deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4335
Published: 2006-09-19
Description: Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GZIP archive that triggers an out-of-bounds write, aka a "stack modification vulnerability."
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204676; http://docs.info.apple.com/article.html?artnum=304829
CVE: CVE-2006-4336
Published: 2006-09-19
Description: Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204676; http://docs.info.apple.com/article.html?artnum=304829
CVE: CVE-2006-4337
Published: 2006-09-19
Description: Buffer overflow in the make_table function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted decoding table in a GZIP archive.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204676; http://docs.info.apple.com/article.html?artnum=304829
CVE: CVE-2006-4338
Published: 2006-09-19
Description: unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204676; http://docs.info.apple.com/article.html?artnum=304829
CVE: CVE-2006-4871
Published: 2006-09-19
Description: SQL injection vulnerability in search_run.asp in Keyvan1 (aka Keyvan Janghorbani) EShoppingPro 1.0 allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22006; http://securityreason.com/securityalert/1610; http://securitytracker.com/id?1016878
CVE: CVE-2006-4872
Published: 2006-09-19
Description: SQL injection vulnerability in search.asp in Keyvan1 (aka Keyvan Janghorbani) ECardPro 2.0 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22013; http://securityreason.com/securityalert/1609; http://securitytracker.com/id?1016882
CVE: CVE-2006-4873
Published: 2006-09-19
Description: Jupiter CMS allows remote attackers to obtain sensitive information via a direct request for (1) includes/functions.php, (2) modules/register.php, (3) modules/poll.php, (4) modules/panel.php, (5) modules/pm.php, (6) modules/news.php, (7) modules/templates_change.php, (8) modules/users.php, (9) modules/misc.php, (10) modules/masspm.php, (11) modules/mass-email.php, (12) modules/main-nav.php, (13) modules/login.php, (14) modules/layout.php, (15) modules/hq.php, (16) modules/forum.php, (17) modules/forum-admin.php, (18) modules/events.php, (19) modules/emoticons.php, (20) modules/download.php, (21) modules/blocks.php, (22) modules/ban.php, (23) modules/badwords.php, (24) modules/ads.php, or (25) modules/admin.php, which reveals the installation path in various error messages.  NOTE: The modules/online.php vector is already covered by CVE-2006-1679.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1608; http://www.securityfocus.com/archive/1/446064/100/0/threaded; http://www.securityfocus.com/bid/20048
CVE: CVE-2006-4874
Published: 2006-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jupiter CMS allow remote attackers to inject arbitrary web script or HTML via the (1) language[Admin name] and (2) language[Admin back] parameters in (a) modules/blocks.php; the (3) language[Register title] and (4) language[Register title2] parameters in (b) modules/register.php; the (5) language[Mass-Email form title], (6) language[Mass-Email form desc], (7) language[Mass-Email form desc2] (8) language[Mass-Email form desc3], and (9) language[Mass-Email form desc4] parameters in (c) modules/mass-email.php; the (10) language[Forgotten title], (11) language[Forgotten desc], (12) language[Forgotten desc2], (13) language[Forgotten desc3], (14) language[Forgotten desc4], and (15) language[Forgotten desc5] parameters in (d) modules/register.php; and the (16) language[Search view desc], (17) language[Search view desc2], (18) language[Search view desc3], (19) language[Search view desc4], (20) language[Search view desc5], (21) language[Search view desc6], (22) language[Search view desc7], and (23) language[Search view desc8] parameters in (e) modules/search.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1608; http://www.securityfocus.com/archive/1/446064/100/0/threaded; http://www.securityfocus.com/bid/20048
CVE: CVE-2006-4875
Published: 2006-09-19
Description: Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, and possibly files with arbitrary extensions, to gallery/albums/public.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1608; http://www.securityfocus.com/archive/1/446064/100/0/threaded; http://www.securityfocus.com/bid/20048
CVE: CVE-2006-4876
Published: 2006-09-19
Description: Multiple SQL injection vulnerabilities in Jupiter CMS allow remote attackers to execute arbitrary SQL commands via (1) the user name during login, or the (2) key or (3) fpwusername parameters in modules/register.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1608; http://www.securityfocus.com/archive/1/446064/100/0/threaded; http://www.securityfocus.com/bid/20048
CVE: CVE-2006-4877
Published: 2006-09-19
Description: Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22014; http://securityreason.com/securityalert/1607; http://www.osvdb.org/28965
CVE: CVE-2006-4878
Published: 2006-09-19
Description: Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter.  NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution by uploading and accessing an avatar file.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22014; http://securityreason.com/securityalert/1607; http://www.osvdb.org/28964
CVE: CVE-2006-4879
Published: 2006-09-19
Description: SQL injection vulnerability in profile.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22014; http://securityreason.com/securityalert/1607; http://www.securityfocus.com/archive/1/446318/100/0/threaded
CVE: CVE-2006-4880
Published: 2006-09-19
Description: David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) footer.php, (2) template.php, or (3) lastvisit.php, which reveals the installation path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22014; http://securityreason.com/securityalert/1607; http://www.osvdb.org/28973
CVE: CVE-2006-4881
Published: 2006-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the replyuser parameter in (a) pm.php; (2) the txt_jumpto parameter in (b) dropdown.php; the (3) txt_error and (4) txt_templatenotexist parameters in (c) template.php; the (5) split parameter in certain files, as demonstrated by (d) editprofile.php, (e) search.php, (f) index.php, and (g) pm.php; and the (6) txt_login parameter in (h) loginline.php; and allow remote authenticated users to inject arbitrary web script or HTML via the (7) txt_logout parameter in (i) loginline.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22014; http://securityreason.com/securityalert/1607; http://www.osvdb.org/28968
CVE: CVE-2006-4882
Published: 2006-09-19
Description: SQL injection vulnerability in Review.asp in Julian Roberts Charon Cart 3 allows remote attackers to execute arbitrary SQL commands via the ProductID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21987; http://securityreason.com/securityalert/1606; http://securitytracker.com/id?1016881
CVE: CVE-2006-4883
Published: 2006-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot BizDirectory allow remote attackers to inject arbitrary web script or HTML via (1) the stylesheet parameter in Feed.php or (2) the message parameter in status.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21911; http://securityreason.com/securityalert/1611; http://securitytracker.com/id?1016876
CVE: CVE-2006-4884
Published: 2006-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 allow remote attackers to inject arbitrary web script or HTML via (1) the suser parameter in support/rightbar.php, (2) the ticket_id parameter in support/open_tickets.php, and (3) the cons_page_title parameter in index.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/19963; http://www.securityfocus.com/bid/19963
CVE: CVE-2006-4885
Published: 2006-09-19
Description: PHP remote file inclusion vulnerability in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) footer.php and (2) header.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information. The bottom.php parameter is already covered by CVE-2006-4826.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21920; http://www.osvdb.org/28836; http://www.osvdb.org/28837
CVE: CVE-2006-4886
Published: 2006-09-19
Description: The VirusScan On-Access Scan component in McAfee VirusScan Enterprise 7.1.0 and Scan Engine 4.4.00 allows local privileged users to bypass security restrictions and disable the On-Access Scan option by opening the program via the task bar and quickly clicking the Disable button, possibly due to an interface-related race condition.
CVSS Score: 3.7 (LOW)
References: http://securityreason.com/securityalert/1605; http://www.securityfocus.com/archive/1/446220/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/28971
CVE: CVE-2006-4887
Published: 2006-09-19
Description: Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain applications, which allows local users to bypass authentication and gain privileges by selecting the icon during installation.  NOTE: it could be argued that the issue is not in Remote Desktop itself, but in applications that are installed while using it.
CVSS Score: 7.2 (HIGH)
References: http://www.osvdb.org/32260; http://www.securityfocus.com/archive/1/446371/100/0/threaded; http://www.securityfocus.com/archive/1/446751/100/0/threaded
CVE: CVE-2006-4888
Published: 2006-09-19
Description: Microsoft Internet Explorer 6 and earlier allows remote attackers to cause a denial of service (application hang) via a CSS-formatted HTML INPUT element within a DIV element that has a larger size than the INPUT.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0199.html; http://jonas.elunic.de/blog/index.php/2006/07/14/ie-freeze-bug/; http://www.osvdb.org/28614
CVE: CVE-2006-4889
Published: 2006-09-19
Description: Multiple PHP remote file inclusion vulnerabilities in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter in (1) index.php, (2) includes/functions.gb.php, (3) includes/functions.admin.php, (4) includes/admin.inc.php, (5) help.php, (6) smile.php, (7) entry.php; (8) adminhelp0.php, (9) adminhelp1.php, (10) adminhelp2.php, and (11) adminhelp3.php in (a) help/en and (b) help/de directories; and the (12) preview.php, (13) log.php, (14) index.php, (15) config.php, and (16) admin.php in the (c) admin directory, a different set of vectors than CVE-2006-4788.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1619; http://www.osvdb.org/32199; http://www.osvdb.org/32200
CVE: CVE-2006-4890
Published: 2006-09-19
Description: Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dirroot parameter to (1) fckeditor/editor/filemanager/browser/default/connectors/php/connector.php or (2) fckeditor/editor/dialog/fck_link.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21957; http://www.securityfocus.com/bid/20070; http://www.unak.net/forum/viewtopic.php?id=165
CVE: CVE-2006-4891
Published: 2006-09-19
Description: SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21976; http://securityreason.com/securityalert/1613; http://www.securityfocus.com/archive/1/446312/100/0/threaded
CVE: CVE-2006-4892
Published: 2006-09-19
Description: SQL injection vulnerability in faqview.asp in Techno Dreams FAQ Manager Package 1.0 allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21977; http://securityreason.com/securityalert/1615; http://www.securityfocus.com/archive/1/446259/100/0/threaded
CVE: CVE-2006-4893
Published: 2006-09-19
Description: PHP remote file inclusion vulnerability in bb_usage_stats/includes/bb_usage_stats.php in phpBB XS 0.58 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter, a different vector than CVE-2006-4780.
CVSS Score: 7.5 (HIGH)
References: http://nyubicrew.org/adv/Noge_adv_02.txt; http://secunia.com/advisories/21970; http://securityreason.com/securityalert/1617
CVE: CVE-2006-4894
Published: 2006-09-19
Description: Cross-site scripting (XSS) vulnerability in forms/lostpassword.php in iDevSpot NixieAffiliate 1.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22063; http://securityreason.com/securityalert/1616; http://www.securityfocus.com/archive/1/446306/100/0/threaded
CVE: CVE-2006-4895
Published: 2006-09-19
Description: IDevSpot NexieAffiliate 1.9 and earlier allows remote attackers to delete arbitrary affiliates via a modified id parameter to delete.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22063; http://securityreason.com/securityalert/1616; http://www.securityfocus.com/archive/1/446306/100/0/threaded
CVE: CVE-2006-4896
Published: 2006-09-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-4785.  Reason: This candidate is a duplicate of CVE-2006-4785.  Notes: All CVE users should reference CVE-2006-4785 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4897
Published: 2006-09-19
Description: CMtextS 1.0 and earlier stores users_logins/admin.txt under the web document root with insufficient access control, which allows remote attackers to obtain the administrator password.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21988; http://www.vupen.com/english/advisories/2006/3690; https://exchange.xforce.ibmcloud.com/vulnerabilities/28999
CVE: CVE-2006-4898
Published: 2006-09-19
Description: PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the appconf[rootpath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20071; https://exchange.xforce.ibmcloud.com/vulnerabilities/28994; https://www.exploit-db.com/exploits/2381
CVE: CVE-2006-4438
Published: 2006-09-20
Description: Heap-based buffer overflow in SpIDer for Dr.Web Scanner for Linux 4.33, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LHA archive with an extended header that contains a long directory name.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049552.html; http://secunia.com/advisories/22019; http://www.securityfocus.com/bid/20119
CVE: CVE-2006-4904
Published: 2006-09-21
Description: Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code, as demonstrated by PHP remote file inclusion via the xcart_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22005; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6&; http://www.securityfocus.com/bid/20108
CVE: CVE-2006-4905
Published: 2006-09-21
Description: PHP remote file inclusion vulnerability in index.php in Artmedic Links 5.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, which is processed by the readfile function.
CVSS Score: 7.5 (HIGH)
References: http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-27-artmedic-links.html; http://securityreason.com/securityalert/1600; http://securitytracker.com/id?1016880
CVE: CVE-2006-4906
Published: 2006-09-21
Description: SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_calendarid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22007; http://www.securityfocus.com/bid/20100; http://www.vupen.com/english/advisories/2006/3718
CVE: CVE-2006-4907
Published: 2006-09-21
Description: OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL to a non-existent file, which displays the web root path in the resulting error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22016; http://securityreason.com/securityalert/1602; http://www.securityfocus.com/archive/1/446372/100/0/threaded
CVE: CVE-2006-4908
Published: 2006-09-21
Description: OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL containing an * (asterisk) wildcard, which displays all matching file and directory information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22016; http://securityreason.com/securityalert/1622; http://www.securityfocus.com/archive/1/446372/100/0/threaded
CVE: CVE-2006-4909
Published: 2006-09-21
Description: Cross-site scripting (XSS) vulnerability in Cisco Guard DDoS Mitigation Appliance before 5.1(6), when anti-spoofing is enabled, allows remote attackers to inject arbitrary web script or HTML via certain character sequences in a URL that are not properly handled when the appliance sends a meta-refresh.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21962; http://securitytracker.com/id?1016890; http://www.cisco.com/warp/public/707/cisco-sa-20060920-guardxss.shtml
CVE: CVE-2006-4910
Published: 2006-09-21
Description: The web administration interface (mainApp) to Cisco IDS before 4.1(5c), and IPS 5.0 before 5.0(6p1) and 5.1 before 5.1(2) allows remote attackers to cause a denial of service (unresponsive device) via a crafted SSLv2 Client Hello packet.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22046; http://securitytracker.com/id?1016891; http://www.cisco.com/warp/public/707/cisco-sa-20060920-ips.shtml
CVE: CVE-2006-4911
Published: 2006-09-21
Description: Unspecified vulnerability in Cisco IPS 5.0 before 5.0(6p2) and 5.1 before 5.1(2), when running in inline or promiscuous mode, allows remote attackers to bypass traffic inspection via a "crafted sequence of fragmented IP packets".
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22022; http://securitytracker.com/id?1016891; http://www.cisco.com/warp/public/707/cisco-sa-20060920-ips.shtml
CVE: CVE-2006-4912
Published: 2006-09-21
Description: PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the script parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20041; http://www.vupen.com/english/advisories/2006/3641; https://exchange.xforce.ibmcloud.com/vulnerabilities/28989
CVE: CVE-2006-4913
Published: 2006-09-21
Description: Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter, as demonstrated by injecting PHP code into a log file.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21961; http://www.securityfocus.com/bid/20088; http://www.vupen.com/english/advisories/2006/3684
CVE: CVE-2006-4914
Published: 2006-09-21
Description: Directory traversal vulnerability in A.l-Pifou 1.8p2 allows remote attackers to read arbitrary files via ".." sequences in the ze_langue_02 cookie, as demonstrated by using the choix_lng parameter to choix_langue.php to indirectly set the cookie, then accessing livre_dor.php to trigger the inclusion from inc/change_lang_ck.php, possibly related to livre_livre.php.  NOTE: the livre_livre.php relationship has been reported by some third party sources.
CVSS Score: 2.6 (LOW)
References: http://seclists.org/fulldisclosure/2006/Sep/0341.html; http://secunia.com/advisories/22038; http://www.osvdb.org/29014
CVE: CVE-2006-4915
Published: 2006-09-21
Description: Cross-site scripting (XSS) vulnerability in index.php in Innovate Portal 2.0 allows remote attackers to inject arbitrary web script or HTML via the content parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1621; http://www.securityfocus.com/archive/1/446422/100/0/threaded; http://www.securityfocus.com/bid/20104
CVE: CVE-2006-4916
Published: 2006-09-21
Description: SQL injection vulnerability in uye_profil.asp in Tekman Portal (TR) 1.0 allows remote attackers to execute arbitrary SQL commands via the uye_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22008; http://www.securityfocus.com/bid/20102; http://www.vupen.com/english/advisories/2006/3717
CVE: CVE-2006-4917
Published: 2006-09-21
Description: Cross-site scripting (XSS) vulnerability in search.php in PT News 1.7.8 allows remote attackers to inject arbitrary web script or HTML via the pgname parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22028; http://securityreason.com/securityalert/1612; http://www.securityfocus.com/archive/1/446417/100/0/threaded