deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5567
Published: 2006-10-27
Description: Multiple heap-based buffer overflows in AOL Nullsoft WinAmp before 5.31 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) ultravox-max-msg header to the Ultravox protocol handler or (2) unspecified Lyrics3 tags.
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=432; http://secunia.com/advisories/22580
CVE: CVE-2006-5568
Published: 2006-10-27
Description: FtpXQ Server 3.0.1 allows remote attackers to cause a denial of service (CPU exhaustion) via a long MKD command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050335.html; http://secunia.com/advisories/22540; http://securityreason.com/securityalert/1789
CVE: CVE-2006-5569
Published: 2006-10-27
Description: FtpXQ Server 3.0.1 installs with two default testing accounts, which allows remote attackers to read or write arbitrary files via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://www.securityfocus.com/bid/20721; http://www.securityfocus.com/bid/20721
CVE: CVE-2006-5570
Published: 2006-10-27
Description: Directory traversal vulnerability in /scripts/cruise/cws.exe in CruiseWorks 1.09c and 1.09d allows remote attackers to read arbitrary files via a .. (dot dot) in the doc parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0165&w=2; http://secunia.com/advisories/22139; http://securityreason.com/securityalert/1790
CVE: CVE-2006-5571
Published: 2006-10-27
Description: Stack-based buffer overflow in /scripts/cruise/cws.exe in CruiseWorks 1.09c and 1.09d allows remote attackers to execute arbitrary code via a long string in the doc parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0165&w=2; http://secunia.com/advisories/22139; http://securityreason.com/securityalert/1790
CVE: CVE-2006-5467
Published: 2006-10-27
Description: The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://docs.info.apple.com/article.html?artnum=305530; http://lists.apple.com/archives/security-announce/2007/May/msg00004.html
CVE: CVE-2006-5587
Published: 2006-10-27
Description: Multiple PHP remote file inclusion vulnerabilities in MDweb 1.3 and earlier (Mdweb132-postgres) allow remote attackers to execute arbitrary PHP code via a URL in the chemin_appli parameter in (1) admin/inc/organisations/form_org.inc.php and (2) admin/inc/organisations/country_insert.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22561; http://www.securityfocus.com/bid/20687; http://www.vupen.com/english/advisories/2006/4214
CVE: CVE-2006-5588
Published: 2006-10-27
Description: Multiple PHP remote file inclusion vulnerabilities in CMS Faethon 2.0 Ultimate and earlier, when register_globals and magic_quotes_gpc are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter to (1) includes/rss-reader.php or (2) admin/config.php, different vectors than CVE-2006-3185.
CVSS Score: 7.5 (HIGH)
References: http://cmsfaethon.org/news.php#8; http://dev.cmsfaethon.org/tracker/?do=details&id=43; http://www.securityfocus.com/bid/20705
CVE: CVE-2006-5589
Published: 2006-10-27
Description: Multiple SQL injection vulnerabilities in LedgerSMB (LSMB) 1.1.0 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors in (1) OE.pm, (2) AM.pm, and (3) Form.pm.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22483; http://sourceforge.net/project/shownotes.php?release_id=456803; http://www.securityfocus.com/archive/1/464789/100/200/threaded
CVE: CVE-2006-5590
Published: 2006-10-27
Description: PHP remote file inclusion vulnerability in index.php in ArticleBeach Script 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22539; http://www.securityfocus.com/archive/1/449924/100/0/threaded; http://www.securityfocus.com/bid/20730
CVE: CVE-2006-5591
Published: 2006-10-27
Description: Multiple SQL injection vulnerabilities in Admin/check.asp in PacPoll 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22576; http://securityreason.com/securityalert/1788; http://www.kapda.ir/advisory-445.html
CVE: CVE-2006-5592
Published: 2006-10-27
Description: Admin/adpoll.asp in PacPoll 4.0 and earlier allows remote attackers to bypass authentication by setting the polllog cookie value to "xx".
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22576; http://securityreason.com/securityalert/1788; http://www.kapda.ir/advisory-445.html
CVE: CVE-2006-5593
Published: 2006-10-27
Description: Buffer overflow in Desknet's (niokeru) before 5.0J R1.0 might allow remote authenticated users to execute arbitrary code via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/22456; http://www.desknets.com/standard/download/
CVE: CVE-2006-5594
Published: 2006-10-27
Description: PHP remote file inclusion vulnerability in University of British Columbia iPeer 2.0, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: it is possible that this issue is related to CakePHP.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1787; http://www.securityfocus.com/archive/1/449460/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/29754
CVE: CVE-2006-4805
Published: 2006-10-27
Description: epan/dissectors/packet-xot.c in the XOT dissector (dissect_xot_pdu) in Wireshark (formerly Ethereal) 0.9.8 through 0.99.3 allows remote attackers to cause a denial of service (memory consumption and crash) via an encoded XOT packet that produces a zero length value when it is decoded.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://secunia.com/advisories/22590; http://secunia.com/advisories/22659
CVE: CVE-2006-5468
Published: 2006-10-27
Description: Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://secunia.com/advisories/22590; http://secunia.com/advisories/22672
CVE: CVE-2006-5740
Published: 2006-10-27
Description: Unspecified vulnerability in the LDAP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via a crafted LDAP packet.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://secunia.com/advisories/22590; http://secunia.com/advisories/22672
CVE: CVE-2006-4513
Published: 2006-10-28
Description: Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord, KWord, and possibly other products, allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.
CVSS Score: 5.1 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434; http://secunia.com/advisories/22595
CVE: CVE-2006-4574
Published: 2006-10-28
Description: Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger an assertion error related to unexpected length values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193, CWE-617, CWE-193
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://secunia.com/advisories/22590; http://secunia.com/advisories/22659
CVE: CVE-2006-5469
Published: 2006-10-28
Description: Unspecified vulnerability in the WBXML dissector in Wireshark (formerly Ethereal) 0.10.11 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://secunia.com/advisories/22590; http://secunia.com/advisories/22672
CVE: CVE-2006-5595
Published: 2006-10-28
Description: Unspecified vulnerability in the AirPcap support in Wireshark (formerly Ethereal) 0.99.3 has unspecified attack vectors related to WEP key parsing.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22590; http://www.securityfocus.com/bid/20762; http://www.wireshark.org/security/wnpa-sec-2006-03.html
CVE: CVE-2006-5596
Published: 2006-10-28
Description: Directory traversal vulnerability in the SSL server in AEP Smartgate 4.3b allows remote attackers to download arbitrary files via ..\ (dot dot backslash) sequences in an HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22550; http://www.securityfocus.com/bid/20722; http://www.vupen.com/english/advisories/2006/4224
CVE: CVE-2006-5597
Published: 2006-10-28
Description: join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified (1) frmMailBox and (2) frmUserPass parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22568; http://www.securityfocus.com/bid/20743; http://www.vupen.com/english/advisories/2006/4217
CVE: CVE-2006-5598
Published: 2006-10-28
Description: Cross-site scripting (XSS) vulnerability in index.php for GOOP Gallery 2.0, and possibly other versions before 2.0.3, allows remote attackers to inject arbitrary HTML or web script via the image parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2006/10/goop-gallery-image-param-cross-site.html; http://securitytracker.com/id?1017081; http://webgeneius.com/index.php?mod=blog&id=49
CVE: CVE-2006-5599
Published: 2006-10-28
Description: Cross-site scripting (XSS) vulnerability in Oracle Application Express (formerly HTML DB) before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWV_FLOW_ITEM_HELP package.  NOTE: it is likely that this issue overlaps one of the Oracle VulnIDs covered by CVE-2006-5351. Oracle has not publicly disputed claims by a reliable researcher that this has been fixed by the October 2006 CPU.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1792; http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2006.html; http://www.red-database-security.com/advisory/oracle_apex_css_wwv_flow_item_help.html
CVE: CVE-2006-5600
Published: 2006-10-28
Description: Axalto Protiva 1.1, possibly only non-commercial versions, stores passwords in plaintext in files with insecure permissions, which allows local users to gain privileges by reading the passwords from (1) KeyTool\keytool.config or (2) webapps\protiva\WEB-INF\classes\authserver.config.
CVSS Score: 2.1 (LOW)
References: http://securityreason.com/securityalert/1793; http://www.securityfocus.com/archive/1/449891/100/0/threaded; http://www.securityfocus.com/bid/20755
CVE: CVE-2006-5601
Published: 2006-10-28
Description: Stack-based buffer overflow in the eap_do_notify function in eap.c in xsupplicant before 1.2.6, and possibly other versions, allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://open1x.cvs.sourceforge.net/open1x/xsupplicant/src/eap.c?r1=1.135&r2=1.136; http://secunia.com/advisories/22612; http://secunia.com/advisories/22641
CVE: CVE-2006-5602
Published: 2006-10-28
Description: Multiple memory leaks in xsupplicant before 1.2.6, and possibly other versions, allow attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/22612; http://secunia.com/advisories/22641; http://sourceforge.net/project/shownotes.php?release_id=421973&group_id=60236
CVE: CVE-2006-5603
Published: 2006-10-30
Description: SQL injection vulnerability in pop_mail.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL commands via the RC parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/20712; http://www.securityfocus.com/bid/20712
CVE: CVE-2006-5604
Published: 2006-10-30
Description: Directory traversal vulnerability in phpcards.header.php in phpCards 1.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the CardLanguageFile parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1017070; https://exchange.xforce.ibmcloud.com/vulnerabilities/29615; http://securitytracker.com/id?1017070
CVE: CVE-2006-5605
Published: 2006-10-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpcards.footer.php in phpCards 1.3 allow remote attackers to inject arbitrary web script or HTML via the CardFontFace parameter and other unspecified parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://securitytracker.com/id?1017070; https://exchange.xforce.ibmcloud.com/vulnerabilities/29616; http://securitytracker.com/id?1017070
CVE: CVE-2006-5470
Published: 2006-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-5740.  Reason: This candidate is a duplicate of CVE-2006-5740 due to a typo.  Notes: All CVE users should reference CVE-2006-5740 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-5607
Published: 2006-10-30
Description: Directory traversal vulnerability in /cgi-bin/webcm in INCA IM-204 allows remote attackers to read arbitrary files via a "/./." (modified dot dot) sequences in the getpage parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22557; http://securityreason.com/securityalert/1796; http://www.securityfocus.com/archive/1/449504/100/0/threaded
CVE: CVE-2006-5608
Published: 2006-10-30
Description: SQL injection vulnerability in Extended Tracker (xtracker) 4.7 before 1.5.2.1 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "parameters from URLs."
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/91358; http://secunia.com/advisories/22566; http://www.securityfocus.com/bid/20759
CVE: CVE-2006-5609
Published: 2006-10-30
Description: Directory traversal vulnerability in dir.php in TorrentFlux 2.1 allows remote attackers to list arbitrary directories via "\.\./" sequences in the dir parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1797; http://www.securityfocus.com/archive/1/449893/100/0/threaded; http://www.securityfocus.com/bid/20771
CVE: CVE-2006-5610
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in player/includes/common.php in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 2021.4.40, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://secunia.com/advisories/22499; http://secunia.com/advisories/22499
CVE: CVE-2006-5611
Published: 2006-10-31
Description: Unspecified vulnerability in Toshiba Bluetooth Stack before 4.20.01 has unspecified impact and attack vectors, related to the 4.20.01(T) "Security fix." NOTE: due to the lack of details in the vendor advisory, it is not clear whether this issue is related to CVE-2006-5405.
CVSS Score: 10.0 (HIGH)
References: http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=bltstack-42001-notebook; https://exchange.xforce.ibmcloud.com/vulnerabilities/44391; http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=bltstack-42001-notebook
CVE: CVE-2006-5612
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the aide parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/1795; http://www.securityfocus.com/archive/1/449887/100/0/threaded; http://www.securityfocus.com/bid/20750
CVE: CVE-2006-5613
Published: 2006-10-31
Description: PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler (mp3SDS) 3.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the fullpath parameter
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22605; http://www.osvdb.org/30110; http://www.securityfocus.com/bid/20783
CVE: CVE-2006-5614
Published: 2006-10-31
Description: Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attackers to cause a denial of service (svchost.exe crash) via a malformed DNS query, which results in a null pointer dereference.
CVSS Score: 2.6 (LOW)
References: http://research.eeye.com/html/alerts/zeroday/20061028.html; http://secunia.com/advisories/22592; http://securitytracker.com/id?1017133
CVE: CVE-2006-5615
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in publish.php in Textpattern 1.19, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the txpcfg[txpath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1794; http://www.securityfocus.com/archive/1/449907/100/0/threaded; http://www.securityfocus.com/bid/20769
CVE: CVE-2006-5616
Published: 2006-10-31
Description: Multiple unspecified vulnerabilities in OpenPBS, as used in SUSE Linux 9.2 through 10.1, allow attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.suse.com/archive/suse-security-announce/2006-Oct/0007.html; http://secunia.com/advisories/22637; http://secunia.com/advisories/24716
CVE: CVE-2006-5617
Published: 2006-10-31
Description: Directory traversal vulnerability in index.php in Thepeak File Upload Manager 1.3 allows remote attackers to read or download arbitrary files via a base64-encoded file path containing a .. (dot dot) sequence in the file parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1798; http://www.securityfocus.com/archive/1/449936/100/0/threaded; http://www.securityfocus.com/bid/20760
CVE: CVE-2006-5618
Published: 2006-10-31
Description: Directory traversal vulnerability in script/cat_for_aff.php in Netref 4 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the ad_direct parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22610; http://www.securityfocus.com/bid/20789; http://www.vupen.com/english/advisories/2006/4259
CVE: CVE-2006-4248
Published: 2006-10-31
Description: thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.
CVSS Score: 7.2 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=396277; http://secunia.com/advisories/22712; http://www.debian.org/security/2006/dsa-1205
CVE: CVE-2006-5606
Published: 2006-10-31
Description: Multiple SQL injection vulnerabilities in BytesFall Explorer (bfExplorer) 0.0.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the username ($User variable) to login/doLogin.php and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://sourceforge.net/forum/forum.php?forum_id=627671; http://sourceforge.net/project/shownotes.php?release_id=458642&group_id=174110; http://www.redteam-pentesting.de/advisories/rt-sa-2006-007.php?lang=en
CVE: CVE-2006-5619
Published: 2006-10-31
Description: The seqfile handling (ip6fl_get_n function in ip6_flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial of service (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://lkml.org/lkml/2006/11/5/46; http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://secunia.com/advisories/22665
CVE: CVE-2006-5620
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in include/menu_builder.php in MiniBILL 2006-10-10 (1.2.3) and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[page_dir] parameter, a different vector than CVE-2006-4489.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22632; http://securityreason.com/securityalert/1803; http://www.securityfocus.com/archive/1/449890/100/0/threaded
CVE: CVE-2006-5621
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote attackers to execute arbitrary PHP code via a URL in the footfile parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://rave.jk-digital.com/blog/2006/12/08/ask_rave-09b-released/; http://www.securityfocus.com/bid/20758; http://www.vupen.com/english/advisories/2006/4211
CVE: CVE-2006-5622
Published: 2006-10-31
Description: SQL injection vulnerability in picmgr.php in Coppermine Photo Gallery 1.4.9 allows remote attackers to execute arbitrary SQL commands via the aid parameter.
CVSS Score: 7.5 (HIGH)
References: http://coppermine-gallery.net/forum/index.php?topic=37895.0; http://secunia.com/advisories/22625; http://www.securityfocus.com/bid/20774
CVE: CVE-2006-5623
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in ip.inc.php in Electronic Engineering Tool (EE Tool) 0.4-1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cgipath parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20780; http://www.vupen.com/english/advisories/2006/4231; https://exchange.xforce.ibmcloud.com/vulnerabilities/29884
CVE: CVE-2006-5624
Published: 2006-10-31
Description: Multiple PHP remote file inclusion vulnerabilities in Multi-Page Comment System (MPCS) 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) include.php or (2) functions.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22578; http://tpvgames.co.uk/web/mpcs/; http://www.securityfocus.com/bid/20751
CVE: CVE-2006-5625
Published: 2006-10-31
Description: PHP remote file inclusion vulnerability in wwwdev/nxheader.inc.php in N/X 2002 Professional Edition Web Content Management System (WCMS) 4.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the c[path] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22627; http://www.securityfocus.com/bid/20773; http://www.vupen.com/english/advisories/2006/4227