rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1911 
Cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.1 allows remote attackers to inject arbitrary web script or HTML via the attachment content disposition in an HTML attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1912 
MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting (XSS) or SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1913 
Cross-site scripting (XSS) vulnerability in jax_guestbook.php in Jax Guestbook 3.1, 3.31, and 3.50 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1914 
DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid (1) fcategoryid parameter to topics.php or (2) unavariabile, (3) GLOBALS, or (4) _SERVER[] parameters to script.php.  NOTE: this information leak might be resultant from a global variable overwrite issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1915 
SQL injection vulnerability in topics.php in DbbS 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the fcategoryid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1916 
Multiple cross-site scripting (XSS) vulnerabilities in profile.php in DbbS 2.0-alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ulocation or (2) uhobbies parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1917 
SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1918 
Multiple cross-site scripting (XSS) vulnerabilities in Papoo 2.1.5 allow remote attackers to inject arbitrary web script or HTML via the menuid parameter to (1) index.php or (2) forum.php, or the (3) reporeid_print parameter to print.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1919 
PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1920 
SQL injection vulnerability in index.php in PMTool 1.2.2 allows remote attackers to execute arbitrary SQL commands via the order parameter in the include files (1) user.inc.php, (2) customer.inc.php, and (3) project.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1921 
nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1922 
PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1923 
Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) RSS/RSS.php and (2) possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1924 
SQL injection vulnerability in functions/db_api.php in LinPHA 1.1.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1925 
Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action.  NOTE: this can also produce resultant XSS when the target file does not exist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1926 
SQL injection vulnerability in showtopic.php in ThWboard 2.84 beta 3 and earlier allows remote attackers to execute arbitrary SQL commands via the pagenum parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1927 
Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 or Cisco 12000 series routers, allows remote attackers to cause a denial of service (Line card crash) via certain MPLS packets, as identified by Cisco bug ID CSCsc77475.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1928 
Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 routers, allows remote attackers to cause a denial of service (Modular Services Cards (MSC) crash or "MPLS packet handling problems") via certain MPLS packets, as identified by Cisco bug IDs (1) CSCsd15970 and (2) CSCsd55531.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1929 
PHP remote file inclusion vulnerability in include/common.php in I-Rater Platinum allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1930 
Multiple SQL injection vulnerabilities in userscript.php in Green Minute 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) huserid, (2) pituus, or (3) date parameters. NOTE: this issue has been disputed by the vendor, saying "those parameters mentioned ARE checked (preg_match) before they are used in SQL-query...  If someone decided to add SQL-injection stuff to certain parameter, they would see an error text, but only because _nothing_ was passed inside that parameter (to MySQL-database)."  As allowed by the vendor, CVE investigated this report on 20060525 and found that the demo site demonstrated a non-sensitive SQL error when given standard SQL injection manipulations
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1931 
The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T21:00:00.000Z
CVE-2006-1932 
Off-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1933 
Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (large or infinite loops) viarafted packets to the (1) UMA and (2) BER dissectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1934 
Multiple buffer overflows in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) ALCAP dissector, (2) Network Instruments file code, or (3) NetXray/Windows Sniffer file code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1935 
Buffer overflow in Ethereal 0.9.15 up to 0.10.14 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the COPS dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1936 
Buffer overflow in Ethereal 0.8.5 up to 0.10.14 allows remote attackers to execute arbitrary code via the telnet dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1937 
Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) multiple vectors in H.248, and the (2) X.509if, (3) SRVLOC, (4) H.245, (5) AIM, and (6) general packet dissectors; and (7) the statistics counter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1938 
Multiple unspecified vulnerabilities in Ethereal 0.8.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via the (1) Sniffer capture or (2) SMB PIPE dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1939 
Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) an invalid display filter, or the (2) GSM SMS, (3) ASN.1-based, (4) DCERPC NT, (5) PER, (6) RPC, (7) DCERPC, and (8) ASN.1 dissectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1940 
Unspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows remote attackers to cause a denial of service (abort) via the SNDCP dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T10:00:00.000Z
CVE-2006-1941 
Neon Responder 5.4 for LANsurveyor allows remote attackers to cause a denial of service (application outage) via a crafted Clock Synchronisation packet that triggers an access violation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1942 
Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1943 
Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in edit.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1944 
Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1945 
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter.  NOTE: this might be the same core issue as CVE-2005-2732.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1946 
Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1947 
Multiple SQL injection vulnerabilities in plexum.php in NicPlex Plexum X5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pagesize, (2) maxrec, and (3) startpos parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1948 
The "Add Sender to Address Book" operation (AddSenderToAddressBook.lss) and NameHelper.lss in IBM Lotus Notes 6.0 and 6.5 before 20060331 do not properly store information in the Personal Address Book when multiple messages are checked and a message uses AltFrom, which might allow user-assisted remote attackers to trick a user into sending e-mail to an unauthorized recipient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1949 
SQL injection vulnerability in plexcart.pl in NicPlex PlexCart X3 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1950 
Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T22:00:00.000Z
CVE-2006-1951 
Directory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to download arbitrary files via a crafted GET request including "....//" sequences, which are collapsed into "../" sequences by filtering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-24T23:00:00.000Z
CVE-2006-1952 
Directory traversal vulnerability in WinAgents TFTP Server for Windows 3.1 and earlier allows remote attackers to read arbitrary files via "..." (triple dot) sequences in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-24T23:00:00.000Z
CVE-2006-1953 
Directory traversal vulnerability in Caucho Resin 3.0.17 and 3.0.18 for Windows allows remote attackers to read arbitrary files via a "C:%5C" (encoded drive letter) in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-17T10:00:00.000Z
CVE-2006-1954 
SQL injection vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the User field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1955 
PHP remote file inclusion vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1956 
The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1957 
The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1958 
Multiple SQL injection vulnerabilities in WWWThreads RC 3 allow remote attackers to execute arbitrary SQL commands via (1) the forumreferrer cookie to register.php and (2) the messages parameter in message_list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1959 
PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Server 8.23 and earlier allows remote attackers to execute arbitrary code via a URL in the rf parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1960 
Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to archiveApplyDisplay.jsp, aka bug ID CSCsc01095.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1961 
Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE).  NOTE: other issues might be addressed by the Cisco advisory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1962 
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1963 
Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." (dot dot) in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1964 
SQL injection vulnerability in Haberler.asp in ASPSitem 1.83 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1965 
Multiple cross-site scripting (XSS) vulnerabilities in aasi media Net Clubs Pro 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) onuser, (2) pass, (3) chatsys, (4) room, (5) username, and (6) to parameters in (a) sendim.cgi; the (7) username parameter in (b) imessage.cgi; the (8) password parameter in (c) login.cgi; and the (9) cat_id parameter in (d) viewcat.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1966 
An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port (TCP port 25), as demonstrated by a 10-microsecond wait between sending packets.  NOTE: this issue has been disputed in followup posts that suggest that a protection feature is triggering a RST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1967 
Cross-site scripting (XSS) vulnerability in calendar/Visitor.cgi in KCScripts Calendar, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1968 
Cross-site scripting (XSS) vulnerability in news/NsVisitor.cgi in KCScripts News Publisher, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1969 
Cross-site scripting (XSS) vulnerability in search/search.cgi in an unspecified KCScripts script, probably Search Engine or Site Search, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1970 
Cross-site scripting (XSS) vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1971 
Cross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1972 
Cross-site scripting (XSS) vulnerability in EasyGallery.php in Wingnut EasyGallery allows remote attackers to inject arbitrary web script or HTML via the ordner parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1973 
Multiple unspecified vulnerabilities in Linksys RT31P2 VoIP router allow remote attackers to cause a denial of service via malformed Session Initiation Protocol (SIP) messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1974 
SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1975 
Cross-site scripting (XSS) vulnerability in guestbook_newentry.php in PHP-Gastebuch 1.61 allows remote attackers to inject arbitrary web script or HTML via the Kommentar field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z
CVE-2006-1976 
Cross-site scripting (XSS) vulnerability in addRequest.php in Prayer Request Board (PRB) Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T10:00:00.000Z