deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2950
Published: 2006-06-12
Description: Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) header.php, (2) contact.php, or (3) forum_extender.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/20523; http://securityreason.com/securityalert/1076; http://www.acid-root.new.fr/advisories/npds510.txt
CVE: CVE-2006-2951
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the (1) Titlesitename or (2) sitename parameter to (a) header.php, (3) nuke_url parameter to (b) meta/meta.php, (4) forum parameter to (c) viewforum.php, (5) post_id, (6) forum, (7) topic, or (8) arbre parameter to (d) editpost.php, or (9) uname or (10) email parameter to (e) user.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20523; http://securityreason.com/securityalert/1076; http://www.acid-root.new.fr/advisories/npds510.txt
CVE: CVE-2006-2952
Published: 2006-06-12
Description: Directory traversal vulnerability in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the (1) Default_Theme parameter to header.php or (2) ModPath parameter to modules/cluster-paradise/cluster-E.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20523; http://securityreason.com/securityalert/1076; http://www.acid-root.new.fr/advisories/npds510.txt
CVE: CVE-2006-2953
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in default.asp in OfficeFlow 2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the sqlType parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/officeflow-26-vuln.html; http://secunia.com/advisories/20545; http://securitytracker.com/id?1016255
CVE: CVE-2006-2954
Published: 2006-06-12
Description: SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/officeflow-26-vuln.html; http://secunia.com/advisories/20545; http://securitytracker.com/id?1016255
CVE: CVE-2006-2955
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in KAPhotoservice 7.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) New Category (newcategory) or (2) apage parameter to (a) edtalbum.asp, or the (3) cat or (4) albumid parameter to (b) album.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/kaphotoservice-75-vuln.html; http://secunia.com/advisories/20521; http://securitytracker.com/id?1016253
CVE: CVE-2006-2956
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in i.List 1.5 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) searchword parameter to search.php or (2) siteurl parameter to add.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20547; http://securitytracker.com/id?1016274; http://www.majorsecurity.de/advisory/major_rls10.txt
CVE: CVE-2006-2957
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in i.List 1.5 beta and earlier allows remote attackers to inject arbitrary web script or HTML via the banurl parameter to add.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20547; http://secunia.com/advisories/20547
CVE: CVE-2006-2958
Published: 2006-06-12
Description: Directory traversal vulnerability in FilZip 3.05 allows remote attackers to write arbitrary files via a .. (dot dot) in a (1) .rar, (2) .tar, (3) .jar, or (4) .gz file.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20543; http://www.securityfocus.com/bid/18375; http://www.vupen.com/english/advisories/2006/2255
CVE: CVE-2006-2959
Published: 2006-06-12
Description: SQL injection vulnerability in inc_header.asp in Snitz Forum 3.4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the %strCookieURL%.GROUP parameter in a cookie.
CVSS Score: 7.5 (HIGH)
References: http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62049; http://securityreason.com/securityalert/1075; http://securitytracker.com/id?1016267
CVE: CVE-2006-2960
Published: 2006-06-12
Description: PHP remote file inclusion vulnerability in includes/joomla.php in Joomla! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1074; http://securitytracker.com/id?1016269; http://www.securityfocus.com/archive/1/436707/100/0/threaded
CVE: CVE-2006-2961
Published: 2006-06-12
Description: Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20574; http://www.osvdb.org/26364; http://www.securityfocus.com/bid/18586
CVE: CVE-2006-2962
Published: 2006-06-12
Description: PHP remote file inclusion vulnerability in sql_fcnsOLD.php in Emergenices Personnel Information System (Empris) 20020923 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phormationdir parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18371; https://exchange.xforce.ibmcloud.com/vulnerabilities/27048; https://www.exploit-db.com/exploits/1895
CVE: CVE-2006-2963
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in Suchergebnisse.asp in Cabacos Web CMS 3.8.498 and earlier allows remote attackers to inject arbitrary web script or HTML via the suchtext parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20583; http://securitytracker.com/id?1016276; http://www.majorsecurity.de/advisory/major_rls13.txt
CVE: CVE-2006-2964
Published: 2006-06-12
Description: Multiple PHP remote file inclusion vulnerabilities in Xtreme Scripts Download Manager (aka Xtreme Downloads) 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) download.php, (2) manager.php, (3) admin/scripts/category.php, (4) includes/add_allow.php, (5) admin/index.php, and (6) admin/admin/login.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1072; http://www.osvdb.org/26643; http://www.osvdb.org/26644
CVE: CVE-2006-2965
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Particle Soft Particle Whois 1.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) the target parameter in index.php and (2) the "input box."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20490; http://securityreason.com/securityalert/1071; http://www.securityfocus.com/archive/1/436113/100/0/threaded
CVE: CVE-2006-2966
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in Particle Soft Particle Wiki 1.0.2 allows remote attackers to inject arbitrary web script or HTML via a BR element with an extraneous IMG tag and a STYLE attribute that contains "/**/" comment sequences, which bypasses the XSS protection scheme.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1070; http://www.securityfocus.com/archive/1/436121/100/0/threaded; http://www.vupen.com/english/advisories/2006/2170
CVE: CVE-2006-2967
Published: 2006-06-12
Description: Syworks SafeNET allows local users to bypass restrictions on network resource consumption by editing the policy.dat file.
CVSS Score: 2.1 (LOW)
References: http://securityreason.com/securityalert/1077; http://securitytracker.com/id?1016231; http://www.securityfocus.com/archive/1/436000/100/0/threaded
CVE: CVE-2006-2968
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in search.php in PHP Labware LabWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input box (query parameter).
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1092; http://securitytracker.com/id?1016227; http://www.attrition.org/pipermail/vim/2006-June/000845.html
CVE: CVE-2006-2969
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in L0j1k tinyMuw 0.1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the input box in quickchat.php, and possibly other manipulations.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20607; http://securityreason.com/securityalert/1091; http://www.securityfocus.com/archive/1/436640/100/0/threaded
CVE: CVE-2006-2970
Published: 2006-06-12
Description: videoPage.php in L0j1k tinyMuw 0.1.0 allows remote attackers to obtain sensitive information via a certain id parameter, probably with an invalid value, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1091; http://www.securityfocus.com/archive/1/436640/100/0/threaded; http://www.vupen.com/english/advisories/2006/2310
CVE: CVE-2006-2971
Published: 2006-06-12
Description: Integer overflow in the recv_packet function in 0verkill 0.16 allows remote attackers to cause a denial of service (daemon crash) via a UDP packet with fewer than 12 bytes, which results in a long length value to the crc32 function.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20551; http://securityreason.com/securityalert/1090; http://www.osvdb.org/26029
CVE: CVE-2006-2972
Published: 2006-06-12
Description: SQL injection vulnerability in vs_resource.php in Arantius Vice Stats 0.5b and 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20512; http://securityreason.com/securityalert/1073; http://www.arantius.com/topic/vice+stats
CVE: CVE-2006-2973
Published: 2006-06-12
Description: Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter.  NOTE: this might be a duplicate of CVE-2005-4009.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/1089; http://www.securityfocus.com/archive/1/436334/100/0/threaded; http://www.securityfocus.com/bid/18314
CVE: CVE-2006-2974
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 6.1.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) errCode and (2) uid parameter in (a) default.asp and (3) dname parameter in (b) /admin/dns.asp and (c) /additional/regdomain_done.asp.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20516; http://securitytracker.com/id?1016237; http://www.vupen.com/english/advisories/2006/2213
CVE: CVE-2006-2975
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in pblguestbook.php in PBL Guestbook 1.31 allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of IMG tags in the (1) name, (2) email, and (3) website parameter, which bypasses XSS protection mechanisms that check for SCRIPT tags but not IMG.  NOTE: portions of this description's details are obtained from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20526; http://securityreason.com/securityalert/1088; http://www.securityfocus.com/archive/1/436408/100/0/threaded
CVE: CVE-2006-2976
Published: 2006-06-12
Description: Unspecified vulnerability in usermgr.php in Coppermine Photo Gallery before 1.4.7 has unknown impact and remote attack vectors, possibly related to authorization/authentication errors.
CVSS Score: 7.5 (HIGH)
References: http://coppermine-gallery.net/forum/index.php?topic=32333.0; http://secunia.com/advisories/20465; http://sourceforge.net/project/shownotes.php?release_id=423104&group_id=89658
CVE: CVE-2006-2977
Published: 2006-06-12
Description: SQL injection vulnerability in big.php in Mafia Moblog 0.6M1 and earlier allows remote attackers to execute arbitrary SQL commands via the img parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/20529; http://securityreason.com/securityalert/1078; http://www.securityfocus.com/archive/1/436410/100/0/threaded
CVE: CVE-2006-2978
Published: 2006-06-12
Description: Mafia Moblog 0.6M1 and earlier allows remote attackers to obtain the installation path in an error message via a direct request to (1) big.php and (2) upgrade.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20529; http://securityreason.com/securityalert/1078; http://www.securityfocus.com/archive/1/436410/100/0/threaded
CVE: CVE-2006-2979
Published: 2006-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Free 2.5.5, and possibly other distributions including Light, Standard, and Enterprise, allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id parameter in forum.php, which is not properly handled in block_forum_topics.php, and (2) item_id parameter in reviews.php, which is not properly handled in block_reviews.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20538; http://securityreason.com/securityalert/1087; http://www.attrition.org/pipermail/vim/2006-June/000846.html
CVE: CVE-2006-2980
Published: 2006-06-12
Description: SQL injection vulnerability in block_forum_topic_new.php in ViArt Shop Free 2.5.5, and possibly other distributions including Light, Standard, and Enterprise, might allow remote attackers to execute arbitrary SQL commands via unknown vectors, probably involving the forum_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-June/000846.html; http://www.codetosell.com/downloads/xss_fix.zip; https://exchange.xforce.ibmcloud.com/vulnerabilities/27684
CVE: CVE-2006-2981
Published: 2006-06-12
Description: SQL injection vulnerability in vs_search.php in Arantius Vice Stats before 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2006-2972.
CVSS Score: 7.5 (HIGH)
References: http://www.arantius.com/topic/vice+stats; http://www.attrition.org/pipermail/vim/2006-June/000848.html; http://www.arantius.com/topic/vice+stats
CVE: CVE-2006-2908
Published: 2006-06-13
Description: The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20371; http://secunia.com/secunia_research/2006-40/advisory/; http://securityreason.com/securityalert/1086
CVE: CVE-2006-2982
Published: 2006-06-13
Description: Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in (1) footer.php and (2) admin/footer.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20522; http://securitytracker.com/id?1016258; http://www.osvdb.org/26266
CVE: CVE-2006-2983
Published: 2006-06-13
Description: PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in cal.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/26418; http://www.vupen.com/english/advisories/2006/2219; http://www.osvdb.org/26418
CVE: CVE-2006-2984
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in index.php in IntegraMOD 1.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the STYLE_URL parameter.  NOTE: it is possible that this issue is resultant from SQL injection.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20528; http://securityreason.com/securityalert/1085; http://www.securityfocus.com/archive/1/436457/100/0/threaded
CVE: CVE-2006-2985
Published: 2006-06-13
Description: SQL injection vulnerability in index.php in IntegraMOD 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded "'" characters in the STYLE_URL parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1085; http://www.attrition.org/pipermail/vim/2006-June/000847.html; http://www.securityfocus.com/archive/1/436457/100/0/threaded
CVE: CVE-2006-2986
Published: 2006-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Baby Katie Media (a) very Simple Car Lister (vSCAL) 1.0 and (b) very simple Realty Lister (vsREAL) 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) lid parameter in index.php and the (2) title parameter in myslideshow.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20533; http://securityreason.com/securityalert/1084; http://www.securityfocus.com/archive/1/436411/100/0/threaded
CVE: CVE-2006-2987
Published: 2006-06-13
Description: Multiple SQL injection vulnerabilities in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) voteid, and (3) vfiel parameters to (a) index.php, and via the (4) nick, (5) email, (6) city, (7) messen, and (8) message form field parameters to (b) add.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20414/; http://www.vupen.com/english/advisories/2006/2118; https://exchange.xforce.ibmcloud.com/vulnerabilities/27017
CVE: CVE-2006-2988
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in dictionary.php in Chemical Dictionary allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a browse action.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20540; http://securityreason.com/securityalert/1083; http://www.securityfocus.com/archive/1/436412/100/0/threaded
CVE: CVE-2006-2989
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in listpics.asp in ASP ListPics 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the info parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/asp-listpics-43-xss-vuln.html; http://secunia.com/advisories/20517; http://www.securityfocus.com/bid/18438
CVE: CVE-2006-2990
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in default.asp in VanillaSoft Helpdesk 2005 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/vanillasoft-helpdesk-xss-vuln.html; http://secunia.com/advisories/20544; http://securitytracker.com/id?1016254
CVE: CVE-2006-2991
Published: 2006-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ringlink 3.2 allow remote attackers to inject arbitrary web script or HTML via a JavaScript URI in the SRC attribute of an IMG element, and possibly other manipulations, in the ringid parameter in (1) next.cgi, (2) stats.cgi, or (3) list.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20590; http://securityreason.com/securityalert/1082; http://www.osvdb.org/26318
CVE: CVE-2006-2992
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in display.asp in My Photo Scrapbook 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the key_m parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/my-photo-scrapbook-vuln.html; http://secunia.com/advisories/20554; http://www.osvdb.org/26280
CVE: CVE-2006-2993
Published: 2006-06-13
Description: Multiple SQL injection vulnerabilities in My Photo Scrapbook 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the key parameter in (1) Displayview.asp and (2) Details_Photo_bv.asp.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/my-photo-scrapbook-vuln.html; http://secunia.com/advisories/20554; http://www.osvdb.org/26281
CVE: CVE-2006-2994
Published: 2006-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in phazizGuestbook 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, (3) url fields, and (4) text field (content parameter).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20615; http://securityreason.com/securityalert/1081; http://www.securityfocus.com/archive/1/436602/100/0/threaded
CVE: CVE-2006-2995
Published: 2006-06-13
Description: Multiple PHP remote file inclusion vulnerabilities in WebprojectDB 0.1.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INCDIR parameter in (1) include/nav.php and (2) include/lang.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20568; http://www.osvdb.org/26339; http://www.osvdb.org/26340
CVE: CVE-2006-2996
Published: 2006-06-13
Description: PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dir[data] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20588; http://www.securityfocus.com/bid/18370; http://www.vupen.com/english/advisories/2006/2274
CVE: CVE-2006-2997
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in ZMS 2.9 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the raw parameter in the search field.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20585; http://securityreason.com/securityalert/1093; http://securitytracker.com/id?1016275
CVE: CVE-2006-2998
Published: 2006-06-13
Description: PHP remote file inclusion vulnerability in board/post.php in free QBoard 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20569; http://www.securityfocus.com/bid/18373; http://www.vupen.com/english/advisories/2006/2273
CVE: CVE-2006-2999
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in search.php in OkScripts QuickLinks 1.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20594; http://securityreason.com/securityalert/1080; http://www.securityfocus.com/archive/1/436561
CVE: CVE-2006-3000
Published: 2006-06-13
Description: Cross-site scripting (XSS) vulnerability in search.php in OkScripts OkArticles 1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20593; http://securityreason.com/securityalert/1080; http://www.securityfocus.com/archive/1/436561