deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5897
Published: 2006-11-15
Description: Multiple directory traversal vulnerabilities in PhpMyChat Plus 1.9 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the ChatPath parameter to (1) avatar.php, (2) colorhelp_popup.php, (3) color_popup.php, (4) index.php, (5) index1.php, (6) lib/connected_users.lib.php, (7) lib/index.lib.php, and (8) phpMyChat.php3; and the (9) L parameter to logs.php.  NOTE: CVE analysis suggests that vector 1 might be incorrect.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/22782; http://securityreason.com/securityalert/1854; http://www.securityfocus.com/archive/1/450919/100/0/threaded
CVE: CVE-2006-5898
Published: 2006-11-15
Description: Directory traversal vulnerability in localization/languages.lib.php3 in PhpMyChat 0.14.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the ChatPath parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1852; http://www.securityfocus.com/archive/1/450923/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30121
CVE: CVE-2006-5899
Published: 2006-11-15
Description: PHP remote file inclusion vulnerability in install.php3 in @cid stats 2.3 allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter.  NOTE: this issue has been disputed by a third party, who states that install.php3 is supposed to be deleted after installation and, if not deleted, intentionally allows setting repertoire without an inclusion attack
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/450676/100/0/threaded; http://www.securityfocus.com/archive/1/450685/100/0/threaded; http://www.securityfocus.com/archive/1/450676/100/0/threaded
CVE: CVE-2006-5900
Published: 2006-11-15
Description: Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1863; http://www.armorize.com/resources/vulnerDetail.php?cve_name=Armorize-ADV-2006-0009; http://www.securityfocus.com/archive/1/450707/100/0/threaded
CVE: CVE-2006-5901
Published: 2006-11-15
Description: Hawking Technology wireless router WR254-CA uses a hardcoded IP address among the set of DNS server IP addresses, which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at the hardcoded address.  NOTE: it could be argued that this issue reflects an inherent limitation of DNS itself, so perhaps it should not be included in CVE.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1860; http://www.securityfocus.com/archive/1/450138/100/100/threaded; http://securityreason.com/securityalert/1860
CVE: CVE-2006-5902
Published: 2006-11-15
Description: viksoe GMail Drive shell extension allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by (1) a GMAILFS: [13;a;1] message with a new filename and a file attachment, which injects a new file into the filesystem; (2) a GMAILFS: [13;a;1] message with an existing filename and a file attachment, which overwrites existing file content; and (3) a GMAILFS: [14;a;1] message, which creates a folder.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/450683/100/0/threaded; http://www.securityfocus.com/archive/1/450683/100/0/threaded
CVE: CVE-2006-5903
Published: 2006-11-15
Description: Rahul Jonna Gmail File Space (GSpace) allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by (1) a GSPACE "2174|1|1|1|gs:/ d$" message, which injects a new file into the filesystem; and (2) a GSPACE "|-135|1|1|0|gs:/ d$" message, which creates a folder.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/450683/100/0/threaded; http://www.securityfocus.com/archive/1/450683/100/0/threaded
CVE: CVE-2006-5904
Published: 2006-11-15
Description: Multiple PHP remote file inclusion vulnerabilities in MWChat Pro 7.0 allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[MWCHAT_Libs] parameter to (1) about.php, (2) buddy.php, (3) chat.php, (4) dialog.php, (5) head.php, (6) help.php, (7) index.php, and (8) license.php, different vectors than CVE-2005-1869.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1849; http://www.securityfocus.com/archive/1/450693/100/0/threaded; http://securityreason.com/securityalert/1849
CVE: CVE-2006-5905
Published: 2006-11-15
Description: Web Directory Pro allows remote attackers to (1) backup the database and obtain the backup via a direct request to admin/backup_db.php or (2) modify configuration via a direct request to admin/options.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/35327; http://securityreason.com/securityalert/1859; http://www.securityfocus.com/archive/1/450556/100/0/threaded
CVE: CVE-2006-5906
Published: 2006-11-15
Description: PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.  NOTE: the issue is disputed by other researchers, who observe that $chemin is defined before use
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/449910/100/200/threaded; http://www.securityfocus.com/archive/1/449927/100/200/threaded; http://www.securityfocus.com/archive/1/449955/100/200/threaded
CVE: CVE-2006-5907
Published: 2006-11-15
Description: SQL injection vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-November/001124.html; http://www.securityfocus.com/archive/1/449955/100/200/threaded; http://www.securityfocus.com/bid/20779
CVE: CVE-2006-5908
Published: 2006-11-15
Description: Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html; http://securityreason.com/securityalert/1866; http://www.securityfocus.com/bid/20963
CVE: CVE-2006-5909
Published: 2006-11-15
Description: generaloptions.php in Paul Tarjan Stanford Conference And Research Forum (SCARF) before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/24311; http://sourceforge.net/project/shownotes.php?group_id=177652&release_id=489633; http://www.securityfocus.com/archive/1/450679/100/0/threaded
CVE: CVE-2006-5910
Published: 2006-11-15
Description: Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 20061110 allow remote attackers to execute arbitrary PHP code via a URL in the g_documentRoot parameter to (1) bugreporter/thankyou.php and (2) feedback/thankyou.php in implementation/management/priv/.
CVSS Score: 7.5 (HIGH)
References: http://code.campware.org/projects/campsite/changeset/6118; http://code.campware.org/projects/campsite/changeset/6119; http://code.campware.org/projects/campsite/ticket/2363
CVE: CVE-2006-5911
Published: 2006-11-15
Description: Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 2.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the g_documentRoot parameter to (1) Alias.php, (2) Article.php, (3) ArticleAttachment.php, (4) ArticleComment.php, (5) ArticleData.php, (6) ArticleImage.php, (7) ArticleIndex.php, (8) ArticlePublish.php, (9) ArticleTopic.php, (10) ArticleType.php, (11) ArticleTypeField.php, (12) Attachment.php, (13) Country.php, (14) DatabaseObject.php, (15) Event.php, (16) IPAccess.php, (17) Image.php, (18) Issue.php, (19) IssuePublish.php, (20) Language.php, (21) Log.php, (22) LoginAttempts.php, (23) Publication.php, (24) Section.php, (25) ShortURL.php, (26) Subscription.php, (27) SubscriptionDefaultTime.php, (28) SubscriptionSection.php, (29) SystemPref.php, (30) Template.php, (31) TimeUnit.php, (32) Topic.php, (33) UrlType.php, (34) User.php, and (35) UserType.php in implementation/management/classes/; (36) configuration.php and (37) db_connect.php in implementation/management/; and (38) LocalizerConfig.php and (39) LocalizerLanguage.php in implementation/management/priv/localizer/.
CVSS Score: 7.5 (HIGH)
References: http://code.campware.org/projects/campsite/changeset/6057; http://code.campware.org/projects/campsite/changeset/6058; http://code.campware.org/projects/campsite/query?milestone=2.6.2
CVE: CVE-2006-5912
Published: 2006-11-15
Description: Unspecified vulnerability in Campware Campsite before 2.6.2 has unknown impact and attack vectors, related to a "Security fix for you-know-what," possibly related to encrypted passwords.
CVSS Score: 10.0 (HIGH)
References: http://code.campware.org/projects/campsite/changeset/6041; http://code.campware.org/projects/campsite/changeset/6042; http://code.campware.org/projects/campsite/query?milestone=2.6.2
CVE: CVE-2006-5913
Published: 2006-11-15
Description: Microsoft Internet Explorer 7 allows remote attackers to (1) cause a security certificate from a secure web site to appear invalid via a link to res://ieframe.dll/sslnavcancel.htm with the target site in the anchor identifier, which displays the site's URL in the address bar but causes Internet Explorer to report that the certificate is invalid, or (2) trigger a "The webpage no longer exists" report via a link to res://ieframe.dll/http_410.htm, a variant of CVE-2006-5805.
CVSS Score: 6.4 (MEDIUM)
References: http://www.blogger.com/comment.g?blogID=15069726&postID=[PII_REDACTED]7394541; http://www.securityfocus.com/archive/1/450825/100/0/threaded; http://www.blogger.com/comment.g?blogID=15069726&postID=[PII_REDACTED]7394541
CVE: CVE-2006-5914
Published: 2006-11-15
Description: SQL injection vulnerability in ls.php in SAMEDIA LandShop allows remote attackers to execute arbitrary SQL commands via the infield parameter.  NOTE: the start, search_order, search_type, and search_area parameters are already covered by CVE-2005-4018.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22784; http://securityreason.com/securityalert/1864; http://www.securityfocus.com/archive/1/451059/100/0/threaded
CVE: CVE-2006-5915
Published: 2006-11-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in ls.php in SAMEDIA LandShop allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) CAT_ID, (3) keyword, (4) search_area, (5) search_type, (6) infield, or (7) search_order parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22784; http://securityreason.com/securityalert/1864; http://www.securityfocus.com/archive/1/451059/100/0/threaded
CVE: CVE-2006-5916
Published: 2006-11-15
Description: Intego VirusBarrier X4 allows context-dependent attackers to bypass virus protection by quickly injecting many infected files into the filesystem, which prevents VirusBarrier from processing all the files.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0141.html; http://securitytracker.com/id?1017202; http://www.digitalmunition.com/DMA%5B2006-1031a%5D.txt
CVE: CVE-2006-5917
Published: 2006-11-15
Description: Multiple SQL injection vulnerabilities in OmniStar Article Manager allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in (a) articles/comments.php and (b) articles/article.php, and the (2) page_id parameter in (c) articles/pages.php.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=10; http://secunia.com/advisories/22794; http://securityreason.com/securityalert/1865
CVE: CVE-2006-5918
Published: 2006-11-15
Description: Unrestricted file upload vulnerability in RapidKill (aka PHP Rapid Kill) 5.7 Pro, and certain other versions, allows remote attackers to upload and execute arbitrary PHP scripts via the "Link to Download" field.  NOTE: it is possible that the field value is restricted to files on specific public web sites.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1862; http://www.securityfocus.com/archive/1/450681/100/0/threaded; http://www.securityfocus.com/bid/20896
CVE: CVE-2006-5919
Published: 2006-11-15
Description: PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the visEdit_root parameter, a different vector than CVE-2003-1131.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1861; http://www.securityfocus.com/archive/1/450944/100/0/threaded; http://www.securityfocus.com/bid/20020
CVE: CVE-2006-5920
Published: 2006-11-15
Description: PHP remote file inclusion vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter.  NOTE: SecurityFocus disputes this issue, saying "further analysis reveals that the application is not vulnerable." NOTE: this issue may overlap CVE-2006-5113
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1858; http://www.securityfocus.com/archive/1/450024/100/200/threaded; http://www.securityfocus.com/bid/20205
CVE: CVE-2006-5921
Published: 2006-11-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in add_comment.php in Wheatblog (wB) allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) WWW, and (3) Comment fields. NOTE: this issue may overlap CVE-2006-5195.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/22783; http://securityreason.com/securityalert/1867; http://www.securityfocus.com/archive/1/451062/100/0/threaded
CVE: CVE-2006-5922
Published: 2006-11-15
Description: index.php in Wheatblog (wB) allows remote attackers to obtain sensitive information via certain values of the postPtr[] and next parameters, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1867; http://www.securityfocus.com/archive/1/451062/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30162
CVE: CVE-2006-5923
Published: 2006-11-15
Description: PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the custom parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/452114/100/200/threaded; http://www.securityfocus.com/bid/20979; https://www.exploit-db.com/exploits/2745
CVE: CVE-2006-5924
Published: 2006-11-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Efficient IP iPmanager (IPm) 2.3 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/bid/20952; http://www.securityfocus.com/bid/20952
CVE: CVE-2006-5925
Published: 2006-11-15
Description: Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in an smb:// URI, as demonstrated by using PUT and GET statements.
CVSS Score: 7.5 (HIGH)
References: http://bugzilla.elinks.cz/show_bug.cgi?id=841; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2780&w=2; http://secunia.com/advisories/22905
CVE: CVE-2006-5926
Published: 2006-11-16
Description: Multiple SQL injection vulnerabilities in mail.php in Vallheru before 1.0.7 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) to parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22812; http://sourceforge.net/project/shownotes.php?release_id=463228; http://vallheru.svn.sourceforge.net/viewvc/vallheru/vallheru/mail.php?r1=782&r2=781&pathrev=782
CVE: CVE-2006-5927
Published: 2006-11-16
Description: SQL injection vulnerability in cpLogin.asp in ASP Scripter Easy Portal 1.4 and Live Support 1.3 allows remote attackers to execute arbitrary SQL commands via the Password parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22856; http://securityreason.com/securityalert/1874; http://www.securityfocus.com/archive/1/451370/100/0/threaded
CVE: CVE-2006-5928
Published: 2006-11-16
Description: Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter to (1) add-modify.php, (2) delete.php, (3) modify.php, and (4) phpjobscheduler.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22855; http://securityreason.com/securityalert/1869; http://securitytracker.com/id?1017264
CVE: CVE-2006-5929
Published: 2006-11-16
Description: PHP remote file inclusion vulnerability in firepjs.php in Phpjobscheduler 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22855; http://secunia.com/advisories/22855
CVE: CVE-2006-5930
Published: 2006-11-16
Description: Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) _basicfunctions.php, or (2) pageactionauthor.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22862; http://securityreason.com/securityalert/1868; http://www.osvdb.org/30377
CVE: CVE-2006-5931
Published: 2006-11-16
Description: Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to certain PHP scripts in (1) lib/actions/, (2) lib/displays/, (3) lib/editforms/, (4) lib/functions/, (5) scheme/, and (6) the root directory.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22862; http://secunia.com/advisories/22862
CVE: CVE-2006-5932
Published: 2006-11-16
Description: Kahua before 0.7, when running multiple applications under a single supervisor, grants application access on the basis of username instead of username and database name, which allows remote authenticated users to obtain unauthorized access if different databases assign the same username to different user accounts.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22785; http://www.kahua.org/cgi-bin/kahua.fcgi/kahua-web/show/KSA/KSA2006-001; http://www.securityfocus.com/bid/21074
CVE: CVE-2006-5933
Published: 2006-11-16
Description: SQL injection vulnerability in update.asp in UltraSite 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1873; http://www.securityfocus.com/archive/1/451367/100/0/threaded; http://securityreason.com/securityalert/1873
CVE: CVE-2006-5934
Published: 2006-11-16
Description: SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the UserName field.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22835; http://securityreason.com/securityalert/1872; http://www.securityfocus.com/archive/1/451299/100/0/threaded
CVE: CVE-2006-5935
Published: 2006-11-16
Description: SQL injection vulnerability in index.php in ShopSystems 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the sessid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22867; http://securityreason.com/securityalert/1871; http://www.majorsecurity.de/index_2.php?major_rls=major_rls33
CVE: CVE-2006-5936
Published: 2006-11-16
Description: SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22899; http://securityreason.com/securityalert/1870; http://www.securityfocus.com/archive/1/451506/100/0/threaded
CVE: CVE-2006-5937
Published: 2006-11-16
Description: Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives that trigger a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0074&w=2; http://secunia.com/advisories/22811; http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
CVE: CVE-2006-5938
Published: 2006-11-16
Description: Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors involving an uninitialized variable and a crafted CAB file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0074&w=2; http://secunia.com/advisories/22811; http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
CVE: CVE-2006-5939
Published: 2006-11-16
Description: Grisoft AVG Anti-Virus before 7.1.407 allows remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers a divide-by-zero error.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-369
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0074&w=2; http://secunia.com/advisories/22811; http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
CVE: CVE-2006-5940
Published: 2006-11-16
Description: Unspecified vulnerability in Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors related to "Integer Issues" and parsing of .EXE files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0074&w=2; http://secunia.com/advisories/22811; http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
CVE: CVE-2006-5942
Published: 2006-11-17
Description: Cross-site scripting (XSS) vulnerability in inventory/display/display_results.asp in Website Designs For Less Inventory Manager allows remote attackers to inject arbitrary web script or HTML via the category parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22915; http://securityreason.com/securityalert/1875; http://www.securityfocus.com/archive/1/451553/100/0/threaded
CVE: CVE-2006-5943
Published: 2006-11-17
Description: Multiple SQL injection vulnerabilities in inventory/display/imager.asp in Website Designs for Less Inventory Manager allow remote attackers to execute arbitrary SQL commands via the (1) pictable, (2) picfield, or (3) where parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22915; http://securityreason.com/securityalert/1875; http://www.securityfocus.com/archive/1/451553/100/0/threaded