http://securitytracker.com/id?1015761; http://www.osvdb.org/23868
CVE: CVE-2006-0819
Published: 2006-03-13
Description: Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/18962; http://secunia.com/secunia_research/2006-13/advisory; http://securityreason.com/securityalert/576
CVE: CVE-2006-0820
Published: 2006-03-13
Description: Cross-site scripting (XSS) vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18962; http://secunia.com/secunia_research/2006-13/advisory; http://securitytracker.com/id?1015779
CVE: CVE-2006-0950
Published: 2006-03-13
Description: unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.
CVSS Score: 2.6 (LOW)
CWE: CWE-22
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2033&w=2; http://secunia.com/advisories/19063; http://secunia.com/secunia_research/2006-16/
CVE: CVE-2006-0049
Published: 2006-03-13
Description: gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U; http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html; http://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.html
CVE: CVE-2006-1194
Published: 2006-03-13
Description: Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet with a large command length value, which leads to an invalid memory access.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/enetx-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/043541.html; http://secunia.com/advisories/19208
CVE: CVE-2006-1195
Published: 2006-03-13
Description: The enet_protocol_handle_send_fragment function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet fragment with a large total data size, which triggers an application abort when memory allocation fails.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/enetx-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/043541.html; http://secunia.com/advisories/19208
CVE: CVE-2006-1196
Published: 2006-03-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in QwikiWiki 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) from and (2) help parameters to (a) index.php; (3) action, (4) page, (5) debug, (6) help, (7) username, or (8) password parameters to (b) login.php; the (7) help parameter to (c) pageindex.php; or (8) help parameter to (d) recentchanges.php.
CVSS Score: 4.3 (MEDIUM)
References: http://kiki91.altervista.org/exploit/qwikiwiki_1.0.5_xss.txt; http://secunia.com/advisories/19182; http://www.osvdb.org/23786
CVE: CVE-2006-1197
Published: 2006-03-13
Description: SafeDisc installs the driver service for the secdrv.sys driver with insecure permissions, which allows local users to gain privileges by changing the configuration to reference a malicious program.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/427410/100/0/threaded; http://www.securityfocus.com/bid/17070; https://exchange.xforce.ibmcloud.com/vulnerabilities/25162
CVE: CVE-2006-1198
Published: 2006-03-14
Description: Comvigo IM Lock 2006 uses a simple substitution cipher to encrypt a password stored in the msnvs\prc registry value, for which all users have Read permission, which allows local users to bypass the product's blocking functionality by decrypting the password.
CVSS Score: 3.7 (LOW)
References: http://secunia.com/advisories/19140; http://www.securityfocus.com/archive/1/426935/100/0/threaded; http://www.securityfocus.com/bid/16988
CVE: CVE-2006-1199
Published: 2006-03-14
Description: Cross-site scripting (XSS) vulnerability in iframe.php in daverave Link Bank allows remote attackers to inject arbitrary web script or HTML via the site parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19154; http://www.osvdb.org/23751; http://www.securityfocus.com/archive/1/426932/100/0/threaded
CVE: CVE-2006-1200
Published: 2006-03-14
Description: Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include statement.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19154; http://securityreason.com/securityalert/553; http://www.osvdb.org/23750
CVE: CVE-2006-1201
Published: 2006-03-14
Description: Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier, and other versions before 2.0 Update 5, allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a "Recover password" operation (recoverpw.php).
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0879.html; http://secunia.com/advisories/19127; http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php
CVE: CVE-2006-1202
Published: 2006-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in textfileBB 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) mess and (2) user parameters in messanger.php, possibly requiring a URL encoded value.
CVSS Score: 4.3 (MEDIUM)
References: http://notlegal.ws/textfilebbmessanger.txt; http://secunia.com/advisories/19149; http://securitytracker.com/id?1015744
CVE: CVE-2006-1203
Published: 2006-03-14
Description: PHP remote file include vulnerability in common.php in txtForum 1.0.4-dev and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the skin parameter to login.php, and possibly other parameters to other PHP scripts, related to include statements in common.php.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/23952; http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-004.txt; http://www.securityfocus.com/archive/1/427188/100/0/threaded
CVE: CVE-2006-1204
Published: 2006-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in txtForum 1.0.4-dev and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prev, (2) next, and (3) rand5 parameters in (a) index.php; the (4) r_username and (5) r_loc parameters in (b) new_topic.php; the (6) r_num, (7) r_family_name, (8) r_icq, (9) r_yahoo, (10) r_aim, (11) r_homepage, (12) r_interests, (13) r_about, (14) selected1, (15) selected0, (16) signature_selected1, (17) signature_selected0, (18) smile_selected1, (19) smile_selected0, (20) ubb_selected1, and (21) ubb_selected0 parameters in (c) profile.php; the (22) quote and (23) tid parameters in (d) reply.php; and the (24) tid, (25) sticked, and (26) mid parameters in (e) view_topic.php.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/23953; http://www.osvdb.org/23954; http://www.osvdb.org/23955
CVE: CVE-2006-1205
Published: 2006-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/23973; http://www.osvdb.org/23974; http://www.osvdb.org/23975
CVE: CVE-2006-1206
Published: 2006-03-14
Description: Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and on general-purpose operating systems, allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015742; http://www.securityfocus.com/archive/1/426999/100/0/threaded; http://www.securityfocus.com/bid/17024
CVE: CVE-2006-1207
Published: 2006-03-14
Description: PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/[USERNAME] file.
CVSS Score: 5.0 (MEDIUM)
References: http://biyosecurity.be/bugs/phpuploadcenter2.txt; http://www.blogcu.com/Liz0ziM/317250/; http://www.osvdb.org/23627
CVE: CVE-2006-1208
Published: 2006-03-14
Description: Sergey Korostel PHP Upload Center allows remote attackers to execute arbitrary PHP code by uploading a file whose name ends in a .php.li extension, which can be accessed from the upload directory.
CVSS Score: 7.5 (HIGH)
References: http://biyosecurity.be/bugs/phpuploadcenter2.txt; http://secunia.com/advisories/19107; http://securityreason.com/securityalert/564
CVE: CVE-2006-1209
Published: 2006-03-14
Description: PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.
CVSS Score: 5.0 (MEDIUM)
References: http://biyosecurity.be/bugs/patm.txt; http://secunia.com/advisories/17134; http://securityreason.com/securityalert/565
CVE: CVE-2006-1210
Published: 2006-03-14
Description: The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source.  NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/427155/100/0/threaded; http://www.securityfocus.com/bid/17032; https://exchange.xforce.ibmcloud.com/vulnerabilities/25270
CVE: CVE-2006-1211
Published: 2006-03-14
Description: IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 configures a MySQL database to allow connections from any source IP address with the ns database account, which allows remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions.  NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/427155/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25270; http://www.securityfocus.com/archive/1/427155/100/0/threaded
CVE: CVE-2006-1212
Published: 2006-03-14
Description: Unspecified vulnerability in index.php in Core CoreNews 2.0.1 allows remote attackers to execute arbitrary commands via the page parameter, possibly due to a PHP remote file include vulnerability.  NOTE: this vulnerability could not be confirmed by source code inspection of CoreNews 2.0.1, which does not appear to use a "page" parameter or variable.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-March/000602.html; http://securityreason.com/securityalert/754; http://web.archive.org/web/[PII_REDACTED]2004/www.coreslawn.de/?show=downloads&cat_id=1
CVE: CVE-2006-1213
Published: 2006-03-14
Description: JiRo's Banner System Experience and Professional 1.0 and earlier allows remote attackers to bypass access restrictions and gain privileges via a direct request to certain scripts in the files directory, as demonstrated by using addadmin.asp to create a new administrator account.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0211.html; http://secunia.com/advisories/19184; http://www.nukedx.com/?viewdoc=19
CVE: CVE-2006-1214
Published: 2006-03-14
Description: UnrealIRCd 3.2.3 allows remote attackers to cause an unspecified denial of service by causing a linked server to send malformed TKL Q:Line commands, as demonstrated by "TKL - q\x08Q *\x08PoC."
CVSS Score: 5.0 (MEDIUM)
References: http://forums.unrealircd.com/viewtopic.php?t=2985; http://secunia.com/advisories/19188; http://www.osvdb.org/23778
CVE: CVE-2006-0457
Published: 2006-03-14
Description: Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/19220; http://secunia.com/advisories/20398; http://secunia.com/advisories/21465
CVE: CVE-2006-1215
Published: 2006-03-14
Description: Cross-site scripting (XSS) vulnerability in misc.php in Woltlab Burning Board (wBB) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter.  NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/426766; http://www.securityfocus.com/archive/1/426816/30/0/threaded; http://www.securityfocus.com/bid/16959
CVE: CVE-2006-1216
Published: 2006-03-14
Description: Cross-site scripting (XSS) vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18997; http://securityreason.com/securityalert/474; http://www.kapda.ir/advisory-280.html
CVE: CVE-2006-1217
Published: 2006-03-14
Description: SQL injection vulnerability in DSPoll 1.1 allows remote attackers to execute arbitrary SQL commands via the pollid parameter to (1) results.php, (2) topolls.php, (3) pollit.php.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/96/summary.html; http://secunia.com/advisories/19209; http://securityreason.com/securityalert/620