rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1723 
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1724 
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1725 
Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 causes certain windows to become translucent due to an interaction between XUL content windows and the history mechanism, which might allow user-assisted remote attackers to trick users into executing arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1726 
Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1727 
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1728 
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1729 
Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1730 
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1731 
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1732 
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to bypass same-origin protections and conduct cross-site scripting (XSS) attacks via unspecified vectors involving the window.controllers array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1733 
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1734 
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the "clone parent" internal function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1735 
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1736 
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable, which causes the executable to be saved when the user clicks the "Save image as..." option.  NOTE: this attack is made easier due to a GUI truncation issue that prevents the user from seeing the malicious extension when there is extra whitespace in the filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1737 
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T18:00:00.000Z
CVE-2006-1738 
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T18:00:00.000Z
CVE-2006-1739 
The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1740 
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1741 
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1742 
The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage collected, which might allow remote attackers to trigger operations on freed memory and cause memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T10:00:00.000Z
CVE-2006-1743 
Multiple SQL injection vulnerabilities in form.php in JBook 1.4 allow remote attackers to execute arbitrary SQL commands via the (1) nom or (2) mail parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1744 
Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1745 
Cross-site scripting (XSS) vulnerability in login.php in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the error parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1746 
Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALS[database_module] or (2) GLOBALS[language_module] parameters, which overwrite the underlying $GLOBALS variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1747 
PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to (1) admin/admin.php, (2) war.php, (3) stats.php, (4) news.php, (5) joinus.php, (6) challenge.php, (7) calendar.php, (8) member.php, (9) popup.php, and other unspecified scripts in the admin folder.  NOTE: these are different attack vectors than CVE-2006-1636 and CVE-2006-1503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1748 
Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1749 
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter.  NOTE: this issue was later reported to affect 2.01 as well.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1750 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Autogallery 0.41 allow remote attackers to inject arbitrary web script or HTML via the (1) pic or (2) show parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1751 
Multiple SQL injection vulnerabilities in MvBlog before 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1752 
Multiple cross-site scripting (XSS) vulnerabilities in the backend in MvBlog before 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) body fields in a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-12T22:00:00.000Z
CVE-2006-1753 
A cron job in fcheck before 2.7.59 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T20:00:00.000Z
CVE-2006-1754 
SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute arbitrary SQL commands via the SID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T00:00:00.000Z
CVE-2006-1755 
SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1756 
MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1757 
Cross-site scripting (XSS) vulnerability in index.php in Vegadns 0.99 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1758 
SQL injection vulnerability in index.php in Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1759 
Cross-site scripting (XSS) vulnerability in allgemein_transfer.php in SWSoft Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the jahr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1760 
Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) Classic.view/thumbnail.php, (2) Classic.view/gallery.php, (3) Classic.view/detail.php, or (4) Orange.view/detail.php; or (5) the name parameter in Orange.view/slideshow.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1761 
Cross-site scripting vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter, which is not sanitized in the error message. NOTE: the vector in the shard parameter is not XSS and has been assigned a separate name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1762 
Directory traversal vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to include arbitrary files via the shard parameter.  NOTE: this issue can be exploited to produce resultant XSS when the parameter has XSS manipulations, and path disclosure with other invalid values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1763 
Multiple SQL injection vulnerabilities in index.php in blur6ex 0.3.452 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a (1) g_reply or (2) g_permaPost action to the blog shard (engine/shards/blog.php), or a (3) g_viewContent action to the content shard (engine/shards/content.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1764 
Hosting Controller 6.1 stores forum/db/forum.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as user name and password credentials.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T01:00:00.000Z
CVE-2006-1765 
Cross-site scripting (XSS) vulnerability in index.php in JBook 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1766 
Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) getlang and (2) reporeid parameter in (a) index.php, (3) menuid parameter in (b) plugin.php and (c) forumthread.php, and (4) msgid parameter in forumthread.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1767 
Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1768 
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_name, (2) newuser_email, and (3) newuser_hp parameters in the faction=register mode in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1769 
Multiple cross-site scripting (XSS) vulnerabilities in UserLand Manila 9.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the mode parameter in msgReader$1 and (2) the end of the URI in viewDepartment$.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1770 
Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execute arbitrary PHP code via a URL in the int_path parameter in (1) vote.php, (2) view.php, (3) admin.php, and (4) admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1771 
Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) allows remote attackers to read arbitrary files and possibly execute arbitrary programs via a .. (dot dot) in the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1772 
debconf in Debian GNU/Linux, when configuring mnogosearch in the mnogosearch-common 3.2.31-1 package, uses the world-readable config.dat file instead of the restricted passwords.dat for storing the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, which allows local users to view the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1773 
SQL injection vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to execute arbitrary SQL commands via the contentid parameter, possibly involving content/news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1774 
HP System Management Homepage (SMH) 2.1.3.132, when running on CompaqHTTPServer/9.9 on Windows, Linux, or Tru64 UNIX, and when "Trust by Certificates" is not enabled, allows remote attackers to bypass authentication via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1775 
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.19 allow remote attackers to inject arbitrary web script or HTML via the (1) Site Description field in (a) admin_board.php, the (2) Group name and (3) Group description fields in (b) admin_groups.php and (c) groupcp.php, the (4) Theme Name field in (d) admin_styles.php, and the (5) Rank Title field in (e) admin_ranks.php.  NOTE: the profile.php/Current password vector is already covered by CVE-2006-1603.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1776 
PHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1777 
Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1778 
Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) blogid parameter in (a) index.php and (b) archive.php, the (2) m and (3) y parameters in archive.php, and the (4) sql parameter in (c) server.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1779 
Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1780 
The Bourne shell (sh) in Solaris 8, 9, and 10 allows local users to cause a denial of service (sh crash) via an unspecified attack vector that causes sh processes to crash during creation of temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1781 
PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.  NOTE: It was later reported that 1.4.2 and earlier are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z