deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0480
Published: 2007-01-25
Description: Cisco IOS 9.x, 10.x, 11.x, and 12.x and IOS XR 2.0.x, 3.0.x, and 3.2.x allows remote attackers to cause a denial of service or execute arbitrary code via a crafted IP option in the IP header in a (1) ICMP, (2) PIMv2, (3) PGM, or (4) URD packet.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/32092; http://secunia.com/advisories/23867; http://securitytracker.com/id?1017555
CVE: CVE-2007-0481
Published: 2007-01-25
Description: Cisco IOS allows remote attackers to cause a denial of service (crash) via a crafted IPv6 Type 0 Routing header.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/32091; http://secunia.com/advisories/23867; http://securitytracker.com/id?1017550
CVE: CVE-2007-0482
Published: 2007-01-25
Description: cgi-bin/main in Sun Ray Server Software 2.0 and 3.0 before 20070123 allows local users to obtain the utadmin password by reading a web server's log file, or by conducting a different, unspecified local attack.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/31671; http://secunia.com/advisories/23900; http://securitytracker.com/id?1017547
CVE: CVE-2007-0483
Published: 2007-01-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Enthusiast 3.1 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) show_owned.php or (2) show_joined.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31608; http://secunia.com/advisories/23865; http://www.securityfocus.com/bid/22180
CVE: CVE-2007-0484
Published: 2007-01-25
Description: Multiple SQL injection vulnerabilities in Enthusiast 3.1 allow remote attackers to execute arbitrary SQL commands via the cat parameter to (1) show_owned.php, (2) show_joined.php, and possibly other files. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31609; http://osvdb.org/31610; http://secunia.com/advisories/23865
CVE: CVE-2007-0485
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP code via a URL in the WEBCHATPATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/8206; http://www.securityfocus.com/archive/1/313610/30/25700/threaded; http://www.securityfocus.com/bid/7000
CVE: CVE-2007-0486
Published: 2007-01-25
Description: Multiple PHP remote file inclusion vulnerabilities in Openads (aka phpAdsNew) 2.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) phpAds_geoPlugin parameter to libraries/lib-remotehost.inc, the (2) filename parameter to admin/report-index, or the (3) phpAds_config[my_footer] parameter to admin/lib-gui.inc.  NOTE: the vendor has disputed this issue, stating that the relevant variables are used within function definitions
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33573; http://securityreason.com/securityalert/2174; http://www.securityfocus.com/archive/1/457670/100/0/threaded
CVE: CVE-2007-0487
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in index.php in FreeForum 0.9.0 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter. NOTE: this issue has been disputed by third party researchers, stating that fpath variable is initialized before being used
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/457643/100/0/threaded; http://www.securityfocus.com/archive/1/457958/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31647
CVE: CVE-2007-0488
Published: 2007-01-25
Description: The Huawei Versatile Routing Platform 1.43 2500E-003 firmware on the Quidway R1600 Router, and possibly other models, allows remote attackers to cause a denial of service (device crash) via a long show arp command.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051856.html; http://osvdb.org/40355; http://securityreason.com/securityalert/2176
CVE: CVE-2007-0489
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in includes/functions.visohotlink.php in VisoHotlink 1.01 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31611; http://secunia.com/advisories/23878; http://www.securityfocus.com/bid/22171
CVE: CVE-2007-0490
Published: 2007-01-25
Description: index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information (the full path) via an invalid listingID parameter in a listingview action.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/457676/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31657; http://www.securityfocus.com/archive/1/457676/100/0/threaded
CVE: CVE-2007-0491
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in up.php in Sky GUNNING MySpeach 3.0.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the my_ms[root] parameter, a different vector than CVE-2006-4630.  NOTE: Some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23850; http://www.vupen.com/english/advisories/2007/0269; http://secunia.com/advisories/23850
CVE: CVE-2007-0492
Published: 2007-01-25
Description: Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) galleryID parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2007/0270; https://exchange.xforce.ibmcloud.com/vulnerabilities/31632; http://www.vupen.com/english/advisories/2007/0270
CVE: CVE-2007-0493
Published: 2007-01-25
Description: Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context."
CVSS Score: 7.8 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305530; http://fedoranews.org/cms/node/2507; http://fedoranews.org/cms/node/2537
CVE: CVE-2007-0494
Published: 2007-01-25
Description: ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://docs.info.apple.com/article.html?artnum=305530; http://fedoranews.org/cms/node/2507
CVE: CVE-2007-0495
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitrary PHP code via a URL in the racine parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/31599; http://secunia.com/advisories/23817; http://www.vupen.com/english/advisories/2007/0263
CVE: CVE-2007-0496
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website (nlws) 3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the g_strRootDir parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36797; http://www.vupen.com/english/advisories/2007/0268; https://www.exploit-db.com/exploits/3163
CVE: CVE-2007-0497
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in upload/top.php in Upload-Service 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the maindir parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://echo.or.id/adv/adv62-y3dips-2007.txt; http://osvdb.org/32938; http://secunia.com/advisories/23845
CVE: CVE-2007-0498
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the my[root] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31603; https://www.exploit-db.com/exploits/3165; http://osvdb.org/31603
CVE: CVE-2007-0499
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the env[inc_path] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/33014; http://secunia.com/advisories/23992; http://www.securityfocus.com/bid/22161
CVE: CVE-2007-0500
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31604; http://secunia.com/advisories/23851; http://www.vupen.com/english/advisories/2007/0264
CVE: CVE-2007-0501
Published: 2007-01-25
Description: PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Generators (adv-random-gen) allows remote attackers to execute arbitrary PHP code via a URL in the gen parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/36810; http://www.securityfocus.com/bid/22151; http://www.vupen.com/english/advisories/2007/0271
CVE: CVE-2007-0502
Published: 2007-01-25
Description: SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36798; http://www.securityfocus.com/bid/22149; http://www.vupen.com/english/advisories/2007/0270
CVE: CVE-2007-0503
Published: 2007-01-25
Description: Unspecified vulnerability in kcms_calibrate in Sun Solaris 8 and 9 before 20071122 allows local users to execute arbitrary commands via unknown vectors.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/31598; http://secunia.com/advisories/23885; http://securitytracker.com/id?1017541
CVE: CVE-2007-0504
Published: 2007-01-26
Description: Eval injection vulnerability in poll_frame.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the poll_id parameter, which is supplied to an eval function call, a different vulnerability type than CVE-2005-4632.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/31606; http://secunia.com/advisories/23834; http://www.vupen.com/english/advisories/2007/0300
CVE: CVE-2007-0505
Published: 2007-01-26
Description: Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.
CVSS Score: 8.5 (HIGH)
References: http://drupal.org/node/112146; http://osvdb.org/32134; http://secunia.com/advisories/23887
CVE: CVE-2007-0506
Published: 2007-01-26
Description: The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests.
CVSS Score: 6.0 (MEDIUM)
References: http://drupal.org/node/112146; http://osvdb.org/32135; http://secunia.com/advisories/23887
CVE: CVE-2007-0507
Published: 2007-01-26
Description: SQL injection vulnerability in the Acidfree module for Drupal before 4.6.x-1.0, and before 4.7.x-1.0 in the 4.7 series, allows remote authenticated users with "create acidfree albums" privileges to execute arbitrary SQL commands via node titles.
CVSS Score: 6.0 (MEDIUM)
References: http://drupal.org/node/112145; http://osvdb.org/32132; http://secunia.com/advisories/23895
CVE: CVE-2007-0508
Published: 2007-01-26
Description: PHP remote file inclusion vulnerability in lib/selectlang.php in BBClone 0.31 allows remote attackers to execute arbitrary PHP code via a URL in the BBC_LANGUAGE_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32957; http://secunia.com/advisories/23874; http://www.vupen.com/english/advisories/2007/0318
CVE: CVE-2007-0509
Published: 2007-01-26
Description: Multiple unspecified vulnerabilities in MaklerPlus before 1.2 have unknown impact and attack vectors, possibly relating to cross-site scripting (XSS) in the slogan parameter in main.tpl, or information leaks in error messages.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/32950; http://secunia.com/advisories/23864; http://sourceforge.net/project/shownotes.php?release_id=479940
CVE: CVE-2007-0510
Published: 2007-01-26
Description: Multiple buffer overflows in (1) graphs.c, (2) output.c, and (3) preserve.c in AWFFull 3.7.1 and earlier have unknown impact and attack vectors.  NOTE: some of these details are obtained from third party information.  NOTE: There may not be any attack vector that crosses privilege boundaries.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/32956; http://secunia.com/advisories/23831; http://www.stedee.id.au/awffull#changes
CVE: CVE-2007-0511
Published: 2007-01-26
Description: Multiple PHP remote file inclusion vulnerabilities in phpXMLDOM (phpXD) 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) dom.php, (2) dtd.php, or (3) parser.php in include/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32953; http://osvdb.org/32954; http://osvdb.org/32955
CVE: CVE-2007-0512
Published: 2007-01-26
Description: Hitachi TP1/LiNK 05-00 through 05-03-/F, 03-04 through 03-06-/K, and 03-00 through 03-03-/H; and TP1/Server Base 05-00 through 05-00-/M, 03-01-E through 03-01-FD, 03-01 through 03-01-DB, and 05-03; allow attackers to cause a denial of service (process crash) via invalid data to an OpenTP1 port.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32962; http://secunia.com/advisories/23866; http://www.hitachi-support.com/security_e/vuls_e/HS06-021_e/01-e.html
CVE: CVE-2007-0513
Published: 2007-01-26
Description: Hitachi HiRDB Datareplicator 7HiRDB, 7(64), 6, 6(64), 5.0, and 5.0(64); and various products that bundle HiRDB Datareplicator; allows attackers to cause a denial of service (CPU consumption) via certain data.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32996; http://secunia.com/advisories/23816; http://www.hitachi-support.com/security_e/vuls_e/HS06-023_e/01-e.html
CVE: CVE-2007-0514
Published: 2007-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in multiple Hitachi Web Server, uCosminexus, and Cosminexus products before 20070124 allow remote attackers to inject arbitrary web script or HTML via (1) HTTP Expect headers or (2) image maps.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32997; http://osvdb.org/32998; http://secunia.com/advisories/23843
CVE: CVE-2007-0515
Published: 2007-01-26
Description: Unspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code on Word 2000, and cause a denial of service on Word 2003, via unknown attack vectors that trigger memory corruption, as exploited by Trojan.Mdropper.W and later by Trojan.Mdropper.X, a different issue than CVE-2006-6456, CVE-2006-5994, and CVE-2006-6561.
CVSS Score: 9.3 (HIGH)
References: http://isc.sans.org/diary.html?storyid=2133; http://osvdb.org/31900; http://secunia.com/advisories/23950
CVE: CVE-2007-0462
Published: 2007-01-26
Description: The _GetSrcBits32ARGB function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT image with a malformed Alpha RGB (ARGB) record, which triggers memory corruption.
CVSS Score: 10.0 (HIGH)
References: http://projects.info-pull.com/moab/MOAB-23-01-2007.html; http://secunia.com/advisories/23859; http://www.osvdb.org/32696
CVE: CVE-2007-0516
Published: 2007-01-26
Description: Yana Framework before 2.8.5a allows remote authenticated users with permissions to modify a guestbook profile to modify or delete arbitrary guestbook profiles via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.9 (MEDIUM)
References: http://all-community.de/pub/pages/changes.php?language=en; http://secunia.com/advisories/23855; http://www.osvdb.org/31615
CVE: CVE-2007-0517
Published: 2007-01-26
Description: Scriptsez Random PHP Quote 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password information via a direct request for pwd.txt.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32947; http://secunia.com/advisories/23888; http://securityreason.com/securityalert/2184
CVE: CVE-2007-0518
Published: 2007-01-26
Description: Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32946; http://secunia.com/advisories/23886; http://securityreason.com/securityalert/2183
CVE: CVE-2007-0519
Published: 2007-01-26
Description: Cross-site scripting (XSS) vulnerability in memcp.php in XMB U2U Instant Messenger allows remote authenticated users to inject arbitrary web script or HTML via the recipient field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://aria-security.com/forum/showthread.php?p=129; http://securityreason.com/securityalert/2182; http://www.securityfocus.com/archive/1/457630/100/0/threaded
CVE: CVE-2007-0520
Published: 2007-01-26
Description: SQL injection vulnerability in banner.php in Unique Ads (UDS) 1.x allows remote attackers to execute arbitrary SQL commands via the bid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/2181; http://www.securityfocus.com/archive/1/457667/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31660
CVE: CVE-2007-0521
Published: 2007-01-26
Description: The Sony Ericsson K700i and W810i phones allow remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://securityreason.com/securityalert/2180; http://www.securityfocus.com/archive/1/457768/100/0/threaded; http://www.securityfocus.com/archive/1/457797/100/0/threaded
CVE: CVE-2007-0522
Published: 2007-01-26
Description: The Motorola MOTORAZR V3 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://securityreason.com/securityalert/2180; http://www.securityfocus.com/archive/1/457768/100/0/threaded; http://www.securityfocus.com/archive/1/457797/100/0/threaded
CVE: CVE-2007-0523
Published: 2007-01-26
Description: The Nokia N70 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://securityreason.com/securityalert/2180; http://www.securityfocus.com/archive/1/457768/100/0/threaded; http://www.securityfocus.com/archive/1/457797/100/0/threaded
CVE: CVE-2007-0524
Published: 2007-01-26
Description: The LG Chocolate KG800 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
CVSS Score: 2.9 (LOW)
CWE: CWE-20
References: http://securityreason.com/securityalert/2180; http://www.securityfocus.com/archive/1/457768/100/0/threaded; http://www.securityfocus.com/archive/1/457797/100/0/threaded
CVE: CVE-2007-0525
Published: 2007-01-26
Description: Multiple buffer overflows in Nickolas Grigoriadis Mini Web server (MiniWebsvr) before 0.05 have unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33512; http://sourceforge.net/project/shownotes.php?release_id=479480&group_id=187000; http://www.vupen.com/english/advisories/2007/0294
CVE: CVE-2007-0526
Published: 2007-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL (PATH_INFO) to (1) articles/edit.php, (2) articles/list.php, (3) blogs/list_blogs.php, or (4) blogs/rankings.php.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33578; http://osvdb.org/33579; http://osvdb.org/33580
CVE: CVE-2007-0527
Published: 2007-01-26
Description: SQL injection vulnerability in the is_remembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBER_KEY cookie parameter. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/32945; http://secunia.com/advisories/23828; http://securityreason.com/securityalert/2185
CVE: CVE-2007-0528
Published: 2007-01-26
Description: The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data).
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/32966; http://secunia.com/advisories/23919; http://secunia.com/advisories/23936
CVE: CVE-2007-0529
Published: 2007-01-26
Description: Cross-site scripting (XSS) vulnerability in index.html (aka the administration page) in PHP Link Directory (phpLD) 3.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted link, which is triggered when the administrator uses the "Validate Links" functionality.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32952; http://www.securityfocus.com/archive/1/457672/100/0/threaded; http://www.smilehouse.com/advisory/phplinkdirectory_070121.txt
CVE: CVE-2007-0530
Published: 2007-01-26
Description: Multiple PHP remote file inclusion vulnerabilities in Advanced Guestbook 2.4.2 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) index.php, (2) addentry.php, or (3) picture.php, a different set of vectors than CVE-2006-5804.  NOTE: this issue has been disputed by third party researchers, stating that the include_path variable is instantiated before use
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/457870/100/0/threaded; http://www.securityfocus.com/archive/1/457955/100/0/threaded; http://www.securityfocus.com/archive/1/457870/100/0/threaded
CVE: CVE-2007-0531
Published: 2007-01-26
Description: PHP remote file inclusion vulnerability in includes/login.php in FreeWebShop 2.2.3 and 2.2.4 before 20070123 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://14house.blogspot.com/2007/01/freewebshoporg-remote-file-inclusion.html; http://osvdb.org/32951; http://secunia.com/advisories/23898