deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1043
Published: 2006-03-07
Description: Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln).
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/19081; http://securitytracker.com/id?1015721; http://www.frsirt.com/exploits/20060305.ms-visual-dbp.c.php
CVE: CVE-2006-1044
Published: 2006-03-07
Description: Multiple buffer overflows in LISTSERV 14.3 and 14.4, including LISTSERV Lite and HPO, with the web archive interface enabled, allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.  NOTE: technical details will be released after the grace period has ended on 20060603.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19106; http://securitytracker.com/id?1015722; http://www.kb.cert.org/vuls/id/841132
CVE: CVE-2006-1045
Published: 2006-03-07
Description: The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19821; http://secunia.com/advisories/19823; http://secunia.com/advisories/19863
CVE: CVE-2006-1046
Published: 2006-03-07
Description: server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/monopdx-adv.txt; http://secunia.com/advisories/19133; http://www.robertjohnkaper.com/downloads/atlantik/monopd-0.9.3-dosfix.diff
CVE: CVE-2006-1047
Published: 2006-03-07
Description: Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.joomla.org/content/view/938/78/; http://www.joomla.org/content/view/938/78/
CVE: CVE-2006-1048
Published: 2006-03-07
Description: Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) Contact items, or (9) Contact Search, (10) Content Search, (11) Newsfeed Search, or (12) Weblink Search.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19105; http://www.joomla.org/content/view/938/78/; http://www.osvdb.org/23822
CVE: CVE-2006-1049
Published: 2006-03-07
Description: Multiple SQL injection vulnerabilities in the Admin functionality in Joomla! 1.0.7 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/19105; http://www.joomla.org/content/view/938/78/; http://www.osvdb.org/23819
CVE: CVE-2006-1050
Published: 2006-03-07
Description: Kwik-Pay Payroll 4.2.20, and possibly other versions, stores the KwikPay.mdb database file with insecure permissions, which allows local users to obtain sensitive information such as employment and payment data.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the vendor has disputed this vulnerability, stating that "The kwikpay.mdb file supplied with kwikpay is a template for the database structure of user databases created by kwikpay and to store a demonstration payroll. It does not contain any sensitive user information.  When a user payroll database is opened, the encryption of the database is checked and if the database is not encrypted, the user is prompted to encrypt the database, but the choice is the customers.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19075; http://www.osvdb.org/23617; https://exchange.xforce.ibmcloud.com/vulnerabilities/25114
CVE: CVE-2006-1051
Published: 2006-03-07
Description: SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19112; http://sourceforge.net/project/shownotes.php?release_id=398713&group_id=155783; http://www.securityfocus.com/bid/16989
CVE: CVE-2006-1062
Published: 2006-03-07
Description: Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19136; http://secunia.com/advisories/19145; http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=8168
CVE: CVE-2006-1063
Published: 2006-03-07
Description: Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19136; http://secunia.com/advisories/19145; http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=8168
CVE: CVE-2006-1064
Published: 2006-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Lurker 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19136; http://secunia.com/advisories/19145; http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=8168
CVE: CVE-2006-1065
Published: 2006-03-07
Description: SQL injection vulnerability in search.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19061; http://www.securityfocus.com/archive/1/426631/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25018
CVE: CVE-2006-1067
Published: 2006-03-07
Description: Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.
CVSS Score: 5.0 (MEDIUM)
References: http://www.hm2k.org/news/[PII_REDACTED].html; http://www.securityfocus.com/archive/1/426756/100/0/threaded; http://www.securityfocus.com/archive/1/426761/100/0/threaded
CVE: CVE-2006-1068
Published: 2006-03-07
Description: Netgear 614 and 624 routers, possibly running VXWorks, allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.
CVSS Score: 4.9 (MEDIUM)
References: http://www.hm2k.org/news/[PII_REDACTED].html; http://www.securityfocus.com/archive/1/426756/100/0/threaded; http://www.securityfocus.com/archive/1/426761/100/0/threaded
CVE: CVE-2006-1069
Published: 2006-03-07
Description: Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.geeklog.net/article.php/geeklog-1.4.0sr2; http://www.securityfocus.com/bid/17010; http://www.vupen.com/english/advisories/2006/0851
CVE: CVE-2006-1070
Published: 2006-03-08
Description: Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://biyosecurity.be/bugs/dvguestbook.txt; http://secunia.com/advisories/19098; http://www.securityfocus.com/archive/1/427214/100/0/threaded
CVE: CVE-2006-1071
Published: 2006-03-08
Description: Cross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://biyosecurity.be/bugs/dvguestbook.txt; http://secunia.com/advisories/19099; http://www.securityfocus.com/archive/1/427214/100/0/threaded
CVE: CVE-2006-1072
Published: 2006-03-08
Description: Cross-site scripting (XSS) vulnerability in Daverave Simplog 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog post.
CVSS Score: 4.3 (MEDIUM)
References: http://notlegal.ws/simplogsploit.txt; http://www.securityfocus.com/archive/1/426769/100/0/threaded; http://www.securityfocus.com/bid/16965
CVE: CVE-2006-1073
Published: 2006-03-08
Description: Directory traversal vulnerability in index.php in Daverave Simplog 1.0.2 and earlier allows remote attackers to include or read arbitrary .txt files via the (1) act and (2) blogid parameters.
CVSS Score: 6.4 (MEDIUM)
References: http://notlegal.ws/simplogsploit.txt; http://secunia.com/advisories/19115; http://securityreason.com/securityalert/542
CVE: CVE-2006-0746
Published: 2006-03-09
Description: Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-dependent attackers to exploit vulnerabilities that were present in CVE-2005-3627.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19189; http://secunia.com/advisories/19190; http://secunia.com/advisories/19264
CVE: CVE-2006-1074
Published: 2006-03-09
Description: Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/lieroxxx-adv.txt; http://secunia.com/advisories/19079; http://www.securityfocus.com/archive/1/426864/100/0/threaded
CVE: CVE-2006-1075
Published: 2006-03-09
Description: Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/lieroxxx-adv.txt; http://secunia.com/advisories/19079; http://securityreason.com/securityalert/549
CVE: CVE-2006-1076
Published: 2006-03-09
Description: SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/426875/100/0/threaded; http://www.securityfocus.com/archive/1/430357/100/0/threaded; http://www.securityfocus.com/bid/16971
CVE: CVE-2006-1077
Published: 2006-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/544; http://www.osvdb.org/23826; http://www.securityfocus.com/archive/1/426826/100/0/threaded
CVE: CVE-2006-1078
Published: 2006-03-09
Description: Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file.  NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE.  However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
CVSS Score: 8.4 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0547.html; http://issues.apache.org/bugzilla/show_bug.cgi?id=31975; http://issues.apache.org/bugzilla/show_bug.cgi?id=41279
CVE: CVE-2006-1079
Published: 2006-03-09
Description: htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function.  NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE.  However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=thttpd&m=[PII_REDACTED]1867&w=2; http://marc.info/?l=thttpd&m=[PII_REDACTED]0296&w=2; http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html
CVE: CVE-2006-1080
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter, possibly requiring a URL encoded value.
CVSS Score: 4.3 (MEDIUM)
References: http://notlegal.ws/gamepanel.txt; http://secunia.com/advisories/19143; http://www.securityfocus.com/archive/1/426825/100/0/threaded
CVE: CVE-2006-1081
Published: 2006-03-09
Description: SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVSS Score: 7.5 (HIGH)
References: http://hamid.ir/security/nexus.txt; http://secunia.com/advisories/19089; http://securityreason.com/securityalert/536
CVE: CVE-2006-1082
Published: 2006-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the gamename parameter in tellafriend.php, (2) the login_status parameter in loginbox.php, (3) the submissionstatus parameter in index.php, the (4) cell_title_background_color and (5) browse_cat_name parameters in browse.php, the (6) gamefile parameter in displaygame.php, and (7) possibly other parameters in unspecified PHP scripts.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19124; http://securityreason.com/securityalert/533; http://www.securityfocus.com/archive/1/426755/100/0/threaded
CVE: CVE-2006-1083
Published: 2006-03-09
Description: Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a) admin.php and (b) other unspecified scripts.  NOTE: the admin.php/option[language] vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/php_stats_0191_adv.html; http://secunia.com/advisories/19116; http://www.phpstats.net/forum/viewtopic.php?t=140
CVE: CVE-2006-1084
Published: 2006-03-09
Description: Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the option[prefix] parameter in admin.php and other unspecified PHP scripts, and (2) the PC_REMOTE_ADDR HTTP header to click.php.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/php_stats_0191_adv.html; http://secunia.com/advisories/19116; http://www.phpstats.net/forum/viewtopic.php?t=140
CVE: CVE-2006-1085
Published: 2006-03-09
Description: admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.
CVSS Score: 10.0 (HIGH)
References: http://retrogod.altervista.org/php_stats_0191_adv.html; http://secunia.com/advisories/19116; http://www.phpstats.net/forum/viewtopic.php?t=140
CVE: CVE-2006-1086
Published: 2006-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-1083.  Reason: This candidate is a duplicate of CVE-2006-1083.  Notes: All CVE users should reference CVE-2006-1083 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-1087
Published: 2006-03-09
Description: Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_new[compatibility_mode] parameter, which is not filtered before being stored in config.php.  NOTE: this vulnerability can be exploited by remote unauthenticated attackers in conjunction with the option[admin_pass] authentication bypass vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: http://retrogod.altervista.org/php_stats_0191_adv.html; http://secunia.com/advisories/19116; http://www.phpstats.net/forum/viewtopic.php?t=140
CVE: CVE-2006-1088
Published: 2006-03-09
Description: PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database table_prefix.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/php_stats_0191_adv.html; http://secunia.com/advisories/19116; http://www.phpstats.net/forum/viewtopic.php?t=140
CVE: CVE-2006-0742
Published: 2006-03-09
Description: The die_if_kernel function in arch/ia64/kernel/unaligned.c in Linux kernel 2.6.x before 2.6.15.6, possibly when compiled with certain versions of gcc, has the "noreturn" attribute set, which allows local users to cause a denial of service by causing user faults on Itanium systems.
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060402-01-U; http://secunia.com/advisories/19078; http://secunia.com/advisories/19220
CVE: CVE-2006-1089
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly handled when the PHP_SELF variable is used to handle a pun_page tag.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19039; http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txt; http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch
CVE: CVE-2006-1090
Published: 2006-03-09
Description: register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations.
CVSS Score: 7.8 (HIGH)
References: http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txt; http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch; http://www.vupen.com/english/advisories/2006/0773
CVE: CVE-2006-1091
Published: 2006-03-09
Description: Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vectors.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/535; http://www.securityfocus.com/archive/1/426699; http://www.securityfocus.com/bid/16942
CVE: CVE-2006-1092
Published: 2006-03-09
Description: Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19128; http://secunia.com/advisories/19716; http://securitytracker.com/id?1015723
CVE: CVE-2006-1093
Published: 2006-03-09
Description: Unspecified vulnerability in IBM WebSphere 5.0.2.10 through 5.0.2.15 and 5.1.1.4 through 5.1.1.9 allows remote attackers to obtain sensitive information via unknown attack vectors, which causes JSP source code to be revealed.
CVSS Score: 6.4 (MEDIUM)
References: http://securitytracker.com/id?1015716; http://www-1.ibm.com/support/docview.wss?uid=swg21231377; http://www.securityfocus.com/bid/16908
CVE: CVE-2006-1094
Published: 2006-03-09
Description: SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to (1) info_db.php or (2) database.php.
CVSS Score: 7.5 (HIGH)
References: http://www.nukedx.com/?viewdoc=17; http://www.osvdb.org/23808; http://www.osvdb.org/23810
CVE: CVE-2006-1095
Published: 2006-03-09
Description: Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/19239; http://securitytracker.com/id?1015764; http://svn.apache.org/viewcvs.cgi/httpd/mod_python/branches/3.2.x/NEWS?rev=378945
CVE: CVE-2006-1096
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter.  NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html; http://secunia.com/advisories/19088; http://www.osvdb.org/23600
CVE: CVE-2006-1097
Published: 2006-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0033.html; http://www.nukedx.com/?viewdoc=17; http://www.osvdb.org/23809
CVE: CVE-2006-1098
Published: 2006-03-09
Description: Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html; http://secunia.com/advisories/19088; http://www.osvdb.org/23601
CVE: CVE-2006-1099
Published: 2006-03-09
Description: PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/16932; http://www.securityfocus.com/bid/16932