deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2490
Published: 2006-05-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other versions before 2.2.3.18 for M10/D10 and 3.0.3.31 for M22, allow remote attackers to inject arbitrary web script or HTML via URL-encoded values in (1) the query string to help/help, (2) the get_image_info_abspath parameter to control/eventplayer, and (3) the source_ip parameter to events.tar.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20151; http://securityreason.com/securityalert/929; http://securitytracker.com/id?1016128
CVE: CVE-2006-2491
Published: 2006-05-19
Description: Cross-site scripting (XSS) vulnerability in (1) index.php and (2) bmc/admin.php in BoastMachine (bMachine) 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $_SERVER["PHP_SELF"] variable.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20149; http://securityreason.com/securityalert/725; http://securityreason.com/securityalert/927
CVE: CVE-2006-2492
Published: 2006-05-20
Description: Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx; http://isc.sans.org/diary.php?storyid=1345; http://isc.sans.org/diary.php?storyid=1346
CVE: CVE-2006-2493
Published: 2006-05-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-1861.  Reason: This candidate is a duplicate of CVE-2006-1861.  Notes: All CVE users should reference CVE-2006-1861 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-2494
Published: 2006-05-20
Description: Stack-based buffer overflow in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a crafted .map file.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20172; http://securitytracker.com/id?1016117; http://www.securityfocus.com/bid/18039
CVE: CVE-2006-2495
Published: 2006-05-20
Description: Cross-site request forgery (CSRF) vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20155; http://sourceforge.net/project/shownotes.php?release_id=414920&group_id=75065; http://www.vupen.com/english/advisories/2006/1855
CVE: CVE-2006-2496
Published: 2006-05-20
Description: Buffer overflow in iMonitor 2.4 in Novell eDirectory 8.8 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/20139; http://securitytracker.com/id?1016120; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2973759.htm
CVE: CVE-2006-2497
Published: 2006-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in AspBB 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to default.asp or (2) get parameter to profile.asp.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20175; http://securityreason.com/securityalert/926; http://www.osvdb.org/25650
CVE: CVE-2006-2498
Published: 2006-05-20
Description: Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classes/post/class_post.php and (2) the df value in action_public/moderate.php.
CVSS Score: 6.4 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-May/000776.html; http://forums.invisionpower.com/index.php?act=Attach&type=post&id=10026; http://forums.invisionpower.com/index.php?showtopic=215527
CVE: CVE-2006-2499
Published: 2006-05-20
Description: SQL injection vulnerability in default.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to execute arbitrary SQL commands via the password field.
CVSS Score: 7.5 (HIGH)
References: http://colander.altervista.org/advisory/CANews.txt; http://secunia.com/advisories/20171; http://www.osvdb.org/25652
CVE: CVE-2006-2500
Published: 2006-05-20
Description: Cross-site scripting (XSS) vulnerability in add_news.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field.  NOTE: if this issue is limited to administrators, and if it is expected behavior for administrators to be able to generate HTML, then this is not a vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: http://colander.altervista.org/advisory/CANews.txt; http://secunia.com/advisories/20171; http://www.osvdb.org/25653
CVE: CVE-2006-2501
Published: 2006-05-20
Description: Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving error messages.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/jp/JVN%2303D5EAA8/index.html; http://secunia.com/advisories/20147; http://securitytracker.com/id?1016125
CVE: CVE-2006-1857
Published: 2006-05-22
Description: Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed HB-ACK chunk.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17; http://secunia.com/advisories/20185; http://secunia.com/advisories/20671
CVE: CVE-2006-1858
Published: 2006-05-22
Description: SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length of provided parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17; http://secunia.com/advisories/20185; http://secunia.com/advisories/20671
CVE: CVE-2006-2502
Published: 2006-05-22
Description: Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute arbitrary code via a long USER command.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0527.html; http://securitytracker.com/id?1016131; http://www.securityfocus.com/bid/18056
CVE: CVE-2006-2185
Published: 2006-05-22
Description: PORTAL.NLM in Novell Netware 6.5 SP5 writes the username and password in cleartext to the abend.log log file when the groupOperationsMethod function fails, which allows context-dependent attackers to gain privileges.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/20288; http://securitytracker.com/id?1016106; http://support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm
CVE: CVE-2006-2503
Published: 2006-05-22
Description: SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20104; http://securityreason.com/securityalert/935; http://www.osvdb.org/25529
CVE: CVE-2006-2504
Published: 2006-05-22
Description: Multiple SQL injection vulnerabilities in mono AZBOARD 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) search and (2) cate parameters to (a) list.asp, and the (3) id and cate parameters to (b) admin_ok.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20112; http://securityreason.com/securityalert/928; http://user.chol.com/~jyj9782/sec/azboard_advisory.txt
CVE: CVE-2006-2505
Published: 2006-05-22
Description: Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via a reference to a malicious package in the TYPE_NAME argument in the (1) GET_DOMAIN_INDEX_TABLES or (2) GET_V2_DOMAIN_INDEX_TABLES function in the DBMS_EXPORT_EXTENSION package.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/19860; http://www.kb.cert.org/vuls/id/932124; http://www.securityfocus.com/archive/1/432078/100/0/threaded
CVE: CVE-2006-2506
Published: 2006-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO and (2) the category parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/930; http://soot.shabgard.org/bugs/Sphider.txt; http://www.osvdb.org/25573
CVE: CVE-2006-2507
Published: 2006-05-22
Description: Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) index.php, (2) song.php, (3) faq.php, (4) list.php, (5) gen_m3u.php, and (6) playlist.php.
CVSS Score: 7.5 (HIGH)
References: http://kurdishsecurity.blogspot.com/2006/05/kurdish-security-7-foing-remote-file.html; http://secunia.com/advisories/20092; http://securityreason.com/securityalert/932
CVE: CVE-2006-2508
Published: 2006-05-22
Description: SQL injection vulnerability in tr1.php in YourFreeWorld.com Stylish Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly involving an attack vector using advertise.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20213; http://securityreason.com/securityalert/931; http://www.osvdb.org/25691
CVE: CVE-2006-2509
Published: 2006-05-22
Description: SQL injection vulnerability in login.php in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/434530/100/0/threaded; http://www.securityfocus.com/bid/18046; http://www.securityfocus.com/archive/1/434530/100/0/threaded
CVE: CVE-2006-2510
Published: 2006-05-22
Description: Cross-site scripting (XSS) vulnerability in the URL submission form in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to inject arbitrary web script or HTML via an unspecified form for submitting URLs.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/434530/100/0/threaded; http://www.securityfocus.com/bid/18046; https://exchange.xforce.ibmcloud.com/vulnerabilities/26574
CVE: CVE-2006-2511
Published: 2006-05-22
Description: The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/20165; http://securitytracker.com/id?1016124; http://www.securityfocus.com/archive/1/434400/100/0/threaded
CVE: CVE-2006-2512
Published: 2006-05-22
Description: SQL injection vulnerability in Hitachi EUR Professional Edition, EUR Viewer, EUR Print Service, and EUR Print Service for ILF allows remote authenticated users to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/20106; http://www.hitachi-support.com/security_e/vuls_e/HS06-010_e/index-e.html; http://www.osvdb.org/25558
CVE: CVE-2006-2513
Published: 2006-05-22
Description: Unspecified vulnerability in the installation process in Sun Java System Directory Server 5.2 causes wrong user data to be written to a file created by the installation, which allows remote attackers or local users to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20144; http://securitytracker.com/id?1016112; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102345-1
CVE: CVE-2006-2514
Published: 2006-05-22
Description: Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20211; http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266; http://www.vupen.com/english/advisories/2006/1892
CVE: CVE-2006-2515
Published: 2006-05-22
Description: Cross-site scripting (XSS) vulnerability in index.php in Hiox Guestbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input forms for signing the guestbook.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20252; http://securityreason.com/securityalert/938; http://www.osvdb.org/25712
CVE: CVE-2006-2516
Published: 2006-05-22
Description: mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/20176; http://securityreason.com/securityalert/934; http://www.osvdb.org/25683
CVE: CVE-2006-2517
Published: 2006-05-22
Description: SQL injection vulnerability in MyWeb Portal Office, Standard Edition, Public Edition, Medical Edition, Citizen Edition, School Edition, and Light Edition allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20178; http://securitytracker.com/id?1016133; http://www.myweb-jp.com/support/tech/tech_common_013.html
CVE: CVE-2006-2518
Published: 2006-05-22
Description: Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] parameter to include/inc_tmpl/content/cnt6.inc.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20239; http://securityreason.com/securityalert/939; http://www.kapda.ir/advisory-331.html
CVE: CVE-2006-2519
Published: 2006-05-22
Description: Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files via .. (dot dot) sequences in the spaw_root parameter.  NOTE: CVE analysis suggests that this issue is actually in SPAW Editor PHP Edition.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20239; http://securityreason.com/securityalert/939; http://www.kapda.ir/advisory-331.html
CVE: CVE-2006-2520
Published: 2006-05-22
Description: Directory traversal vulnerability in BitZipper 4.1.2 SR-1 and earlier allows remote attackers to create files in arbitrary directories via a ..  (dot dot) in the filename of a file that is stored in a (1) RAR (.rar), (2) TAR (.tar), (3) ZIP (.zip), (4) GZ (.gz), or (5) JAR (.jar) archive.
CVSS Score: 5.0 (MEDIUM)
References: http://hamid.ir/security/bitzipper.txt; http://secunia.com/advisories/20207; http://securitytracker.com/id?1016132
CVE: CVE-2006-2521
Published: 2006-05-22
Description: PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/20209; http://www.vupen.com/english/advisories/2006/1896; https://exchange.xforce.ibmcloud.com/vulnerabilities/26625
CVE: CVE-2006-2522
Published: 2006-05-22
Description: Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://colander.altervista.org/advisory/DayfoxBlog.txt; http://secunia.com/advisories/20216; http://securitytracker.com/id?1016163
CVE: CVE-2006-2523
Published: 2006-05-22
Description: PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20220; http://www.osvdb.org/25694; http://www.vupen.com/english/advisories/2006/1894
CVE: CVE-2006-2524
Published: 2006-05-22
Description: Cross-site scripting (XSS) vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20187; http://sourceforge.net/project/shownotes.php?release_id=418462&group_id=93103; http://www.osvdb.org/25684
CVE: CVE-2006-2525
Published: 2006-05-22
Description: SQL injection vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to execute arbitrary SQL commands via the member list search module.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20187; http://sourceforge.net/project/shownotes.php?release_id=418462&group_id=93103; http://www.osvdb.org/25685
CVE: CVE-2006-2526
Published: 2006-05-22
Description: PHP remote file inclusion vulnerability in index.php in PHP Easy Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20245; http://securityreason.com/securityalert/936; http://www.securityfocus.com/archive/1/434695/100/0/threaded
CVE: CVE-2006-2527
Published: 2006-05-22
Description: Admin/admin.php in phpBazar 2.1.0 and earlier allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20198; http://www.osvdb.org/25701; http://www.securityfocus.com/archive/1/434558/100/0/threaded
CVE: CVE-2006-2528
Published: 2006-05-22
Description: PHP remote file inclusion vulnerability in classified_right.php in phpBazar 2.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20198; http://securityreason.com/securityalert/933; http://www.osvdb.org/25700
CVE: CVE-2006-1520
Published: 2006-05-22
Description: Format string vulnerability in ANSI C Sender Policy Framework library (libspf) before 1.0.0-p5, when debugging is enabled, allows remote attackers to execute arbitrary code via format string specifiers, possibly in an e-mail address.
CVSS Score: 6.4 (MEDIUM)
References: http://permalink.gmane.org/gmane.mail.spam.spf.devel/849; http://www.gossamer-threads.com/lists/spf/devel/27053?page=last; http://www.libspf.org/index.html
CVE: CVE-2006-2529
Published: 2006-05-22
Description: editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, does not verify the Type parameter, which allows remote attackers to upload arbitrary file types.  NOTE: It is not clear whether this is related to CVE-2006-0658.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20122; http://www.fckeditor.net/whatsnew/default.html; http://www.osvdb.org/25631
CVE: CVE-2006-2530
Published: 2006-05-22
Description: avatar_upload.asp in Avatar MOD 1.3 for Snitz Forums 3.4, and possibly other versions, allows remote attackers to bypass file type checks and upload arbitrary files via a null byte in the file name, as discovered by the Codescan product.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/20148; http://www.codescan.com/Advisories/CodeScanLabs_AvatarMod.html; http://www.security-assessment.com/Whitepapers/0x00_vs_ASP_File_Uploads.pdf
CVE: CVE-2006-2531
Published: 2006-05-22
Description: Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to spoof being a trusted console and bypass authentication by setting HTTP User-Agent header to "Ipswitch/1.0" and the User-Application header to "NmConsole".
CVSS Score: 7.5 (HIGH)
References: http://www.ftusecurity.com/pub/whatsup.public.pdf; http://www.securityfocus.com/archive/1/434247/100/0/threaded; http://www.securityfocus.com/archive/1/434447/100/0/threaded
CVE: CVE-2006-2532
Published: 2006-05-22
Description: stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message.  NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an invalid value that prevents some variables from being set.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/940; http://www.securityfocus.com/archive/1/434691/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26603
CVE: CVE-2006-2533
Published: 2006-05-22
Description: Cross-site scripting (XSS) vulnerability in (1) addWeblog.php and (2) leaveComments.php in Destiney Rated Images Script 0.5.0 does not properly filter all vulnerable HTML tags, which allows remote attackers to inject arbitrary web script or HTML via Javascript in a DIV tag.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20249; http://securityreason.com/securityalert/940; http://www.securityfocus.com/archive/1/434691/100/0/threaded
CVE: CVE-2006-2534
Published: 2006-05-22
Description: Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain the installation path via a direct URL to files in the (1) include and (2) themes/original directories.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/937; http://www.securityfocus.com/archive/1/434692/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26610
CVE: CVE-2006-2535
Published: 2006-05-22
Description: index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message.  NOTE: this issue might be resultant from a more serious issue such as directory traversal.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/20248; http://securityreason.com/securityalert/937; http://www.securityfocus.com/archive/1/434692/100/0/threaded
CVE: CVE-2006-2536
Published: 2006-05-22
Description: Cross-site scripting (XSS) vulnerability in Destiney Links Script 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) "Search" (term parameter in index.php) and (2) "Add a Site" (add.php) fields.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20248; http://securityreason.com/securityalert/937; http://www.securityfocus.com/archive/1/434692/100/0/threaded