deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6347
Published: 2006-12-07
Description: Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php.  NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector.
CVSS Score: 6.5 (MEDIUM)
References: http://securityreason.com/securityalert/1983; http://www.securityfocus.com/archive/1/453471/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30731
CVE: CVE-2006-6348
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in board.php in mowdBB RC-6 allows remote attackers to inject arbitrary web script or HTML via the forum_name[] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1977; http://www.securityfocus.com/archive/1/453508/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30710
CVE: CVE-2006-6349
Published: 2006-12-07
Description: Multiple SQL injection vulnerabilities in PWP Technologies The Classified Ad System allow remote attackers to execute arbitrary SQL commands via (1) the main parameter in a view action (includes/mainpage/view.asp) in default.asp or (2) a query in the search engine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/23289; http://securityreason.com/securityalert/1975; http://www.securityfocus.com/archive/1/452194/100/200/threaded
CVE: CVE-2006-6350
Published: 2006-12-07
Description: listpics 5 stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for listpics.mdb.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23210; http://www.securityfocus.com/archive/1/453416/100/0/threaded; http://www.vupen.com/english/advisories/2006/4847
CVE: CVE-2006-6351
Published: 2006-12-07
Description: KhaledMuratList stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) CL2F9R1A2C1N.mdb or (2) Data2F9R1A2C1N.mdb.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23310; http://securityreason.com/securityalert/1999; http://www.securityfocus.com/archive/1/453328/100/0/threaded
CVE: CVE-2006-6352
Published: 2006-12-07
Description: FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinite loop) via a crafted ACE file.  NOTE: this issue has at least a partial overlap with CVE-2006-6294.
CVSS Score: 5.0 (MEDIUM)
References: http://gleg.net/fprot.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051096.html; http://secunia.com/advisories/23328
CVE: CVE-2006-6353
Published: 2006-12-07
Description: Multiple unspecified vulnerabilities in BOMArchiveHelper in Mac OS X allow user-assisted remote attackers to cause a denial of service (application crash) via unspecified vectors related to (1) certain KERN_PROTECTION_FAILURE thread crashes and (2) certain KERN_INVALID_ADDRESS thread crashes, as discovered with the "iSec Partners FileP fuzzer".
CVSS Score: 5.0 (MEDIUM)
References: http://security-protocols.com/2006/12/04/bomarchivehelper-needs-some-lovin/; http://www.securityfocus.com/bid/21446; http://security-protocols.com/2006/12/04/bomarchivehelper-needs-some-lovin/
CVE: CVE-2006-6354
Published: 2006-12-07
Description: Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter.  NOTE: the iType parameter in type.asp is covered by CVE-2005-3976.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23228; http://securityreason.com/securityalert/1996; http://www.aria-security.com/forum/showthread.php?t=61
CVE: CVE-2006-6355
Published: 2006-12-07
Description: SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter.  NOTE: the iState parameter is already covered by CVE-2005-2049.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1997; http://www.aria-security.com/forum/showthread.php?t=59; http://www.securityfocus.com/archive/1/453318/100/0/threaded
CVE: CVE-2006-6356
Published: 2006-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) id, (3) subject, (4) username, or (5) time parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23214; http://securityreason.com/securityalert/1994; http://www.securityfocus.com/archive/1/453321/100/0/threaded
CVE: CVE-2006-6357
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in templates/cat_temp.php in PHPNews 1.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4826; http://www.vupen.com/english/advisories/2006/4826
CVE: CVE-2006-6235
Published: 2006-12-07
Description: A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc; http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html; http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html
CVE: CVE-2006-6358
Published: 2006-12-07
Description: SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly the (2) password parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8486&w=2; http://secunia.com/advisories/23169; http://www.securityfocus.com/bid/21422
CVE: CVE-2006-6359
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8486&w=2; http://secunia.com/advisories/23169; http://www.securityfocus.com/bid/21422
CVE: CVE-2006-6360
Published: 2006-12-07
Description: PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the footerpage parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23204; http://securitytracker.com/id?1017329; http://www.securityfocus.com/bid/21412
CVE: CVE-2006-6361
Published: 2006-12-07
Description: Heap-based buffer overflow in the uploadprogress_php_rfc1867_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted HTTP POST fileupload requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.php-security.org/archives/58-Suhosin-caught-another-remote-code-execution-vulnerability.html; http://www.securityfocus.com/bid/21417; http://www.vupen.com/english/advisories/2006/4841
CVE: CVE-2006-6362
Published: 2006-12-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-5873.  Reason: This candidate is a duplicate of CVE-2006-5873.  Notes: All CVE users should reference CVE-2006-5873 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-6363
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in admin.pl in BlueSocket Secure Controller (BSC) before 5.2, or without 5.1.1-BluePatch, allows remote attackers to inject arbitrary web script or HTML via the ad_name parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23238; http://securityreason.com/securityalert/1991; http://www.securityfocus.com/archive/1/453412/100/0/threaded
CVE: CVE-2006-6364
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in error.php in Inside Systems Mail (ISMail) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23229; http://securityreason.com/securityalert/1990; http://www.insidesystems.net/projects/project.php?projectid=4
CVE: CVE-2006-6365
Published: 2006-12-07
Description: SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter.  NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by CVE-2005-2047.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23222; http://securityreason.com/securityalert/1987; http://www.aria-security.com/forum/showthread.php?t=62
CVE: CVE-2006-6366
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23193; http://www.securityfocus.com/bid/21423; http://www.vupen.com/english/advisories/2006/4875
CVE: CVE-2006-6367
Published: 2006-12-07
Description: Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter.  NOTE: the iType parameter is already covered by CVE-2005-3976.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3388&w=2; http://secunia.com/advisories/23224; http://www.aria-security.com/forum/showthread.php?t=60
CVE: CVE-2006-6368
Published: 2006-12-07
Description: PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to search.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23293; http://www.attrition.org/pipermail/vim/2006-December/001166.html; http://www.securityfocus.com/bid/21407
CVE: CVE-2006-6369
Published: 2006-12-07
Description: SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality.
CVSS Score: 7.5 (HIGH)
References: http://forums.invisionpower.com/index.php?showtopic=230108; http://www.securityfocus.com/archive/1/453126/100/100/threaded; http://www.securityfocus.com/archive/1/453159/100/100/threaded
CVE: CVE-2006-6370
Published: 2006-12-07
Description: SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/453167/100/100/threaded; http://www.securityfocus.com/archive/1/453468/100/0/threaded; http://www.securityfocus.com/archive/1/453167/100/100/threaded
CVE: CVE-2006-6371
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in pbguestbook.php in JAB Guest Book allows remote attackers to inject arbitrary web script or HTML via the author parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23216; http://securityreason.com/securityalert/1992; http://www.securityfocus.com/archive/1/453482/100/0/threaded
CVE: CVE-2006-6372
Published: 2006-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in pbguestbook.php in JAB Guest Book 20061205 allow remote attackers to inject arbitrary web script or HTML via the (1) topic or (2) message parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23216; https://exchange.xforce.ibmcloud.com/vulnerabilities/30718; http://secunia.com/advisories/23216
CVE: CVE-2006-6373
Published: 2006-12-07
Description: PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1993; http://www.securityfocus.com/archive/1/453432/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30737
CVE: CVE-2006-6374
Published: 2006-12-07
Description: Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1993; http://www.securityfocus.com/archive/1/453432/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30703
CVE: CVE-2006-6375
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer's automatic type detection.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23175; http://securityreason.com/securityalert/2001; http://www.securityfocus.com/archive/1/453426/100/0/threaded
CVE: CVE-2006-6376
Published: 2006-12-07
Description: Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30687; https://www.exploit-db.com/exploits/2883; https://exchange.xforce.ibmcloud.com/vulnerabilities/30687
CVE: CVE-2006-6377
Published: 2006-12-07
Description: Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain the admin password hash via a direct request for /password.txt.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23264; http://securityreason.com/securityalert/2003; http://www.securityfocus.com/archive/1/453644/100/0/threaded
CVE: CVE-2006-6378
Published: 2006-12-07
Description: BTSaveMySql 1.2 stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain configuration and save files via direct requests.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2002; http://www.securityfocus.com/archive/1/453652/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30760
CVE: CVE-2006-6380
Published: 2006-12-07
Description: Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23225; http://www.securityfocus.com/bid/21402; http://www.vupen.com/english/advisories/2006/4819
CVE: CVE-2006-6381
Published: 2006-12-07
Description: Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23225; http://www.vupen.com/english/advisories/2006/4819; https://exchange.xforce.ibmcloud.com/vulnerabilities/30722
CVE: CVE-2006-6382
Published: 2006-12-07
Description: The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23199; http://www.securityfocus.com/bid/21436; https://exchange.xforce.ibmcloud.com/vulnerabilities/30753
CVE: CVE-2006-4249
Published: 2006-12-07
Description: Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."
CVSS Score: 4.3 (MEDIUM)
References: http://plone.org/about/security/advisories/cve-2006-4249/; http://secunia.com/advisories/23240; http://www.securityfocus.com/bid/21460
CVE: CVE-2006-6384
Published: 2006-12-07
Description: Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window (f parameter), a variant of CVE-2006-6084.
CVSS Score: 7.8 (HIGH)
References: http://www.unverse.net/abitwhizzy-forum/[PII_REDACTED]/; http://www.unverse.net/abitwhizzy-forum/[PII_REDACTED]/
CVE: CVE-2006-6334
Published: 2006-12-08
Description: Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote malicious web sites to execute arbitrary code via a DataSize parameter that is less than the length of the Data buffer.
CVSS Score: 6.8 (MEDIUM)
References: http://fortconsult.net/files/fortconsult.dk/citrix_advisory_dec2006.pdf; http://secunia.com/advisories/23246; http://securityreason.com/securityalert/1995
CVE: CVE-2006-6385
Published: 2006-12-08
Description: Stack-based buffer overflow in Intel PRO 10/100, PRO/1000, and PRO/10GbE PCI, PCI-X, and PCIe network adapter drivers (aka NDIS miniport drivers) before 20061205 allows local users to execute arbitrary code with "kernel-level" privileges via an incorrect function call in certain OID handlers.
CVSS Score: 7.2 (HIGH)
References: http://lists.freebsd.org/pipermail/freebsd-security/2006-December/004186.html; http://research.eeye.com/html/advisories/published/AD20061207.html; http://research.eeye.com/html/advisories/upcoming/20060710.html
CVE: CVE-2006-6386
Published: 2006-12-08
Description: Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application page, which is not passed through check_markup on display.
CVSS Score: 6.8 (MEDIUM)
References: http://drupal.org/node/101540; http://secunia.com/advisories/23261; http://www.securityfocus.com/bid/21455
CVE: CVE-2006-6387
Published: 2006-12-08
Description: Multiple SQL injection vulnerabilities in LINK Content Management Server (CMS) allow remote attackers to execute arbitrary SQL commands via the (1) IDMeniGlavni parameter to navigacija.php, and the (2) IDStranicaPodaci parameter to prikazInformacije.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23107; http://www.securityfocus.com/bid/21464; https://exchange.xforce.ibmcloud.com/vulnerabilities/30744
CVE: CVE-2006-6388
Published: 2006-12-08
Description: Cross-site scripting (XSS) vulnerability in naprednaPretraga.php in LINK Content Management Server (CMS) allows remote attackers to inject arbitrary web script or HTML via the txtPretraga parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23107; http://www.securityfocus.com/bid/21464; https://exchange.xforce.ibmcloud.com/vulnerabilities/30745
CVE: CVE-2006-6389
Published: 2006-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via the (1) Taaa parameter to (a) up.php, or the (2) pollhtml and (3) Bloks parameters to (b) polls.php, different vectors than CVE-2006-5770.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2018; http://www.osvdb.org/37047; http://www.osvdb.org/37048
CVE: CVE-2006-6390
Published: 2006-12-08
Description: Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db_type] parameter to (1) categories.php, (2) couriers.php, (3) orders.php, and (4) products.php in actions_admin/; and (5) orders.php and (6) products.php in actions_client/; as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by one of these PHP scripts.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23168; http://www.securityfocus.com/bid/21411; http://www.vupen.com/english/advisories/2006/4835
CVE: CVE-2006-6391
Published: 2006-12-08
Description: Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include arbitrary files via a .. (dot dot) in the config[db_type] parameter to (1) actions_admin/other.php and (2) actions_client/gallery.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23168; http://secunia.com/advisories/23168
CVE: CVE-2006-6392
Published: 2006-12-08
Description: Directory traversal vulnerability in index.php in plx Web Studio (aka plxWebDev) plx Pay 3.2 and earlier allows remote attackers to include and execute arbitrary local files, or obtain user credentials and other sensitive information, via a .. (dot dot) in the read parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23190; http://www.securityfocus.com/bid/21379; http://www.vupen.com/english/advisories/2006/4809
CVE: CVE-2006-6393
Published: 2006-12-08
Description: Cross-site scripting (XSS) vulnerability in Jonas Gauffin Publicera 1.0-rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the InputFilter::getString function.
CVSS Score: 6.8 (MEDIUM)
References: http://sourceforge.net/forum/forum.php?forum_id=641350; http://www.securityfocus.com/bid/21457; http://www.vupen.com/english/advisories/2006/4880
CVE: CVE-2006-6394
Published: 2006-12-08
Description: SQL injection vulnerability in certain database classes in Jonas Gauffin Publicera 1.0-rc2 and earlier might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/forum/forum.php?forum_id=641350; http://www.securityfocus.com/bid/21457; http://www.vupen.com/english/advisories/2006/4880