deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5015
Published: 2006-09-27
Description: PHP remote file inclusion vulnerability in hit.php in Kietu 3.2 allows remote attackers to execute arbitrary PHP code via an FTP URL in the url_hit parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/8071; http://securityreason.com/securityalert/1644; http://www.attrition.org/pipermail/vim/2006-September/001053.html
CVE: CVE-2006-4694
Published: 2006-09-27
Description: Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office XP and Office 2003 allows user-assisted attackers to execute arbitrary code via a crafted record in a PPT file, as exploited by malware such as Exploit:Win32/Controlppt.W, Exploit:Win32/Controlppt.X, and Exploit-PPT.d/Trojan.PPDropper.F. NOTE: it has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/22127; http://securitytracker.com/id?1016937; http://vil.nai.com/vil/content/v_140666.htm
CVE: CVE-2006-5016
Published: 2006-09-27
Description: Unrestricted file upload vulnerability in admin/x_image.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to upload arbitrary files to the /imagebank directory.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21969; http://securityreason.com/securityalert/1642; http://www.securityfocus.com/archive/1/446706/100/0/threaded
CVE: CVE-2006-5017
Published: 2006-09-27
Description: SQL injection vulnerability in admin/all_users.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to execute arbitrary SQL commands via the from parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21969; http://securityreason.com/securityalert/1642; http://www.securityfocus.com/archive/1/446706/100/0/threaded
CVE: CVE-2006-5018
Published: 2006-09-27
Description: ContentKeeper 123.25 and earlier places passwords in cleartext in an INPUT element in cgi-bin/ck/changepw.cgi, which allows remote authenticated users to obtain passwords via this URI.
CVSS Score: 4.0 (MEDIUM)
References: http://securityreason.com/securityalert/1639; http://securitytracker.com/id?1016915; http://www.aushack.com/advisories/200606-contentkeeper.txt
CVE: CVE-2006-5019
Published: 2006-09-27
Description: Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invalid client parameter, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22059; http://securityreason.com/securityalert/1637; http://users.tpg.com.au/adsl2dvp/advisories/200609-googlemini.txt
CVE: CVE-2006-5020
Published: 2006-09-27
Description: Multiple PHP remote file inclusion vulnerabilities in SolidState 0.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the base_path parameter in manager/pages/ scripts including (1) AccountsPage.class.php, (2) AddInvoicePage.class.php, (3) AddIPAddressPage.class.php, (4) AddPaymentPage.class.php, (5) AddTaxRulePage.class.php, (6) AssignDomainPage.class.php, (7) AssignHostingPage.class.php, (8) AssignProductPage.class.php, (9) BillingPage.class.php, (10) BillingPaymentPage.class.php, (11) BrowseAccountsPage.class.php, (12) BrowseInvoicesPage.class.php, (13) ConfigureEditUserPage.class.php, (14) ConfigureNewUserPage.class.php, (15) ConfigureNewUserReceiptPage.class.php, (16) ConfigureUsersPage.class.php, (17) DeleteAccountPage.class.php, (18) DeleteDomainServicePage.class.php, (19) DeleteHostingServicePage.class.php, (20) DeleteInvoicePage.class.php, (21) DeleteProductPage.class.php, (22) DeleteServerPage.class.php, (23) DomainServicesPage.class.php, (24) DomainsPage.class.php, (25) EditAccountPage.class.php, (26) EditDomainPage.class.php, (27) EditDomainServicePage.class.php, (28) EditHostingServicePage.class.php, (29) EditPaymentPage.class.php, (30) EditProductPage.class.php, (31) EditServerPage.class.php, (32) EmailInvoicePage.class.php, (33) ExecuteOrderPage.class.php, (34) ExpiredDomainsPage.class.php, (35) FulfilledOrdersPage.class.php, (36) GenerateInvoicesPage.class.php, (37) HomePage.class.php, (38) InactiveAccountsPage.class.php, (39) IPManagerPage.class.php, (40) LoginPage.class.php, (41) LogPage.class.php, (42) ModulesPage.class.php, (43) NewAccountPage.class.php, (44) NewDomainServicePage.class.php, (45) NewProductPage.class.php, (46) OutstandingInvoicesPage.class.php, (47) PendingAccountsPage.class.php, (48) PendingOrdersPage.class.php, (49) PrintInvoicePage.class.php, (50) ProductsPage.class.php, (51) RegisterDomainPage.class.php, (52) RegisteredDomainsPage.class.php, (53) ServersPage.class.php, (54) ServicesHostingServicesPage.class.php, (55) ServicesNewHostingPage.class.php, (56) ServicesPage.class.php, (57) ServicesWebHostingPage.class.php, (58) SettingsPage.class.php, (59) TaxesPage.class.php, (60) TransferDomainPage.class.php, (61) ViewAccountPage.class.php, (62) ViewDomainServicePage.class.php, (63) ViewHostingServicePage.class.php, (64) ViewInvoicePage.class.php, (65) ViewLogMessagePage.class.php, (66) ViewOrderPage.class.php, (67) ViewProductPage.class.php, (68) ViewServerPage.class.php, (69) WelcomeEmailPage.class.php; and (70) modules/RegistrarModule.class.php, (71) modules/SolidStateModule.class.php, (72) modules/authorizeaim/authorizeaim.class.php, and (73) modules/authorizeaim/pages/AAIMConfigPage.class.php.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-January/001210.html; http://www.osvdb.org/31097; http://www.osvdb.org/31098
CVE: CVE-2006-5021
Published: 2006-09-27
Description: Multiple PHP remote file inclusion vulnerabilities in redgun RedBLoG 0.5 allow remote attackers to execute arbitrary PHP code via a URL in (1) the root parameter in imgen.php, and the root_path parameter in (2) admin/config.php, (3) common.php, and (4) admin/index.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/20115; http://www.securityfocus.com/bid/20115
CVE: CVE-2006-5022
Published: 2006-09-27
Description: PHP remote file inclusion vulnerability in includes/global.php in Joshua Wilson pNews System 1.1.0 (aka PowerNews) allows remote attackers to execute arbitrary PHP code via a URL in the nbs parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/446929/100/0/threaded; http://www.securityfocus.com/bid/20140; https://exchange.xforce.ibmcloud.com/vulnerabilities/29080
CVE: CVE-2006-5023
Published: 2006-09-27
Description: SQL injection vulnerability in kategori.asp in xweblog 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the kategori parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22052; http://www.securityfocus.com/bid/20145; http://www.vupen.com/english/advisories/2006/3762
CVE: CVE-2006-5024
Published: 2006-09-27
Description: Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.4 have unknown impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://secunia.com/advisories/21952; http://sourceforge.net/project/shownotes.php?release_id=447952&group_id=173812; http://www.securityfocus.com/bid/20151
CVE: CVE-2006-5025
Published: 2006-09-27
Description: Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.2 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=447952&group_id=173812; http://sourceforge.net/project/shownotes.php?release_id=447952&group_id=173812
CVE: CVE-2006-5026
Published: 2006-09-27
Description: Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.3 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=447952&group_id=173812; http://sourceforge.net/project/shownotes.php?release_id=447952&group_id=173812
CVE: CVE-2006-5027
Published: 2006-09-27
Description: Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/phplib files (1) db_msql.inc, (2) db_mssql.inc, (3) db_mysql.inc, (4) db_oci8.inc, (5) db_odbc.inc, (6) db_oracle.inc, and (7) db_pgsql.inc; and (8) db_sybase.inc, which reveals the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1638; http://www.securityfocus.com/archive/1/446741/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/29126
CVE: CVE-2006-5028
Published: 2006-09-27
Description: Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remote attackers to list arbitrary directories via a ../ (dot dot slash) in the file parameter in a chdir action.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22058; http://securityreason.com/securityalert/1643; http://www.securityfocus.com/archive/1/446730/100/0/threaded
CVE: CVE-2006-5029
Published: 2006-09-27
Description: SQL injection vulnerability in thread.php in WoltLab Burning Board (wBB) 2.3.x allows remote attackers to obtain the version numbers of PHP, MySQL, and wBB via the page parameter.  NOTE: this issue might be a forced SQL error. Also, the original report was disputed by a third party for 2.3.3 and 2.3.4.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/446743/100/0/threaded; http://www.securityfocus.com/archive/1/446937/100/0/threaded; http://www.securityfocus.com/archive/1/446938/100/100/threaded
CVE: CVE-2006-5030
Published: 2006-09-27
Description: SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22045; http://www.securityfocus.com/bid/20143; https://exchange.xforce.ibmcloud.com/vulnerabilities/29079
CVE: CVE-2006-5031
Published: 2006-09-27
Description: Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://cakeforge.org/frs/shownotes.php?release_id=134; http://secunia.com/advisories/22040; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
CVE: CVE-2006-5032
Published: 2006-09-27
Description: PHP remote file inclusion vulnerability in dix.php3 in PHPartenaire 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the url_phpartenaire parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22053; http://www.securityfocus.com/bid/20182; http://www.vupen.com/english/advisories/2006/3759
CVE: CVE-2006-5033
Published: 2006-09-27
Description: Unspecified vulnerability in StoresAndCalendarsList.cgi in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to cause a denial of service via the session parameter, possibly related to format string specifiers or malformed URL encoding.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0187.html; http://secunia.com/advisories/21862; http://securitytracker.com/id?1016822
CVE: CVE-2006-5034
Published: 2006-09-27
Description: Directory traversal vulnerability in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0187.html; http://secunia.com/advisories/21862; http://securitytracker.com/id?1016822
CVE: CVE-2006-5035
Published: 2006-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Paul Smith Computer Services vCAP 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the statusmsg parameter in RegisterPage.cgi or (2) a URI corresponding to a nonexistent file. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21862; http://www.osvdb.org/28809; http://www.osvdb.org/28810
CVE: CVE-2006-5036
Published: 2006-09-27
Description: MySource Matrix 3.8 and earlier, and MySource 2.x, allow remote attackers to use the application as an HTTP proxy server via the sq_remote_page_url parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting (XSS) attacks. NOTE: the researcher reports that "The vendor does not consider this a vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22060; http://securityreason.com/securityalert/1635; http://www.aushack.com/advisories/200607-mysourcematrix.txt
CVE: CVE-2006-5037
Published: 2006-09-27
Description: MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sq_content_src parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting (XSS) attacks.  NOTE: the researcher reports that "The vendor does not consider this a vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22060; http://securityreason.com/securityalert/1635; http://www.aushack.com/advisories/200607-mysourcematrix.txt
CVE: CVE-2006-5038
Published: 2006-09-27
Description: The FiWin SS28S WiFi VoIP SIP/Skype Phone, firmware version 01_02_07, has a hard-coded username and password, which allows remote attackers to gain administrative access via telnet.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0391.html; http://secunia.com/advisories/22041; http://www.osnews.com/story.php/15923/Review-FiWin-SS28S-WiFi-VoIP-SIPSkype-Phone/
CVE: CVE-2006-5039
Published: 2006-09-27
Description: Unspecified vulnerability in Events 1.3 beta module (com_events) for Joomla! has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C79477.0.html; http://forum.joomla.org/index.php/topic%2C80411.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html
CVE: CVE-2006-5040
Published: 2006-09-27
Description: Unspecified vulnerability in SEF404x (com_sef) for Joomla! has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C79477.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html
CVE: CVE-2006-5041
Published: 2006-09-27
Description: Unspecified vulnerability in Hot Properties (possibly com_hotproperties) 0.97 and earlier for Joomla! has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C79477.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html
CVE: CVE-2006-5042
Published: 2006-09-27
Description: Unspecified vulnerability in mosMedia (com_mosmedia) 1.0.8 and earlier for Joomla! has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C78533.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html; http://forum.joomla.org/index.php/topic%2C78533.0.html
CVE: CVE-2006-5043
Published: 2006-09-27
Description: Multiple PHP remote file inclusion vulnerabilities in the Joomlaboard Forum Component (com_joomlaboard) before 1.1.2 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the sbp parameter to (1) file_upload.php or (2) image_upload.php, a variant of CVE-2006-3528.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://forum.joomla.org/index.php/topic%2C76852.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html; http://jext.info/builds/joomlaboard/joomlaboard-1.1.1-stable.tgz
CVE: CVE-2006-5044
Published: 2006-09-27
Description: Unspecified vulnerability in Prince Clan (Princeclan) Chess component (com_pcchess) 0.8 and earlier for Mambo and Joomla! has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C79477.0.html; http://www.princeclan.org; http://forum.joomla.org/index.php/topic%2C79477.0.html
CVE: CVE-2006-5045
Published: 2006-09-27
Description: Unspecified vulnerability in PollXT component (com_pollxt) 1.22.07 and earlier for Joomla! has unspecified impact and attack vectors, probably related to PHP remote file inclusion in the mosConfig_absolute_path to conf.pollxt.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://forum.joomla.org/index.php/topic%2C77975.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html; http://secunia.com/advisories/21068
CVE: CVE-2006-5046
Published: 2006-09-27
Description: Unspecified vulnerability in RS Gallery2 (com_rsgallery2) 1.11.3 and earlier for Joomla! has unspecified impact and attack vectors, related to lack of "hardened language files."
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C73453.0.html; http://forum.joomla.org/index.php/topic%2C79477.0.html; http://rsgallery2.net/component/option%2Ccom_rsgallery2/Itemid%2C7/page%2CviewChangelog/
CVE: CVE-2006-5047
Published: 2006-09-27
Description: Unspecified vulnerability in rsgallery2.html.php in RS Gallery2 component (com_rsgallery2) before 1.11.3 for Joomla! allows attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://rsgallery2.net/component/option%2Ccom_rsgallery2/Itemid%2C7/page%2CviewChangelog/; http://rsgallery2.net/component/option%2Ccom_rsgallery2/Itemid%2C7/page%2CviewChangelog/
CVE: CVE-2006-5048
Published: 2006-09-27
Description: Multiple PHP remote file inclusion vulnerabilities in Security Images (com_securityimages) component 3.0.5 and earlier for Joomla! allow remote attackers to execute arbitrary code via a URL in the mosConfig_absolute_path parameter in (1) configinsert.php, (2) lang.php, (3) client.php, and (4) server.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://forum.joomla.org/index.php/topic%2C79477.0.html; http://forum.joomla.org/index.php/topic%2C81589.0.html; http://secunia.com/advisories/21260
CVE: CVE-2006-5049
Published: 2006-09-27
Description: Unspecified vulnerability in Classifieds (com_classifieds) component 1.3 and earlier for Joomla! has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://forum.joomla.org/index.php/topic%2C79477.0.html; http://forum.joomla.org/index.php/topic%2C82457.0.html; http://www.securityfocus.com/bid/84256
CVE: CVE-2006-5050
Published: 2006-09-27
Description: Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" sequences in the URI.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1636; http://securitytracker.com/id?1016875; http://www.securityfocus.com/archive/1/446228/100/0/threaded
CVE: CVE-2006-5051
Published: 2006-09-27
Description: Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
CVSS Score: 8.1 (HIGH)
CWE: CWE-415
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc; ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://docs.info.apple.com/article.html?artnum=305214
CVE: CVE-2006-5052
Published: 2006-09-27
Description: Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://marc.info/?l=openssh-unix-dev&m=[PII_REDACTED]9160&w=2
CVE: CVE-2006-5053
Published: 2006-09-28
Description: PHP remote file inclusion vulnerability in webnews/template.php in Web-News 1.6.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content_page parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22075; http://www.osvdb.org/29106; http://www.securityfocus.com/bid/20166
CVE: CVE-2006-5054
Published: 2006-09-28
Description: SQL injection vulnerability in uye/uye_ayrinti.asp in iyzi Forum 1 Beta 2 and earlier allows remote attackers to execute arbitrary SQL commands via the uye_nu parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20168; http://www.vupen.com/english/advisories/2006/3761; https://exchange.xforce.ibmcloud.com/vulnerabilities/29125
CVE: CVE-2006-5055
Published: 2006-09-28
Description: PHP remote file inclusion vulnerability in admin/testing/tests/0004_init_urls.php in syntaxCMS 1.1.1 through 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the init_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8660&w=2; http://securitytracker.com/id?1016914; http://www.securityfocus.com/bid/20171
CVE: CVE-2006-5056
Published: 2006-09-28
Description: Cross-site scripting (XSS) vulnerability in index.php in Opial Audio/Video Download Management 1.0 allows remote attackers to inject arbitrary web script or HTML via the destination parameter in the Login view.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22092; http://securityreason.com/securityalert/1641; http://www.securityfocus.com/archive/1/446896/100/0/threaded
CVE: CVE-2006-5057
Published: 2006-09-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ktools.net PhotoStore allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter in details.php, or the (2) photogid parameter in view_photog.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22122; http://securityreason.com/securityalert/1640; http://www.securityfocus.com/archive/1/446909/100/0/threaded
CVE: CVE-2006-5058
Published: 2006-09-28
Description: Buffer overflow in (1) Call of Duty 1.5b and earlier, (2) Call of Duty United Offensive 1.51b and earlier, and (3) Call of Duty 2 1.3 and earlier allows remote attackers to execute arbitrary code via a long map argument to the "callvote map" command.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/codmapbof-adv.txt; http://secunia.com/advisories/22078; http://www.securityfocus.com/bid/20180
CVE: CVE-2006-5059
Published: 2006-09-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in WWWthreads 5.4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the Cat parameter to (1) dosearch.php, (2) postlist.php, (3) showmembers.php, (4) faq_english.php, (5) online.php, (6) login.php, (7) newuser.php, (8) wwwthreads.php, (9) search.php, or (10) postlist.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22211; http://securityreason.com/securityalert/1645; http://www.securityfocus.com/archive/1/446911/100/0/threaded
CVE: CVE-2006-5060
Published: 2006-09-28
Description: Cross-site scripting (XSS) vulnerability in login.php in Jamroom 3.0.16 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the forgot parameter in the forgot mode.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22077; http://securityreason.com/securityalert/1649; http://www.securityfocus.com/archive/1/446879/100/0/threaded
CVE: CVE-2006-5061
Published: 2006-09-28
Description: PHP remote file inclusion vulnerability in mcf.php in Advanced-Clan-Script (AVCX) 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22070; http://www.osvdb.org/29123; http://www.securityfocus.com/bid/20167