deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2126
Published: 2006-05-01
Description: SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categori and (2) stranica parameters.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/maxtrade-sql-inj.html; http://secunia.com/advisories/19876; http://www.osvdb.org/25122
CVE: CVE-2006-2127
Published: 2006-05-01
Description: SQL injection vulnerability in weblog_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL commands via the r parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/810; http://www.securityfocus.com/archive/1/432602/100/0/threaded; http://www.securityfocus.com/bid/17744
CVE: CVE-2006-2128
Published: 2006-05-01
Description: Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str parameter to (b) search.php, or (4) artid parameter to (c) art.php, or (5) catid parameter to (d) cat.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evuln.com/vulns/130/summary.html; http://secunia.com/advisories/19882; http://soot.shabgard.org/bugs/propublish.txt
CVE: CVE-2006-2129
Published: 2006-05-01
Description: Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in set_inc.php.
CVSS Score: 5.5 (MEDIUM)
References: http://evuln.com/vulns/130/summary.html; http://secunia.com/advisories/19882; http://www.osvdb.org/25128
CVE: CVE-2006-2130
Published: 2006-05-01
Description: SQL injection vulnerability in include/class_poll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
CVSS Score: 5.1 (MEDIUM)
References: http://evuln.com/vulns/131/summary.html; http://secunia.com/advisories/19899; http://www.osvdb.org/25167
CVE: CVE-2006-2131
Published: 2006-05-01
Description: include/class_poll.php in Advanced Poll 2.0.4 uses the HTTP_X_FORWARDED_FOR (X-Forwarded-For HTTP header) to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/131/summary.html; http://secunia.com/advisories/19899; http://www.vupen.com/english/advisories/2006/1603
CVE: CVE-2006-2132
Published: 2006-05-01
Description: SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/duclassified-detail.asp-sql-inj.txt; http://www.securityfocus.com/bid/17722; http://downloads.securityfocus.com/vulnerabilities/exploits/duclassified-detail.asp-sql-inj.txt
CVE: CVE-2006-2133
Published: 2006-05-01
Description: SQL injection vulnerability in index.php in BoonEx Barracuda 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) link_dir_target and (2) link_id_target parameter, possibly involving the link_edit functionality.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/barracuda-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26175; http://pridels0.blogspot.com/2006/04/barracuda-vuln.html
CVE: CVE-2006-2109
Published: 2006-05-02
Description: Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables within the program, as demonstrated using the table parameter to login.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19937; http://www.osvdb.org/25222; http://www.securityfocus.com/archive/1/432714/100/0/threaded
CVE: CVE-2006-2134
Published: 2006-05-02
Description: PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/19892; http://www.securityfocus.com/bid/17763; http://www.vupen.com/english/advisories/2006/1585
CVE: CVE-2006-2135
Published: 2006-05-02
Description: SQL injection vulnerability in login.php in Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/128/; http://secunia.com/advisories/19895; http://www.securityfocus.com/bid/17758
CVE: CVE-2006-2136
Published: 2006-05-02
Description: SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/126/; http://secunia.com/advisories/19888; http://securitytracker.com/id?1016036
CVE: CVE-2006-2137
Published: 2006-05-02
Description: PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19893; http://www.openphpnuke.com/system/article/index.php?opnparams=B3YBZAI3BWgEbFU0; http://www.osvdb.org/25140
CVE: CVE-2006-2138
Published: 2006-05-02
Description: Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.29 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19906; http://securityreason.com/securityalert/827; http://www.aria-security.net/hm/neomail.txt
CVE: CVE-2006-2139
Published: 2006-05-02
Description: Multiple SQL injection vulnerabilities in PHP Newsfeed 20040723 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to (a) deltables.php, (2) select, (3) header, (4) url, (5) source, or (6) time parameters to (b) manualsubmit.php, (7) num parameter to (c) delete.php, or (8) tablename parameter to (d) searchnews.php.
CVSS Score: 6.4 (MEDIUM)
References: http://evuln.com/vulns/129/summary.html; http://secunia.com/advisories/19904; http://www.osvdb.org/25132
CVE: CVE-2006-2140
Published: 2006-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitrary web script via the (1) referral parameter to signup.php or (2) id parameter to members.php.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/orbithyip-xss.html; http://secunia.com/advisories/19877; http://www.osvdb.org/25141
CVE: CVE-2006-2141
Published: 2006-05-02
Description: Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the pos argument.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/cps-340-xss.html; http://secunia.com/advisories/19879; http://www.osvdb.org/25144
CVE: CVE-2006-2142
Published: 2006-05-02
Description: PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classes_dir parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19891; http://www.osvdb.org/25155; http://www.securityfocus.com/archive/1/446142/100/0/threaded
CVE: CVE-2006-2143
Published: 2006-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in TextFileBB 1.0.16 allow remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) color, (2) size, or (3) url bbcode tags.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19883; http://securityreason.com/securityalert/828; http://securitytracker.com/id?1016013
CVE: CVE-2006-2144
Published: 2006-05-02
Description: PHP remote file inclusion vulnerability in kopf.php in DMCounter 0.9.2-b allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0181.html; http://secunia.com/advisories/19918; http://securityreason.com/securityalert/826
CVE: CVE-2006-2145
Published: 2006-05-02
Description: Multiple SQL injection vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) topic or (2) id parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://evuln.com/vulns/127/summary.html; http://secunia.com/advisories/19896; http://securitytracker.com/id?1016037
CVE: CVE-2006-2146
Published: 2006-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) poster_name, (2) poster_email, (3) poster_homepage, or (4) message parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://evuln.com/vulns/127/summary.html; http://secunia.com/advisories/19896; http://securitytracker.com/id?1016037
CVE: CVE-2006-2147
Published: 2006-05-02
Description: resmgrd in resmgr for SUSE Linux and other distributions does not properly handle when access to a USB device is granted by using "usb:<bus>,<dev>" notation, which grants access to all USB devices and allows local users to bypass intended restrictions.  NOTE: this is a different vulnerability than CVE-2005-4788.
CVSS Score: 3.6 (LOW)
References: http://lists.suse.com/archive/suse-security-announce/2006-Feb/0008.html; http://secunia.com/advisories/19887; http://secunia.com/advisories/19898
CVE: CVE-2006-1526
Published: 2006-05-02
Description: Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
CVSS Score: 2.1 (LOW)
References: http://lists.freedesktop.org/archives/xorg/2006-May/015136.html; http://secunia.com/advisories/19900; http://secunia.com/advisories/19915
CVE: CVE-2006-2148
Published: 2006-05-02
Description: Multiple buffer overflows in client.c in CGI:IRC (CGIIRC) before 0.5.8 might allow remote attackers to execute arbitrary code via (1) cookies or (2) the query string.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365680; http://cvs.cgiirc.org/chngview?cn=263; http://cvs.cgiirc.org/chngview?cn=283
CVE: CVE-2006-2149
Published: 2006-05-03
Description: PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the CONFIG[path] parameter, as demonstrated by including a GIF that contains PHP code.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19911; http://www.osvdb.org/25158; http://www.securityfocus.com/bid/17940
CVE: CVE-2006-2150
Published: 2006-05-03
Description: PHP remote file inclusion vulnerability in top/list.php in phpBB TopList 1.3.8 and earlier allows remote attackers to include arbitrary files via the returnpath parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://www.osvdb.org/25294; http://www.securityfocus.com/archive/1/432453/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26172
CVE: CVE-2006-2151
Published: 2006-05-03
Description: PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19884; http://www.osvdb.org/25260; http://www.vupen.com/english/advisories/2006/1601
CVE: CVE-2006-2152
Published: 2006-05-03
Description: PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19905; http://www.securityfocus.com/bid/17745; http://www.vupen.com/english/advisories/2006/1600
CVE: CVE-2006-2153
Published: 2006-05-03
Description: Cross-site scripting (XSS) vulnerability in HTM_PASSWD in DirectAdmin Hosting Management allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19885; http://securityreason.com/securityalert/830; http://www.aria-security.net/advisory/hm/directadmin.txt
CVE: CVE-2006-2154
Published: 2006-05-03
Description: EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 does not drop privileges before opening files, which allows local users to execute arbitrary code via the File>Open dialog.
CVSS Score: 7.2 (HIGH)
References: http://kb.dantz.com/display/2n/articleDirect/index.asp?aid=9507&r=0.7344324; http://secunia.com/advisories/19850; http://www.securityfocus.com/bid/17798
CVE: CVE-2006-2155
Published: 2006-05-03
Description: EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 allows local users to execute arbitrary code by replacing the Retrospect.exe file, possibly due to improper file permissions.
CVSS Score: 4.6 (MEDIUM)
References: http://kb.dantz.com/display/2n/articleDirect/index.asp?aid=9507&r=0.7344324; http://secunia.com/advisories/19850; http://www.vupen.com/english/advisories/2006/1612
CVE: CVE-2006-2156
Published: 2006-05-03
Description: Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. (dot dot) sequences in the help_file parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19886; http://securityreason.com/securityalert/829; http://www.osvdb.org/25149
CVE: CVE-2006-2157
Published: 2006-05-03
Description: SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow".  NOTE: This is a different vulnerability than CVE-2005-4246.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://retrogod.altervista.org/plogger_b21_sql_xpl.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26273; http://retrogod.altervista.org/plogger_b21_sql_xpl.html
CVE: CVE-2006-2158
Published: 2006-05-03
Description: Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by performing PHP remote file inclusion using the include_files array parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://retrogod.altervista.org/gbs_17_xpl_pl.html; http://secunia.com/advisories/19957; http://www.securityfocus.com/bid/17845
CVE: CVE-2006-2159
Published: 2006-05-03
Description: CRLF injection vulnerability in help.php in Russcom Network Loginphp allows remote attackers to spoof e-mails and inject MIME headers via CRLF sequences in the email address.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19930; http://www.osvdb.org/25214; http://www.securityfocus.com/archive/1/432729/100/0/threaded
CVE: CVE-2006-2160
Published: 2006-05-03
Description: Cross-site scripting (XSS) vulnerability in Russcom Network Loginphp (Russcom.Loginphp) allows remote attackers to inject arbitrary web script or HTML via the username field when registering.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19930; http://www.osvdb.org/25213; http://www.securityfocus.com/archive/1/432729/100/0/threaded
CVE: CVE-2006-2162
Published: 2006-05-03
Description: Buffer overflow in CGI scripts in Nagios 1.x before 1.4 and 2.x before 2.3 allows remote attackers to execute arbitrary code via a negative content length (Content-Length) HTTP header.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19991; http://secunia.com/advisories/19998; http://secunia.com/advisories/20013
CVE: CVE-2006-1527
Published: 2006-05-03
Description: The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed by the for_each_sctp_chunk function.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19926; http://secunia.com/advisories/20157; http://secunia.com/advisories/20237
CVE: CVE-2006-2163
Published: 2006-05-04
Description: Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart 3.33 and earlier allows remote attackers to inject arbitrary web script or HTML via the setbackurl parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/pinnacle-cart-xss.html; http://secunia.com/advisories/19878; http://www.securityfocus.com/bid/17794
CVE: CVE-2006-2164
Published: 2006-05-04
Description: Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php, and (2) prod_id parameter in (c) cart.php and (d) product_info.php.  NOTE: this issue also produces resultant full path disclosure from invalid SQL queries.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/05/avactis-shopping-cart-vuln.html; http://www.osvdb.org/25637; http://www.osvdb.org/25638
CVE: CVE-2006-2165
Published: 2006-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php and (2) prod_id parameter in (c) product_info.php.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/05/avactis-shopping-cart-vuln.html; http://www.osvdb.org/25641; http://www.osvdb.org/25642
CVE: CVE-2006-2166
Published: 2006-05-04
Description: Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows remote authenticated attackers to reset the password for any user with an expired password.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19881; http://securitytracker.com/id?1016015; http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml
CVE: CVE-2006-2167
Published: 2006-05-04
Description: Cross-site scripting (XSS) vulnerability in SloughFlash SF-Users 1.0, possibly in register.php, allows remote attackers to inject arbitrary web script or HTML by setting the username field to contain JavaScript in the SRC attribute of an IMG element.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19932; http://securityreason.com/securityalert/831; http://www.securityfocus.com/archive/1/432727/100/0/threaded
CVE: CVE-2006-2168
Published: 2006-05-04
Description: FileProtection Express 1.0.1 and earlier allows remote attackers to bypass authentication via a cookie with an Admin value of 1.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/835; http://www.securityfocus.com/archive/1/432728/100/0/threaded; http://www.securityfocus.com/bid/17786
CVE: CVE-2006-2169
Published: 2006-05-04
Description: RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/rt-request-tracker-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26164; http://pridels0.blogspot.com/2006/04/rt-request-tracker-vuln.html
CVE: CVE-2006-2170
Published: 2006-05-04
Description: Buffer overflow in ArgoSoft FTP Server 1.4.3.6 allows remote attackers to execute arbitrary code via Unicode in the RNTO command, as demonstrated by the Infigo FTPStress Fuzzer.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0139.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8818&w=2; http://secunia.com/advisories/19934
CVE: CVE-2006-2171
Published: 2006-05-04
Description: Buffer overflow in WDM.exe in WarFTPD allows remote attackers to execute arbitrary code via unspecified arguments, as demonstrated by the Infigo FTPStress Fuzzer.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0139.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8818&w=2; http://www.infigo.hr/en/in_focus/tools
CVE: CVE-2006-2172
Published: 2006-05-04
Description: Buffer overflow in Gene6 FTP Server 3.1.0 allows remote authenticated attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to (1) MKD or (2) XMKD, as demonstrated by the Infigo FTPStress Fuzzer.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19965; http://www.infigo.hr/en/in_focus/tools; http://www.osvdb.org/25238
CVE: CVE-2006-2173
Published: 2006-05-04
Description: Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PASS followed by the MLSD command, or (2) the remote server interface, as demonstrated by the Infigo FTPStress Fuzzer.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0139.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8818&w=2; http://www.infigo.hr/en/in_focus/tools
CVE: CVE-2006-2174
Published: 2006-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/server_day_stats.php in Virtual Hosting Control System (VHCS) allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, or (3) year parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19940; http://securityreason.com/securityalert/832; http://www.aria-security.net/hm/vhcs.txt
CVE: CVE-2006-2175
Published: 2006-05-04
Description: PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) show.php or (2) top.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19923; http://securitytracker.com/id?1016021; http://www.aria-security.net/advisory/fc/fastclick.txt
CVE: CVE-2006-2176
Published: 2006-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in links.php in PHP Linkliste 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) new_input, (2) new_url, or (3) new_name parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://d4igoro.blogspot.com/2006/05/php-linkliste-10b-xss.html; http://secunia.com/advisories/19925; http://www.securityfocus.com/bid/17828
CVE: CVE-2006-2177
Published: 2006-05-04
Description: Cross-site scripting (XSS) vulnerability in viewcat.php in geoBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/833; http://www.securityfocus.com/archive/1/432720/100/0/threaded; http://www.securityfocus.com/bid/17784