deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6242
Published: 2006-12-03
Description: Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include arbitrary local files via a .. (dot dot) sequence in the serendipity[charset] parameter in (1) include/lang.inc.php; or to plugins/ scripts (2) serendipity_event_bbcode/serendipity_event_bbcode.php, (3) serendipity_event_browsercompatibility/serendipity_event_browsercompatibility.php, (4) serendipity_event_contentrewrite/serendipity_event_contentrewrite.php, (5) serendipity_event_creativecommons/serendipity_event_creativecommons.php, (6) serendipity_event_emoticate/serendipity_event_emoticate.php, (7) serendipity_event_entryproperties/serendipity_event_entryproperties.php, (8) serendipity_event_karma/serendipity_event_karma.php, (9) serendipity_event_livesearch/serendipity_event_livesearch.php, (10) serendipity_event_mailer/serendipity_event_mailer.php, (11) serendipity_event_nl2br/serendipity_event_nl2br.php, (12) serendipity_event_s9ymarkup/serendipity_event_s9ymarkup.php, (13) serendipity_event_searchhighlight/serendipity_event_searchhighlight.php, (14) serendipity_event_spamblock/serendipity_event_spamblock.php, (15) serendipity_event_spartacus/serendipity_event_spartacus.php, (16) serendipity_event_statistics/serendipity_plugin_statistics.php, (17) serendipity_event_templatechooser/serendipity_event_templatechooser.php, (18) serendipity_event_textile/serendipity_event_textile.php, (19) serendipity_event_textwiki/serendipity_event_textwiki.php, (20) serendipity_event_trackexits/serendipity_event_trackexits.php, (21) serendipity_event_weblogping/serendipity_event_weblogping.php, (22) serendipity_event_xhtmlcleanup/serendipity_event_xhtmlcleanup.php, (23) serendipity_plugin_comments/serendipity_plugin_comments.php, (24) serendipity_plugin_creativecommons/serendipity_plugin_creativecommons.php, (25) serendipity_plugin_entrylinks/serendipity_plugin_entrylinks.php, (26) serendipity_plugin_eventwrapper/serendipity_plugin_eventwrapper.php, (27) serendipity_plugin_history/serendipity_plugin_history.php, (28) serendipity_plugin_recententries/serendipity_plugin_recententries.php, (29) serendipity_plugin_remoterss/serendipity_plugin_remoterss.php, (30) serendipity_plugin_shoutbox/serendipity_plugin_shoutbox.php, and and (31) serendipity_plugin_templatedropdown/serendipity_plugin_templatedropdown.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.s9y.org/forums/viewtopic.php?t=7922; http://www.securityfocus.com/bid/21367; http://www.vupen.com/english/advisories/2006/4782
CVE: CVE-2006-3893
Published: 2006-12-04
Description: Multiple buffer overflows in the ActiveX controls in Newtone ImageKit 5 before Fix 30 and 6 before Fix 40, as used in CASIO Photo Loader software before 3.01 and possibly other software, allow remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23286; http://www.kb.cert.org/vuls/id/210697; http://www.securityfocus.com/bid/21375
CVE: CVE-2006-6243
Published: 2006-12-04
Description: Multiple SQL injection vulnerabilities in index.asp in FipsSHOP allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) did parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23147; http://securityreason.com/securityalert/1959; http://www.aria-security.com/forum/showthread.php?t=46
CVE: CVE-2006-6244
Published: 2006-12-04
Description: Coalescent Systems freePBX (formerly Asterisk Management Portal) before 2.2.0rc1 allows attackers to execute arbitrary commands via shell metacharacters in (1) CALLERID(name) or (2) CALLERID(number).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23124; http://sourceforge.net/project/shownotes.php?group_id=121515&release_id=467129; http://www.freepbx.org/trac/changeset/2076
CVE: CVE-2006-6245
Published: 2006-12-04
Description: Multiple SQL injection vulnerabilities in Photo Organizer (PO) 2.32b and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://po.shaftnet.org/po_stable_changelog; http://secunia.com/advisories/23176; http://www.securityfocus.com/bid/21351
CVE: CVE-2006-6246
Published: 2006-12-04
Description: Photo Organizer 2.32b and earlier does not properly check the ownership of certain objects, which allows remote attackers to gain unauthorized access via vectors related to (1) camera del, (2) camera edit, (3) folder/album deletion, (4) photo.move, (5) content.indexer, (6) folder.content, and possibly other operations.
CVSS Score: 7.5 (HIGH)
References: http://bugs.shaftnet.org/task/113; http://po.shaftnet.org/po_stable_changelog; http://secunia.com/advisories/23176
CVE: CVE-2006-6247
Published: 2006-12-04
Description: Multiple SQL injection vulnerabilities in Uapplication UPhotoGallery 1.1 allow remote attackers to execute arbitrary SQL commands via the ci parameter to (1) slideshow.asp or (2) thumbnails.asp.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1950; http://www.aria-security.com/forum/showthread.php?t=53; http://www.securityfocus.com/archive/1/452827/100/0/threaded
CVE: CVE-2006-6248
Published: 2006-12-04
Description: index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path in an error message.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/1951; http://www.securityfocus.com/archive/1/452025/100/200/threaded; http://www.securityfocus.com/archive/1/452099/100/200/threaded
CVE: CVE-2006-6249
Published: 2006-12-04
Description: Cross-site scripting (XSS) vulnerability in Chama Cargo 4.36 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23149; http://www.ipa.go.jp/security/vuln/documents/2006/JVN_08494205_ChamaCargo.html
CVE: CVE-2006-6250
Published: 2006-12-04
Description: Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of service (crash) via an M3U Playlist file containing extended ASCII, which causes the Unicode converter to be invoked.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/21343; https://exchange.xforce.ibmcloud.com/vulnerabilities/30563; https://www.exploit-db.com/exploits/2861
CVE: CVE-2006-6251
Published: 2006-12-04
Description: Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U file, aka an "M3U UNC Name" attack.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23182; http://www.kb.cert.org/vuls/id/311192; http://www.securityfocus.com/bid/21363
CVE: CVE-2006-6252
Published: 2006-12-04
Description: Microsoft Windows Live Messenger 8.0 and earlier, when gestual emoticons are enabled, allows remote attackers to cause a denial of service (CPU consumption) via a long string composed of ":D" sequences, which are interpreted as emoticons.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/452620/100/0/threaded; http://www.securityfocus.com/archive/1/452645/100/0/threaded; http://www.securityfocus.com/archive/1/452620/100/0/threaded
CVE: CVE-2006-6253
Published: 2006-12-04
Description: Cahier de texte 2.0 stores sensitive information under the web root, possibly with insufficient access control, which might allow remote attackers to obtain all users' passwords via a direct request for administration/dump.sql.
CVSS Score: 5.0 (MEDIUM)
References: http://acid-root.new.fr/poc/15061124.txt; http://secunia.com/advisories/23122; http://securityreason.com/securityalert/1961
CVE: CVE-2006-6254
Published: 2006-12-04
Description: administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the chemin parameter, as demonstrated using directory traversal sequences to obtain the MySQL username and password from conn_cahier_de_texte.php.  NOTE: it is not clear whether the scope of this issue extends above the web document root, and whether directory traversal is the primary vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: http://acid-root.new.fr/poc/15061124.txt; http://secunia.com/advisories/23122; http://securityreason.com/securityalert/1961
CVE: CVE-2006-6255
Published: 2006-12-04
Description: Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension in the filename parameter and code in the moreinfo parameter, which is saved to a filename under descriptions/, which is accessible via a direct request.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21284; https://exchange.xforce.ibmcloud.com/vulnerabilities/44729; https://www.exploit-db.com/exploits/2843
CVE: CVE-2006-6256
Published: 2006-12-04
Description: Cross-site scripting (XSS) vulnerability in the file manager in admin/bro_main.php in AlternC 0.9.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a folder name.
CVSS Score: 6.8 (MEDIUM)
References: http://dev.alternc.org/trac/alternc/changeset/1739; http://secunia.com/advisories/23144; http://securityreason.com/securityalert/1965
CVE: CVE-2006-6257
Published: 2006-12-04
Description: The file manager in AlternC 0.9.5 and earlier, when warnings are enabled in PHP, allows remote attackers to obtain sensitive information via certain folder names such as ones composed of JavaScript code, which reveal the path in a warning message.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23144; http://securityreason.com/securityalert/1965; http://www.ground418.org/exploits/read.php?file=06-alternC-095.txt
CVE: CVE-2006-6258
Published: 2006-12-04
Description: The phpmyadmin subsystem in AlternC 0.9.5 and earlier transmits the SQL password in cleartext in a cookie, which might allow remote attackers to obtain the password by sniffing or by conducting a cross-site scripting (XSS) attack.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23144; http://securityreason.com/securityalert/1965; http://www.ground418.org/exploits/read.php?file=06-alternC-095.txt
CVE: CVE-2006-6259
Published: 2006-12-04
Description: Multiple directory traversal vulnerabilities in (a) class/functions.php and (b) class/m_bro.php in AlternC 0.9.5 and earlier allow remote attackers to (1) create arbitrary files and directories via a .. (dot dot) in the "create name" field and (2) read arbitrary files via a .. (dot dot) in the "web root" field when configuring a subdomain.
CVSS Score: 10.0 (HIGH)
References: http://dev.alternc.org/trac/alternc/changeset/1737; http://dev.alternc.org/trac/alternc/changeset/1738; http://dev.alternc.org/trac/alternc/changeset/1742
CVE: CVE-2006-6260
Published: 2006-12-04
Description: SQL injection vulnerability in login.asp in Redbinaria Sistema Integrado de Administracion de Portales (SIAP) allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1957; http://www.securityfocus.com/archive/1/452642/100/0/threaded; http://www.securityfocus.com/bid/21286
CVE: CVE-2006-6261
Published: 2006-12-04
Description: Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) M3u or (2) M3u-8 file; or a (3) crafted PLS file with a long value in the (a) NumberofEntries, (b) Length (aka Length1), (c) Filename (aka File1), (d) Title (aka Title1) field, or other unspecified fields.
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/21331; https://exchange.xforce.ibmcloud.com/vulnerabilities/30559; https://www.exploit-db.com/exploits/2860
CVE: CVE-2006-6262
Published: 2006-12-04
Description: Directory traversal vulnerability in mboard.php in PHPJunkYard (aka Klemen Stirn) MBoard 1.22 and earlier allows remote attackers to create arbitrary empty files via a .. (dot dot) in the orig_id parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/23129; http://securityreason.com/securityalert/1988; http://www.mayhemiclabs.com/advisories/MHL-2006-004.txt
CVE: CVE-2006-6263
Published: 2006-12-04
Description: Teredo clients, when source routing is enabled, recognize a Routing header in an encapsulated IPv6 packet and send the packet to the next hop, which might allow remote attackers to bypass policies of certain Internet gateways that drop all source-routed packets.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/452989/100/0/threaded; http://www.securityfocus.com/archive/1/452996/100/0/threaded; http://www.symantec.com/avcenter/reference/Teredo_Security.pdf
CVE: CVE-2006-6264
Published: 2006-12-04
Description: Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to intranet hosts that use non-RFC1918 addresses, bypassing IPv4 ingress filtering.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/452989/100/0/threaded; http://www.securityfocus.com/archive/1/452996/100/0/threaded; http://www.symantec.com/avcenter/reference/Teredo_Security.pdf
CVE: CVE-2006-6265
Published: 2006-12-04
Description: Teredo clients, when located behind a restricted NAT, allow remote attackers to establish an inbound connection without the guessing required to find a port mapping for a traditional restricted NAT client, by (1) using the client port number contained in the Teredo address or (2) following the bubble-to-open procedure.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/452989/100/0/threaded; http://www.securityfocus.com/archive/1/452996/100/0/threaded; http://www.symantec.com/avcenter/reference/Teredo_Security.pdf
CVE: CVE-2006-6266
Published: 2006-12-04
Description: Teredo clients, when following item 6 of RFC4380 section 5.2.3, start direct IPv6 connectivity tests (aka ping tests) in response to packets from non-Teredo source addresses, which might allow remote attackers to induce Teredo clients to send packets to third parties.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/452989/100/0/threaded; http://www.securityfocus.com/archive/1/452996/100/0/threaded; http://www.symantec.com/avcenter/reference/Teredo_Security.pdf
CVE: CVE-2006-6267
Published: 2006-12-04
Description: PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an error message.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/452283/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30474; http://www.securityfocus.com/archive/1/452283/100/100/threaded
CVE: CVE-2006-6268
Published: 2006-12-04
Description: SQL injection vulnerability in system/core/profile/profile.inc.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote authenticated users to execute arbitrary SQL commands via a url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif" followed by a double-encoded NULL and ' (apostrophe) (%2500%2527).
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1954; http://www.nukedx.com/?viewdoc=51; http://www.securityfocus.com/archive/1/452259/100/100/threaded
CVE: CVE-2006-6269
Published: 2006-12-04
Description: Multiple SQL injection vulnerabilities in Infinitytechs Restaurants CM allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in rating.asp, (2) the mealid parameter in meal_rest.asp, and (3) the resid parameter in res_details.asp.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1981; http://www.securityfocus.com/archive/1/451970/100/200/threaded; http://securityreason.com/securityalert/1981
CVE: CVE-2006-6270
Published: 2006-12-04
Description: Multiple SQL injection vulnerabilities in ASPMForum allow remote attackers to execute arbitrary SQL commands via (1) the soruid parameter in forum2.asp, (2) the ak parameter in kullanicilistesi.asp, (3) the kelimeler parameter in aramayap.asp, and (4) the kullaniciadi parameter in giris.asp; and allow remote authenticated users to execute arbitrary SQL commands via (5) the mesajno parameter in mesajkutum.asp.  NOTE: the harf parameter in kullanicilistesi.asp and the baslik parameter in forum.asp are already covered by CVE-2005-4141.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1963; http://www.securityfocus.com/archive/1/451958/100/200/threaded; http://www.securityfocus.com/bid/21113
CVE: CVE-2006-6271
Published: 2006-12-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPOLL 0.96 allow remote attackers to inject arbitrary web script or HTML via the language parameter to (1) index.php, (2) info.php; and (3) index.php, (4) votanti.php, (5) risultati_config.php, (6) modifica_band.php, (7) band_editor.php, and (8) config_editor.php in admin/.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1960; http://www.securityfocus.com/archive/1/452093/100/200/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30426
CVE: CVE-2006-6272
Published: 2006-12-04
Description: Cross-site scripting (XSS) vulnerability in sp_index.php in Simple PHP Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1967; http://www.securityfocus.com/archive/1/452555/100/100/threaded; http://www.securityfocus.com/bid/21278
CVE: CVE-2006-6273
Published: 2006-12-04
Description: sp_index.php in Simple PHP Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid dir parameter, which reveals the path in an error message.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1967; http://www.securityfocus.com/archive/1/452555/100/100/threaded; http://www.securityfocus.com/archive/1/455359/100/0/threaded
CVE: CVE-2006-6274
Published: 2006-12-04
Description: SQL injection vulnerability in articles.asp in Expinion.net iNews (1) Publisher (iNP) 2.5 and earlier, and possibly (2) News Manager, allows remote attackers to execute arbitrary SQL commands via the ex parameter.  NOTE: early reports of this issue reported it as XSS, but this was erroneous.  The original report was for News Manager, but there is strong evidence that the correct product is Publisher.
CVSS Score: 6.8 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-November/001147.html; http://secunia.com/advisories/23123; http://securityreason.com/securityalert/1956
CVE: CVE-2006-6275
Published: 2006-12-04
Description: Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors, possibly related to the exitlwps function and SIGKILL and /proc PCAGENT signals.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/23187; http://securitytracker.com/id?1017321; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102574-1
CVE: CVE-2006-6276
Published: 2006-12-04
Description: HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-444
References: http://secunia.com/advisories/23186; http://securitytracker.com/id?1017322; http://securitytracker.com/id?1017323
CVE: CVE-2006-6277
Published: 2006-12-04
Description: Directory traversal vulnerability in admin/FileServer.php in ContentServ 4.x allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter, a different vector than CVE-2005-3086.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23158; http://securityreason.com/securityalert/1989; http://www.securityfocus.com/archive/1/453130/100/0/threaded
CVE: CVE-2006-6278
Published: 2006-12-04
Description: Cross-site scripting (XSS) vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23181; http://securityreason.com/securityalert/1964; http://www.securityfocus.com/archive/1/453123/100/0/threaded
CVE: CVE-2006-6279
Published: 2006-12-04
Description: index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23181; http://securityreason.com/securityalert/1964; http://www.securityfocus.com/archive/1/453123/100/0/threaded
CVE: CVE-2006-6280
Published: 2006-12-04
Description: SQL injection vulnerability in viewthread.php in Oxygen (O2PHP Bulletin Board) 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, a different vector than CVE-2006-1572.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/14061118.txt; http://securityreason.com/securityalert/1958; http://www.securityfocus.com/archive/1/452009/100/200/threaded
CVE: CVE-2006-6281
Published: 2006-12-04
Description: PHP remote file inclusion vulnerability in check_status.php in dicshunary 0.1 alpha allows remote attackers to execute arbitrary PHP code via a URL in the dicshunary_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1962; http://www.securityfocus.com/archive/1/452128/100/200/threaded; http://www.securityfocus.com/bid/21162
CVE: CVE-2006-6282
Published: 2006-12-04
Description: members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709.  NOTE: might only be an exposure if display_errors is enabled, but due to lack of details, even this is not clear.
CVSS Score: 9.3 (HIGH)
References: http://securityreason.com/securityalert/1966; http://www.securityfocus.com/archive/1/452018/100/200/threaded; http://www.securityfocus.com/bid/21196
CVE: CVE-2006-6283
Published: 2006-12-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the subject field of (1) a private message (PM) or (2) a bulletin board post.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/23026; http://securityreason.com/securityalert/1982; http://www.osvdb.org/30529
CVE: CVE-2006-6284
Published: 2006-12-04
Description: Directory traversal vulnerability in admin.php in Vikingboard 0.1.2 allows remote authenticated administrators to include arbitrary files via a .. (dot dot) sequence in the act parameter.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/23026; http://securityreason.com/securityalert/1966; http://www.osvdb.org/30530
CVE: CVE-2006-6285
Published: 2006-12-04
Description: PHP remote file inclusion vulnerability in index.php in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the externalConfig parameter.  NOTE: CVE and other third parties dispute this vulnerability because $externalConfig is defined before use
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-December/001159.html; http://www.attrition.org/pipermail/vim/2006-December/001161.html; http://www.securityfocus.com/bid/21378