deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3074
Published: 2006-06-19
Description: klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey, (2) NtCreateProcess, (3) NtCreateProcessEx, (4) NtCreateSection, (5) NtCreateSymbolicLinkObject, (6) NtCreateThread, (7) NtDeleteValueKey, (8) NtLoadKey2, (9) NtOpenKey, (10) NtOpenProcess, (11) NtOpenSection, and (12) NtQueryValueKey hooked system calls, which allows local users to cause a denial of service (reboot) via an invalid parameter, as demonstrated by the ClientId parameter to NtOpenProcess.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/20629; http://secunia.com/advisories/25603; http://uninformed.org/index.cgi?v=4&a=4&p=4
CVE: CVE-2006-3075
Published: 2006-06-19
Description: Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including (1) thumstbl.php, (2) wpfiles.php, and (3) wallpapr.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20656; http://securitytracker.com/id?1016279; http://www.osvdb.org/26500
CVE: CVE-2006-3076
Published: 2006-06-19
Description: PHP remote file inclusion vulnerability in software_upload/public_includes/pub_templates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/1109; http://www.securityfocus.com/archive/1/437130/100/0/threaded; http://www.securityfocus.com/bid/18440
CVE: CVE-2006-3077
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in guestbook.cfm in aXentGuestbook 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/axentguestbook-ii-xss-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27160; http://pridels0.blogspot.com/2006/06/axentguestbook-ii-xss-vuln.html
CVE: CVE-2006-3078
Published: 2006-06-19
Description: Multiple SQL injection vulnerabilities in APBoard 2.2-r3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) PHPSESSID parameter in board.php and (2) viewcatmod parameter in main.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20682; http://securityreason.com/securityalert/1117; http://www.osvdb.org/26582
CVE: CVE-2006-3079
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in index.cfm in SSPwiz Plus 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/sspwiz-xss-vuln.html; http://secunia.com/advisories/20698; http://www.osvdb.org/26532
CVE: CVE-2006-3080
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in viewposts.cfm in aXentForum II and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/axentforum-ii-xss-vuln.html; http://securitytracker.com/id?1016320; http://www.securityfocus.com/archive/1/437403/100/0/threaded
CVE: CVE-2006-3081
Published: 2006-06-19
Description: mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=373913; http://bugs.mysql.com/bug.php?id=15828; http://docs.info.apple.com/article.html?artnum=305214
CVE: CVE-2006-3082
Published: 2006-06-19
Description: parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U; http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157; http://seclists.org/lists/fulldisclosure/2006/May/0774.html
CVE: CVE-2006-3086
Published: 2006-06-19
Description: Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel worksheet with a long link in Unicode, aka "Hyperlink COM Object Buffer Overflow Vulnerability." NOTE: this is a different issue than CVE-2006-3059.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.technet.com/msrc/archive/2006/06/20/437826.aspx; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6070&w=2; http://secunia.com/advisories/20748
CVE: CVE-2006-3087
Published: 2006-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in EZGallery 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pUserID, (2) aid, (3) aname, (4) uid, and (5) m parameter in (a) common/galleries.asp; (6) aid, (7) aname, (8) uid, (9) m, (10) gp, and (11) g parameter in (b) common/pupload.asp; and (12) msg, (13) fn and (14) gp parameter in (c) common/upload.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels0.blogspot.com/2006/06/ezgallery-v15-xss-vuln.html; http://secunia.com/advisories/20553; http://www.osvdb.org/26370
CVE: CVE-2006-3088
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in index.php in Car Classifieds allows remote attackers to inject arbitrary web script or HTML via the make_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20565; http://www.osvdb.org/26489; http://www.vupen.com/english/advisories/2006/2342
CVE: CVE-2006-3089
Published: 2006-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) prefixe_dossier parameter in (a) /inc/header.php; (2) msg parameter in (b) /remises/ajouter_remise.php, (c) /tva/ajouter_tva.php, (d) /stocks/ajouter.php, (e) /pays/ajouter_pays.php, (f) /produits/ajouter_cat.php, (g) /produits/ajouter_produit.php and (h) /produits/modifier_cat.php; (3) tire parameter in /remises/ajouter_remise.php; (4) quantite, (5) taux and (6) date parameter in /stocks/ajouter.php; and (7) pays and (8) prefixe parameter in /pays/ajouter_pays.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20642; http://securityreason.com/securityalert/1111; http://www.acid-root.new.fr/advisories/phpmyfactures.txt
CVE: CVE-2006-3090
Published: 2006-06-19
Description: Multiple SQL injection vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id_pays parameter in (a) /pays/modifier_pays.php; (2) id_produit, (3) quantite, (4) prix_ht, and (5) date parameter in (b) /stocks/ajouter.php; (6) id_cat parameter in (c) /produits/modifier_cat.php; (7) id_client parameter in (d) /clients/modifier_client.php; (8) id_remise parameter in (e) /remises/index.php; (9) id_taux parameter in (f) /tva/index.php; (10) ref_produit, and (11) id_stock parameter in (g) /stocks/index.php; (12) id_pays parameter in (h) /pays/index.php; and (13) id_cat parameter in (i) /produits/index.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20642; http://securityreason.com/securityalert/1111; http://www.acid-root.new.fr/advisories/phpmyfactures.txt
CVE: CVE-2006-3091
Published: 2006-06-19
Description: PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20642; http://securityreason.com/securityalert/1111; http://www.acid-root.new.fr/advisories/phpmyfactures.txt
CVE: CVE-2006-3092
Published: 2006-06-19
Description: PhpMyFactures 1.2 and earlier allows remote attackers to bypass authentication and modify data via direct requests with modified parameters to (1) /tva/ajouter_tva.php, (2) /remises/ajouter_remise.php, (3) /pays/ajouter_pays.php, (4) /pays/modifier_pays.php, (5) /produits/ajouter_cat.php, (6) /produits/ajouter_produit.php, (7) /clients/ajouter_client.php, (8) /clients/modifier_client.php.  NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20642; http://securityreason.com/securityalert/1111; http://www.acid-root.new.fr/advisories/phpmyfactures.txt
CVE: CVE-2006-3093
Published: 2006-06-19
Description: Multiple unspecified vulnerabilities in Adobe Acrobat Reader (acroread) before 7.0.8 have unknown impact and unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20576; http://secunia.com/advisories/20925; http://secunia.com/advisories/20960
CVE: CVE-2006-3094
Published: 2006-06-19
Description: Multiple SQL injection vulnerabilities in Calendarix Basic 0.7.20060401 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) cal_event.php and (2) cal_popup.php.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5454&w=2; http://secunia.com/advisories/20645; http://securitytracker.com/id?1016324
CVE: CVE-2006-3095
Published: 2006-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the RETURNURL parameter in (1) userlogin.cfm and (2) account.cfm.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/ipostmx-2005-vuln.html; http://secunia.com/advisories/20697; http://www.osvdb.org/26522
CVE: CVE-2006-3096
Published: 2006-06-19
Description: Multiple SQL injection vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) forum parameter in messagepost.cfm and (2) topic parameter in topics.cfm.  NOTE: this item was created based on information in a blog entry that was apparently removed after CVE analysis.  As of 20060619, CVE is attempting to determine the cause of the removal.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/ipostmx-2005-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27144; http://pridels0.blogspot.com/2006/06/ipostmx-2005-vuln.html
CVE: CVE-2006-3097
Published: 2006-06-20
Description: Unspecified vulnerability in Support Tools Manager (xstm, cstm, and stm) on HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/20711; http://secunia.com/advisories/21491; http://securityreason.com/securityalert/1119
CVE: CVE-2006-2942
Published: 2006-06-20
Description: TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form with a modified action attribute that references the Sandbox web instead of the user web, which can then be used to associate the user's login name with the WikiName of a member of the TWikiAdminGroup.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0032.html; http://secunia.com/advisories/20596; http://securitytracker.com/id?1016323
CVE: CVE-2006-3101
Published: 2006-06-21
Description: Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2) SSL, and (3) Ok parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20699; http://securityreason.com/securityalert/1116; http://securitytracker.com/id?1016317
CVE: CVE-2006-3102
Published: 2006-06-21
Description: Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
CVSS Score: 5.1 (MEDIUM)
References: http://retrogod.altervista.org/bitweaver_13_xpl.html; http://secunia.com/advisories/20695; http://securityreason.com/securityalert/1115
CVE: CVE-2006-3103
Published: 2006-06-21
Description: Cross-site scripting (XSS) vulnerability in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error parameter in users/login.php and the (2) feedback parameter in articles/index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://retrogod.altervista.org/bitweaver_13_xpl.html; http://secunia.com/advisories/20695; http://securityreason.com/securityalert/1115
CVE: CVE-2006-3104
Published: 2006-06-21
Description: users/index.php in Bitweaver 1.3 allows remote attackers to obtain sensitive information via an invalid sort_mode parameter, which reveals the installation path and database information in the resultant error message.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/bitweaver_13_xpl.html; http://secunia.com/advisories/20695; http://securityreason.com/securityalert/1115
CVE: CVE-2006-3105
Published: 2006-06-21
Description: CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/bitweaver_13_xpl.html; http://securityreason.com/securityalert/1115; http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
CVE: CVE-2006-3106
Published: 2006-06-21
Description: Cross-site scripting (XSS) vulnerability in index.php in phpMyDesktop|Arcade 1.0 allows remote attackers to inject arbitrary web script or HTML via the subsite parameter in the subsite todo.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1016201; https://exchange.xforce.ibmcloud.com/vulnerabilities/27345; http://securitytracker.com/id?1016201
CVE: CVE-2006-3107
Published: 2006-06-21
Description: Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in (1) GLOBALS[where_framework] to (a) admin/modules/news/news_class.php and (b) admin/modules/content/content_class.php, and (2) GLOBALS[where_cms] to (c) admin/modules/block_media/util.media.php.  NOTE: this issue might be resultant from a global overwrite vulnerability.  This issue is similar to CVE-2006-2576, but the vectors are different.
CVSS Score: 5.1 (MEDIUM)
References: http://securitytracker.com/id?1016259; http://www.osvdb.org/26707; http://www.osvdb.org/26708
CVE: CVE-2006-3108
Published: 2006-06-21
Description: Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a carriage return between the onmouseover attribute and its value, which bypasses the mail filter.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1016243; http://securitytracker.com/id?1016243
CVE: CVE-2006-3109
Published: 2006-06-21
Description: Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2) arbitrary parameters in ccmuser/logon.asp, aka bugid CSCsb68657.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047015.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047019.html; http://secunia.com/advisories/20735
CVE: CVE-2006-3110
Published: 2006-06-21
Description: Cross-site scripting (XSS) vulnerability in main.php in Chipmailer 1.09 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) betreff, (3) mail, and (4) text parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8386&w=2; http://securitytracker.com/id?1016315; https://exchange.xforce.ibmcloud.com/vulnerabilities/27156
CVE: CVE-2006-3111
Published: 2006-06-21
Description: Multiple SQL injection vulnerabilities in main.php in Chipmailer 1.09 allow remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by (1) anfang, (2) name, (3) mail, (4) anrede, (5) vorname, (6) nachname, (7) gebtag, (8) gebmonat, and (9) gebjahr.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8386&w=2; http://secunia.com/advisories/20643; http://securitytracker.com/id?1016315
CVE: CVE-2006-3112
Published: 2006-06-21
Description: Chipmailer 1.09 allows remote attackers to obtain sensitive information via a direct request to php.php, which displays the output of the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8386&w=2; http://securitytracker.com/id?1016315; https://exchange.xforce.ibmcloud.com/vulnerabilities/27159
CVE: CVE-2006-2911
Published: 2006-06-21
Description: SQL injection vulnerability in controlpanel/index.php in CMS Mundo before 1.0 build 008 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20362; http://secunia.com/secunia_research/2006-43/advisory/; http://securitytracker.com/id?1016311
CVE: CVE-2006-2931
Published: 2006-06-21
Description: CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20362; http://secunia.com/secunia_research/2006-43/advisory/; http://securitytracker.com/id?1016311
CVE: CVE-2006-3127
Published: 2006-06-21
Description: Memory leak in Network Security Services (NSS) 3.11, as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2, allows remote attackers to cause a denial of service (memory consumption) by performing a large number of RSA cryptographic operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/25048; http://securitytracker.com/id?1016294; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102461-1
CVE: CVE-2006-3128
Published: 2006-06-21
Description: choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory.
CVSS Score: 4.6 (MEDIUM)
References: http://biyosecurity.be/bugs/easycms.txt; http://secunia.com/advisories/20733; http://securitytracker.com/id?1016335
CVE: CVE-2006-3014
Published: 2006-06-22
Description: Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.html; http://hackingspirits.com/vuln-rnd/vuln-rnd.html; http://secunia.com/advisories/21865
CVE: CVE-2006-3129
Published: 2006-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in NC LinkList 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) view parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/nc-linklist-xss-vuln.html; http://secunia.com/advisories/20691; http://www.osvdb.org/26675
CVE: CVE-2006-3130
Published: 2006-06-22
Description: SQL injection vulnerability in index.php in Clubpage allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/clubpage-vuln.html; http://secunia.com/advisories/20706; http://www.osvdb.org/26690
CVE: CVE-2006-3131
Published: 2006-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Clubpage allow remote attackers to inject arbitrary web script or HTML via the (1) news_archive, (2) language, and (3) intranetLogin parameters in (a) index.php; the (4) sites_id parameter in (b) sites.php; and the (5) news_id parameter in (c) news_more.php.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/clubpage-vuln.html; http://secunia.com/advisories/20706; http://www.osvdb.org/26687
CVE: CVE-2006-3132
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in qtofm.php4 in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, as originally reported for index.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20681; http://securityreason.com/securityalert/1118; http://securitytracker.com/id?1016333
CVE: CVE-2006-3136
Published: 2006-06-22
Description: Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIR_LIBS parameter in (1) path/action.php, and to files in path/nucleus including (2) media.php, (3) /xmlrpc/server.php, and (4) /xmlrpc/api_metaweblog.inc.php.  NOTE: this is a similar vulnerability to CVE-2006-2583.  NOTE: this issue has been disputed by third parties, who state that the DIR_LIBS parameter is defined in an include file before being used
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://securityreason.com/securityalert/1120; http://securitytracker.com/id?1016325; http://www.osvdb.org/27502
CVE: CVE-2006-3137
Published: 2006-06-22
Description: Cross-site scripting (XSS) vulnerability in productDetail.asp in Edge eCommerce Shop allows remote attackers to inject arbitrary web script or HTML via the cart_id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/edge-ecommerce-shop-xss.html; http://www.securityfocus.com/bid/18528; http://www.vupen.com/english/advisories/2006/2425
CVE: CVE-2006-3138
Published: 2006-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PIC parameter in offers-pix.php, (2) from parameter in cp/index.php, and (3) action parameter in cp/admin_index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels0.blogspot.com/2006/06/phpmydirectory-xss-vuln.html; http://secunia.com/advisories/20718; http://www.osvdb.org/26669
CVE: CVE-2006-3139
Published: 2006-06-22
Description: Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0186.html; http://pridels0.blogspot.com/2006/06/virtual-war-multiple-sql-inj-vuln.html; http://secunia.com/advisories/20696