deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0677
Published: 2007-02-03
Description: PHP remote file inclusion vulnerability in fw/class.Quick_Config_Browser.php in Cadre PHP Framework 20020724 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][framework_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv63-y3dips-2007.txt; http://osvdb.org/33631; http://securityreason.com/securityalert/2215
CVE: CVE-2007-0678
Published: 2007-02-03
Description: SQL injection vulnerability in windows.asp in Fullaspsite Asp Hosting Sitesi allows remote attackers to execute arbitrary SQL commands via the kategori_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36041; http://www.securityfocus.com/bid/22347; http://www.vupen.com/english/advisories/2007/0453
CVE: CVE-2007-0679
Published: 2007-02-03
Description: PHP remote file inclusion vulnerability in lang/leslangues.php in Nicolas Grandjean PHPMyRing 4.1.3b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fichier parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36039; http://www.securityfocus.com/bid/22345; http://www.vupen.com/english/advisories/2007/0448
CVE: CVE-2007-0680
Published: 2007-02-03
Description: PHP remote file inclusion vulnerability in includes/functions.php in Phpbb Tweaked 3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33079; http://secunia.com/advisories/24001; http://www.securityfocus.com/bid/22344
CVE: CVE-2007-0681
Published: 2007-02-03
Description: profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://osvdb.org/38130; https://exchange.xforce.ibmcloud.com/vulnerabilities/32035; https://www.exploit-db.com/exploits/3239
CVE: CVE-2007-0682
Published: 2007-02-03
Description: PHP remote file inclusion vulnerability in theme/include_mode/template.php in JV2 Folder Gallery 3.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the galleryfilesdir parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33077; http://secunia.com/advisories/24012; http://www.securityfocus.com/bid/22354
CVE: CVE-2007-0683
Published: 2007-02-03
Description: PHP remote file inclusion vulnerability in includes/functions.php in Omegaboard 1.0beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2782&w=2; http://www.securityfocus.com/archive/1/458825/100/0/threaded; http://www.securityfocus.com/bid/22355
CVE: CVE-2007-0684
Published: 2007-02-03
Description: PHP remote file inclusion vulnerability in portal.php in Cerulean Portal System 0.7b allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/458824/100/0/threaded; http://www.securityfocus.com/bid/22356; http://www.vupen.com/english/advisories/2007/0444
CVE: CVE-2007-0685
Published: 2007-02-03
Description: Internet Explorer on Windows Mobile 5.0 and Windows Mobile 2003 and 2003SE for Smartphones and PocketPC allows attackers to cause a denial of service (application crash and device instability) via unspecified vectors, possibly related to a buffer overflow.
CVSS Score: 2.6 (LOW)
References: http://blog.trendmicro.com/trend-micro-finds-more-windows-mobile-flaws/; http://osvdb.org/36149; http://www.securityfocus.com/bid/22343
CVE: CVE-2007-0686
Published: 2007-02-03
Description: The Intel 2200BG 802.11 Wireless Mini-PCI driver 9.0.3.9 (w29n51.sys) allows remote attackers to cause a denial of service (system crash) via crafted disassociation packets, which triggers memory corruption of "internal kernel structures," a different vulnerability than CVE-2006-6651.  NOTE: this issue might overlap CVE-2006-3992.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/37996; https://www.exploit-db.com/exploits/3224; http://osvdb.org/37996
CVE: CVE-2007-0687
Published: 2007-02-03
Description: SQL injection vulnerability in i-search.php in Michelle's L2J Dropcalc 4 and earlier allows remote authenticated users to execute arbitrary SQL commands via the itemid parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/36038; http://www.securityfocus.com/bid/22335; https://exchange.xforce.ibmcloud.com/vulnerabilities/32003
CVE: CVE-2007-0688
Published: 2007-02-03
Description: SQL injection vulnerability in oku.asp in Hunkaray Duyuru Scripti allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34086; http://secunia.com/advisories/25581; http://www.securityfocus.com/archive/1/470744/100/0/threaded
CVE: CVE-2007-0695
Published: 2007-02-03
Description: Multiple SQL injection vulnerabilities in Free LAN In(tra|ter)net Portal (FLIP) before 1.0-RC3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: some sources mention the escape_sqlData, implode_sql, and implode_sqlIn functions, but these are protection schemes, not the vulnerable functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/33649; http://sourceforge.net/project/shownotes.php?release_id=481131&group_id=98260; http://www.attrition.org/pipermail/vim/2007-February/001282.html
CVE: CVE-2007-0696
Published: 2007-02-03
Description: Cross-site scripting (XSS) vulnerability in error messages in Free LAN In(tra|ter)net Portal (FLIP) before 1.0-RC3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, different vectors than CVE-2007-0611.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33650; http://sourceforge.net/project/shownotes.php?release_id=481131&group_id=98260; http://www.vupen.com/english/advisories/2007/0454
CVE: CVE-2007-0697
Published: 2007-02-03
Description: index2.php in ACGVannu 1.3 and earlier allows remote attackers to change the password or profile of a user via a modified id parameter, related to templates/modif.html.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/33115; http://secunia.com/advisories/24072; http://www.securityfocus.com/bid/22279
CVE: CVE-2007-0698
Published: 2007-02-03
Description: Multiple SQL injection vulnerabilities in ACGVannu 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via the id_mod parameter to templates/modif.html, and other unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/34666; http://www.vupen.com/english/advisories/2007/0388; https://exchange.xforce.ibmcloud.com/vulnerabilities/32257
CVE: CVE-2007-0472
Published: 2007-02-03
Description: Multiple race conditions in Smb4K before 0.8.0 allow local users to (1) modify arbitrary files via unspecified manipulations of Smb4K's lock file, which is not properly handled by the remove_lock_file function in core/smb4kfileio.cpp, and (2) add lines to the sudoers file via a symlink attack on temporary files, which isn't properly handled by the writeFile function in core/smb4kfileio.cpp.
CVSS Score: 3.7 (LOW)
References: http://developer.berlios.de/bugs/?func=detailbug&bug_id=9630&group_id=769; http://developer.berlios.de/project/shownotes.php?release_id=11706; http://developer.berlios.de/project/shownotes.php?release_id=11902
CVE: CVE-2007-0473
Published: 2007-02-03
Description: The writeFile function in core/smb4kfileio.cpp in Smb4K before 0.8.0 does not preserve /etc/sudoers permissions across modifications, which allows local users to obtain sensitive information (/etc/sudoers contents) by reading this file.
CVSS Score: 1.9 (LOW)
References: http://developer.berlios.de/bugs/?func=detailbug&bug_id=9630&group_id=769; http://developer.berlios.de/project/shownotes.php?release_id=11706; http://developer.berlios.de/project/shownotes.php?release_id=11902
CVE: CVE-2007-0474
Published: 2007-02-03
Description: Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to kill arbitrary processes, related to a "design issue with smb4k_kill."
CVSS Score: 3.3 (LOW)
References: http://developer.berlios.de/bugs/?func=detailbug&bug_id=9631&group_id=769; http://developer.berlios.de/project/shownotes.php?release_id=11706; http://developer.berlios.de/project/shownotes.php?release_id=11902
CVE: CVE-2007-0475
Published: 2007-02-03
Description: Multiple stack-based buffer overflows in utilities/smb4k_*.cpp in Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to gain privileges via unspecified vectors related to the args variable and unspecified other variables, in conjunction with the sudo configuration.
CVSS Score: 4.4 (MEDIUM)
References: http://developer.berlios.de/bugs/?func=detailbug&bug_id=9631&group_id=769; http://developer.berlios.de/project/shownotes.php?release_id=11706; http://developer.berlios.de/project/shownotes.php?release_id=11902
CVE: CVE-2006-6966
Published: 2007-02-04
Description: phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures[] parameter to index.php.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpGraphy.
CVSS Score: 7.5 (HIGH)
References: http://phpgraphy.sourceforge.net/changelog.php; http://retrogod.altervista.org/phpgraphy_0912_zhdkoi_cmd.html; http://securitytracker.com/id?1017571
CVE: CVE-2006-6967
Published: 2007-02-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: None.  Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE).  In addition, it describes standard behavior (publication of revocation lists) and as such does not cross privilege boundaries.  Notes: the former description is: "Check Point FireWall-1 allows remote attackers to obtain certificate revocation lists (CRLs) and other unspecified sensitive information via an HTTP request for the top-level URI on the internal certificate authority (ICA) port (18264/tcp).
CVE: CVE-2007-0436
Published: 2007-02-04
Description: Barron McCann X-Kryptor Driver BMS1446HRR (Xgntr BMS1351 Install BMS1472) in X-Kryptor Secure Client does not drop privileges when launching an Explorer window in response to a help command, which allows local users to gain LocalSystem privileges via interactive use of Explorer.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/niscc/NISCC-462660/index.html; http://osvdb.org/33110; http://secunia.com/advisories/24045
CVE: CVE-2007-0699
Published: 2007-02-04
Description: PHP remote file inclusion vulnerability in includes/includes.php in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web, PwP) before 2.5.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33633; http://securityreason.com/securityalert/2223; http://sourceforge.net/project/shownotes.php?release_id=480538&group_id=178400
CVE: CVE-2007-0700
Published: 2007-02-04
Description: Directory traversal vulnerability in index.php in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web, PwP) allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.  NOTE: this issue was later reported for 2.5.1.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/33634; http://www.attrition.org/pipermail/vim/2007-February/001269.html; http://www.attrition.org/pipermail/vim/2007-February/001280.html
CVE: CVE-2007-0701
Published: 2007-02-04
Description: PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31938; http://secunia.com/advisories/24003; http://www.attrition.org/pipermail/vim/2007-February/001266.html
CVE: CVE-2007-0702
Published: 2007-02-04
Description: Multiple PHP remote file inclusion vulnerabilities in phpEventMan 1.0.2 allow remote attackers to execute arbitrary PHP code via a URL in the level parameter to (1) Shared/controller/text.ctrl.php or (2) UserMan/controller/common.function.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31936; http://osvdb.org/31937; http://secunia.com/advisories/24000
CVE: CVE-2007-0703
Published: 2007-02-04
Description: PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[core][module_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33607; http://www.attrition.org/pipermail/vim/2007-February/001267.html; http://www.vupen.com/english/advisories/2007/0458
CVE: CVE-2007-0704
Published: 2007-02-04
Description: PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter, a different vector than CVE-2006-4669.  NOTE: the documentation says to remove install.php after installation.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33608; http://www.attrition.org/pipermail/vim/2007-February/001265.html; https://www.exploit-db.com/exploits/2329
CVE: CVE-2007-0705
Published: 2007-02-04
Description: Cross-zone scripting vulnerability in Sleipnir 2.49 and earlier, and Portable Sleipnir 2.45 and earlier, allows remote attackers to bypass Web content zone restrictions via certain script contained in RSS data.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/32977; http://secunia.com/advisories/23927
CVE: CVE-2007-0706
Published: 2007-02-04
Description: Cross-zone scripting vulnerability in Darksky RSS bar for Internet Explorer before 1.29, RSS bar for Sleipnir before 1.29, and RSS bar for unDonut before 1.29 allows remote attackers to bypass Web content zone restrictions via certain script contained in RSS data.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://www.fenrir.co.jp/press/20070126_2.html; http://www.vupen.com/english/advisories/2007/0365
CVE: CVE-2007-0707
Published: 2007-02-04
Description: Stack-based buffer overflow in GOM Player 2.0.12.3375 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the "ref href" tag.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33080; http://secunia.com/advisories/23994; http://www.gomplayer.com/forum/viewtopic.html?t=221
CVE: CVE-2007-0708
Published: 2007-02-04
Description: cmdmon.sys in Comodo Firewall Pro (formerly Comodo Personal Firewall) before 2.4.16.174 does not validate arguments that originate in user mode for the (1) NtConnectPort and (2) NtCreatePort hooked SSDT functions, which allows local users to cause a denial of service (system crash) and possibly gain privileges via invalid arguments.
CVSS Score: 7.2 (HIGH)
References: http://securitytracker.com/id?1017580; http://www.matousec.com/info/advisories/Comodo-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php; http://www.securityfocus.com/archive/1/458773/100/0/threaded
CVE: CVE-2007-0709
Published: 2007-02-04
Description: cmdmon.sys in Comodo Firewall Pro (formerly Comodo Personal Firewall) 2.4.16.174 and earlier does not validate arguments that originate in user mode for the (1) NtCreateSection, (2) NtOpenProcess, (3) NtOpenSection, (4) NtOpenThread, and (5) NtSetValueKey hooked SSDT functions, which allows local users to cause a denial of service (system crash) and possibly gain privileges via invalid arguments.
CVSS Score: 7.2 (HIGH)
References: http://securitytracker.com/id?1017580; http://www.matousec.com/info/advisories/Comodo-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php; http://www.securityfocus.com/archive/1/458773/100/0/threaded
CVE: CVE-2007-0555
Published: 2007-02-06
Description: PostgreSQL 7.3 before 7.3.13, 7.4 before 7.4.16, 8.0 before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 allows attackers to disable certain checks for the data types of SQL function arguments, which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content.
CVSS Score: 8.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://fedoranews.org/cms/node/2554; http://lists.rpath.com/pipermail/security-announce/2007-February/000141.html
CVE: CVE-2007-0556
Published: 2007-02-06
Description: The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.
CVSS Score: 6.6 (MEDIUM)
References: http://fedoranews.org/cms/node/2554; http://lists.rpath.com/pipermail/security-announce/2007-February/000141.html; http://osvdb.org/33302
CVE: CVE-2006-6968
Published: 2007-02-06
Description: Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/34729; http://www.phorum.org/phorum5/read.php?12%2C119757; http://www.vupen.com/english/advisories/2007/0410
CVE: CVE-2007-0452
Published: 2007-02-06
Description: smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://fedoranews.org/cms/node/2579; http://fedoranews.org/cms/node/2580
CVE: CVE-2007-0453
Published: 2007-02-06
Description: Buffer overflow in the nss_winbind.so.1 library in Samba 3.0.21 through 3.0.23d, as used in the winbindd daemon on Solaris, allows attackers to execute arbitrary code via the (1) gethostbyname and (2) getipnodebyname functions.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/33098; http://secunia.com/advisories/24043; http://secunia.com/advisories/24101
CVE: CVE-2007-0454
Published: 2007-02-06
Description: Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://osvdb.org/33101; http://secunia.com/advisories/24021; http://secunia.com/advisories/24046
CVE: CVE-2007-0756
Published: 2007-02-06
Description: Chicken of the VNC (cotv) 2.0 allows remote attackers to cause a denial of service (application crash) via a large computer-name size value in a ServerInit packet, which triggers a failed malloc and a resulting NULL dereference.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33637; http://securityreason.com/securityalert/2220; http://www.securityfocus.com/archive/1/458907/100/0/threaded
CVE: CVE-2007-0757
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in index.php in Miguel Nunes Call of Duty 2 (CoD2) DreamStats System 4.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33095; http://secunia.com/advisories/24037; http://www.attrition.org/pipermail/vim/2007-February/001272.html
CVE: CVE-2007-0758
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in lang.php in PHPProbid 5.24 allows remote attackers to execute arbitrary PHP code via a URL in the SRC attribute of an HTML element in the lang parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34667; http://www.securityfocus.com/bid/22374; https://exchange.xforce.ibmcloud.com/vulnerabilities/32273
CVE: CVE-2007-0759
Published: 2007-02-06
Description: Multiple SQL injection vulnerabilities in EasyMoblog 0.5.1 allow remote attackers to execute arbitrary SQL commands via the (1) i or (2) post_id parameter to add_comment.php, which triggers an injection in libraries.inc.php; or (3) the i parameter to list_comments.php, which triggers an injection in libraries.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0052.html; http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0054.html; http://osvdb.org/33636
CVE: CVE-2007-0760
Published: 2007-02-06
Description: EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an admin/ URL, which allows remote attackers to read or modify account names and passwords via a spoofed Referer.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33112; http://secunia.com/advisories/24038; http://www.securityfocus.com/bid/20805
CVE: CVE-2007-0761
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter (ezconvert) 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the ezconvert_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33645; http://www.attrition.org/pipermail/vim/2007-February/001278.html; http://www.vupen.com/english/advisories/2007/0473
CVE: CVE-2007-0762
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33092; http://secunia.com/advisories/24034; http://www.attrition.org/pipermail/vim/2007-February/001279.html
CVE: CVE-2007-0763
Published: 2007-02-06
Description: Cross-site scripting (XSS) vulnerability in the news comment functionality in F3Site 2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the Autor field.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34668; http://www.securityfocus.com/bid/22379; https://exchange.xforce.ibmcloud.com/vulnerabilities/32188
CVE: CVE-2007-0764
Published: 2007-02-06
Description: Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload and execute arbitrary PHP scripts via GIF86 header in a file in the uplf parameter, which can be later accessed via a relative pathname in the dir parameter in adm.php.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/34669; https://exchange.xforce.ibmcloud.com/vulnerabilities/32189; https://www.exploit-db.com/exploits/3255