deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1666
Published: 2006-04-07
Description: SQL injection vulnerability in forum.php in Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/644; http://www.securityfocus.com/archive/1/429940/100/0/threaded; http://www.securityfocus.com/bid/17375
CVE: CVE-2006-1667
Published: 2006-04-07
Description: SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to execute arbitrary SQL commands via the limitquery_s parameter when the $projectid variable is less than 1, which prevents the $limitquery_s from being set within slides.php.
CVSS Score: 7.5 (HIGH)
References: http://bash-x.net/undef/adv/craftygallery.html; http://bash-x.net/undef/exploits/crappy_syntax.txt; http://secunia.com/advisories/19478
CVE: CVE-2006-1668
Published: 2006-04-07
Description: newimage.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.
CVSS Score: 9.0 (HIGH)
References: http://bash-x.net/undef/adv/craftygallery.html; http://bash-x.net/undef/exploits/crappy_syntax.txt; http://secunia.com/advisories/19478
CVE: CVE-2006-1669
Published: 2006-04-07
Description: SQL injection vulnerability in chat/messagesL.php3 in phpHeaven Team PHPMyChat 0.14.5 and earlier allows remote attackers to execute arbitrary SQL commands via the T parameter.  NOTE: this issue can be leveraged to execute arbitrary shell commands since the username is later processed in an eval() call, but since the username originated from the SQL injection, it could be a resultant issue.
CVSS Score: 6.4 (MEDIUM)
References: http://securitytracker.com/id?1015873; http://www.securityfocus.com/archive/1/430358/100/0/threaded; http://www.securityfocus.com/bid/17382
CVE: CVE-2006-1670
Published: 2006-04-07
Description: Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (memory exhaustion and possibly card reset) by sending an invalid response when the final ACK is expected, aka bug ID CSCei45910.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19553; http://securitytracker.com/id?1015872; http://www.cisco.com/warp/public/707/cisco-sa-20060405-ons.shtml
CVE: CVE-2006-1671
Published: 2006-04-07
Description: Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (card reset) via (1) a "crafted" IP packet to a device with secure mode EMS-to-network-element access, aka bug ID CSCsc51390; (2) a "crafted" IP packet to a device with IP on the LAN interface, aka bug ID CSCsd04168; and (3) a "malformed" OSPF packet, aka bug ID CSCsc54558.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19553; http://securitytracker.com/id?1015872; http://www.cisco.com/warp/public/707/cisco-sa-20060405-ons.shtml
CVE: CVE-2006-1672
Published: 2006-04-07
Description: The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows remote attackers to execute arbitrary code on a CTC workstation, aka bug ID CSCea25049.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19553; http://securitytracker.com/id?1015871; http://www.cisco.com/warp/public/707/cisco-sa-20060405-ons.shtml
CVE: CVE-2006-1673
Published: 2006-04-07
Description: Cross-site scripting (XSS) vulnerability in vbugs.php in Dark_Wizard vBug Tracker 3.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/vbug-tracker-for-vbulletin-35x-xss.html; http://secunia.com/advisories/19562; http://www.osvdb.org/24448
CVE: CVE-2006-0951
Published: 2006-04-08
Description: The GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/19054; http://secunia.com/secunia_research/2006-17/advisory/; http://www.osvdb.org/24394
CVE: CVE-2006-0053
Published: 2006-04-10
Description: Imager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by writing a 2- or 4-channel JPEG image (or a 2-channel TGA image) to a scalar, which triggers a NULL pointer dereference.
CVSS Score: 2.6 (LOW)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359661; http://rt.cpan.org/Public/Bug/Display.html?id=18397; http://secunia.com/advisories/19575
CVE: CVE-2006-0996
Published: 2006-04-10
Description: Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c; http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261
CVE: CVE-2006-1494
Published: 2006-04-10
Description: Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U; http://rhn.redhat.com/errata/RHSA-2006-0549.html; http://secunia.com/advisories/19599
CVE: CVE-2006-1608
Published: 2006-04-10
Description: The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19599; http://secunia.com/advisories/19775; http://secunia.com/advisories/21125
CVE: CVE-2006-1674
Published: 2006-04-10
Description: Cross-site scripting (XSS) vulnerability in search.php in PHPWebGallery 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-1675.
CVSS Score: 2.6 (LOW)
References: http://www.Silitix.com/phpwebgallery; http://www.Silitix.com/phpwebgallery
CVE: CVE-2006-1675
Published: 2006-04-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) num, and (3) search parameters to (a) category.php, and the (4) slideshow, (5) show_metadata, and (6) start parameters to (b) picture.php, a different vulnerability than CVE-2006-1674.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19610; http://www.securityfocus.com/archive/1/430481/100/0/threaded; http://www.securityfocus.com/bid/17421
CVE: CVE-2006-1522
Published: 2006-04-10
Description: The sys_add_key function in the keyring code in Linux kernel 2.6.16.1 and 2.6.17-rc1, and possibly earlier versions, allows local users to cause a denial of service (OOPS) via keyctl requests that add a key to a user key instead of a keyring key, which causes an invalid dereference in the __keyring_search_one function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.3; http://lwn.net/Alerts/180820/; http://secunia.com/advisories/19573
CVE: CVE-2006-1549
Published: 2006-04-10
Description: PHP 4.4.2 and 5.1.2 allows local users to cause a crash (segmentation fault) by defining and executing a recursive function.  NOTE: it has been reported by a reliable third party that some later versions are also affected.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://securityreason.com/achievement_securityalert/35; http://securityreason.com/securityalert/2312; http://securityreason.com/securityalert/676
CVE: CVE-2006-1676
Published: 2006-04-11
Description: SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/19578; http://www.maxdev.com/Article592.phtml; http://www.securityfocus.com/archive/1/430370/100/0/threaded
CVE: CVE-2006-1677
Published: 2006-04-11
Description: MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/19578; http://www.maxdev.com/Article592.phtml; http://www.securityfocus.com/archive/1/430370/100/0/threaded
CVE: CVE-2006-1678
Published: 2006-04-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19556; http://secunia.com/advisories/19897; http://secunia.com/advisories/22781
CVE: CVE-2006-1679
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in modules/online.php in Jupiter CMS 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the layout parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19582; http://www.securityfocus.com/archive/1/430391/100/0/threaded; http://www.securityfocus.com/bid/17405
CVE: CVE-2006-1680
Published: 2006-04-11
Description: Jupiter CMS 1.1.5, when display_errors is enabled, allows remote attackers to obtain the full server path via a direct request to modules/online.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19582; http://www.securityfocus.com/archive/1/430391/100/0/threaded; http://www.vupen.com/english/advisories/2006/1302
CVE: CVE-2006-1681
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19587; http://www.osvdb.org/24469; http://www.securityfocus.com/archive/1/430385/100/0/threaded
CVE: CVE-2006-1682
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in webplus.exe in TalentSoft Web+Shop 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the deptname parameter, possibly involving the webpshop/ department.wml script.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/web-shop-50-xss.html; http://secunia.com/advisories/19594; http://www.securityfocus.com/bid/17418
CVE: CVE-2006-1683
Published: 2006-04-11
Description: SQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the User name.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19584; http://www.securityfocus.com/archive/1/430315/100/0/threaded; http://www.securityfocus.com/bid/17483
CVE: CVE-2006-1684
Published: 2006-04-11
Description: Unspecified vulnerability in ecotwo Shopsystem 1.0-192 and earlier allows remote attackers to include arbitrary local files via (1) the lang parameter in news.php and (2) other unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/ecotwo-shopsystem-vuln.html; http://pridels0.blogspot.com/2006/04/ecotwo-shopsystem-vuln.html
CVE: CVE-2006-1685
Published: 2006-04-11
Description: Multiple SQL injection vulnerabilities in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allow remote attackers to execute arbitrary SQL commands via the (1) group, (2) seite, and (3) id parameter, possibly involving the artikel functionality.  NOTE: this vulnerability also allows resultant path disclosure when the SQL queries are invalid.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.html; http://secunia.com/advisories/19592; http://www.securityfocus.com/bid/17425
CVE: CVE-2006-1686
Published: 2006-04-11
Description: Unspecified vulnerability in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to access unspecified files via a modified warp parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.html; http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.html
CVE: CVE-2006-1687
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to inject arbitrary web script or HTML via the message parameter, probably involving the basket functionality.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.html; http://secunia.com/advisories/19592; http://www.vupen.com/english/advisories/2006/1293
CVE: CVE-2006-1688
Published: 2006-04-11
Description: Multiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allow remote attackers to execute arbitrary PHP code via a URL in the libpath parameter to scripts in the lib directory including (1) ase.php, (2) devi.php, (3) doom3.php, (4) et.php, (5) flashpoint.php, (6) gameSpy.php, (7) gameSpy2.php, (8) gore.php, (9) gsvari.php, (10) halo.php, (11) hlife.php, (12) hlife2.php, (13) igi2.php, (14) main.lib.php, (15) netpanzer.php, (16) old_hlife.php, (17) pkill.php, (18) q2a.php, (19) q3a.php, (20) qworld.php, (21) rene.php, (22) rvbshld.php, (23) savage.php, (24) simracer.php, (25) sof1.php, (26) sof2.php, (27) unreal.php, (28) ut2004.php, and (29) vietcong.php. NOTE: the lib/armygame.php vector is already covered by CVE-2006-1610. The provenance of most of these additional vectors is unknown, although likely from post-disclosure analysis.  NOTE: this only occurs when register_globals is disabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://liz0zim.no-ip.org/alp.txt; http://secunia.com/advisories/19482; http://secunia.com/advisories/19588
CVE: CVE-2006-1689
Published: 2006-04-11
Description: Unspecified vulnerability in su in HP HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/19560; http://securitytracker.com/id?1015874; http://www.osvdb.org/24449
CVE: CVE-2006-1060
Published: 2006-04-11
Description: Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/19571; http://secunia.com/advisories/19572; http://secunia.com/advisories/19731
CVE: CVE-2006-1690
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the user_name parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0447.html; http://evuln.com/vulns/123/summary.html; http://secunia.com/advisories/19568
CVE: CVE-2006-1691
Published: 2006-04-11
Description: SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the user_name parameter to unsubscribe.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0447.html; http://evuln.com/vulns/123/summary.html; http://secunia.com/advisories/19568
CVE: CVE-2006-1692
Published: 2006-04-11
Description: Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the (1) user_email parameter to (a) unsubscribe.php or (b) subscribe.php; or the (2) user_name parameter to subscribe.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, although it is likely that this was discovered during post-disclosure analysis.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19568; http://www.osvdb.org/24445; http://www.osvdb.org/24905
CVE: CVE-2006-1693
Published: 2006-04-11
Description: Unspecified vulnerability in GlobalSCAPE Secure FTP Server before 3.1.4 Build 01.10.2006 allows attackers to cause a denial of service (application crash) via a "custom command" with a long argument.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19547; http://www.globalscape.com/gsftps/history.asp; http://www.osvdb.org/24451
CVE: CVE-2006-1694
Published: 2006-04-11
Description: SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19602; http://www.securityfocus.com/bid/17424; http://www.vupen.com/english/advisories/2006/1283
CVE: CVE-2006-1695
Published: 2006-04-11
Description: The fbgs script in the fbi package 2.01-1.4, when the TMPDIR environment variable is not defined, allows local users to overwrite arbitrary files via a symlink attack on temporary files in /var/tmp/fbps-[PID].
CVSS Score: 1.2 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361370; http://secunia.com/advisories/19559; http://secunia.com/advisories/19766
CVE: CVE-2006-1696
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in Gallery before 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19580; http://sourceforge.net/project/shownotes.php?release_id=408602&group_id=7130; http://www.osvdb.org/24466
CVE: CVE-2006-1697
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) Your Name, (2) E-Mail, or (3) Comments fields when posting a message.
CVSS Score: 4.3 (MEDIUM)
References: http://liz0zim.no-ip.org/mattguestbook.html; http://secunia.com/advisories/19586; http://securityreason.com/securityalert/681
CVE: CVE-2006-1698
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) url, (2) city, (3) state, or (4) country parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, although it is likely that they are the result of post-disclosure analysis.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19586; http://www.vupen.com/english/advisories/2006/1287; https://exchange.xforce.ibmcloud.com/vulnerabilities/25697
CVE: CVE-2006-1699
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in index.php in Aweb Banner Generator 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the banner parameter in view mode.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19621; http://securitytracker.com/id?1015877; http://www.securityfocus.com/bid/17416
CVE: CVE-2006-1700
Published: 2006-04-11
Description: Buy.php in Aweb Scripts Seller uses predictable cookies for authentication based on the time and the script number, which allows remote attackers to bypass authentication.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19626; http://securitytracker.com/id?1015878; http://www.securityfocus.com/bid/17417
CVE: CVE-2006-1701
Published: 2006-04-11
Description: Cross-site scripting (XSS) vulnerability in the Pages module in Shadowed Portal allows remote attackers to inject arbitrary web script or HTML via the page parameter to load.php.
CVSS Score: 2.6 (LOW)
References: http://liz0zim.no-ip.org/shad0w.txt; http://secunia.com/advisories/19595; http://securityreason.com/securityalert/685
CVE: CVE-2006-1702
Published: 2006-04-11
Description: PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/430443/100/0/threaded; http://www.securityfocus.com/bid/17423; https://exchange.xforce.ibmcloud.com/vulnerabilities/25711
CVE: CVE-2006-1703
Published: 2006-04-11
Description: PHP remote file inclusion vulnerability in lire.php in Sire 2.0 nws allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015885; http://www.securityfocus.com/archive/1/430301/100/0/threaded; http://www.securityfocus.com/bid/17428
CVE: CVE-2006-1704
Published: 2006-04-11
Description: Sire 2.0 nws allows remote attackers to upload arbitrary image files without authentication via a direct request to upload.php.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015885; http://www.securityfocus.com/archive/1/430301/100/0/threaded; http://www.securityfocus.com/bid/17431
CVE: CVE-2006-1705
Published: 2006-04-11
Description: Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044990.html; http://secunia.com/advisories/19574; http://securitytracker.com/id?1015886
CVE: CVE-2006-1706
Published: 2006-04-11
Description: Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a) login.php and (b) memo.php; and the (2) itemgr, (3) brandID, and (4) album parameters to (c) index.php.  NOTE: this issue also produces resultant full path disclosure from invalid SQL queries.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/shopweezle-20-multiple-vuln.html; http://secunia.com/advisories/19593; http://www.osvdb.org/24470
CVE: CVE-2006-1707
Published: 2006-04-11
Description: index.php in Shopweezle 2.0 allows remote attackers to include arbitrary local files via the url parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/shopweezle-20-multiple-vuln.html; http://www.osvdb.org/24474; https://exchange.xforce.ibmcloud.com/vulnerabilities/25725
CVE: CVE-2006-1708
Published: 2006-04-11
Description: SQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page to index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19609; http://securitytracker.com/id?1015935; http://www.securityfocus.com/bid/17456