rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-4639 
Multiple PHP remote file inclusion vulnerabilities in C-News.fr C-News 1.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path parameter in (1) formulaire_commentaires.php, (2) affichage/liste_news.php, (3) affichage/news_complete.php, or (4) affichage/pagination.php.  NOTE: the provenance of some of this information is unknown; some details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4640 
Unspecified vulnerability in Adobe Flash Player before 9.0.16.0 allows user-assisted remote attackers to bypass the allowScriptAccess protection via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-12T23:00:00.000Z
CVE-2006-4641 
SQL injection vulnerability in kategori.asp in Muratsoft Haber Portal 3.6 allows remote attackers to execute arbitrary SQL commands via the kat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4642 
AuditWizard 6.3.2, when using "Remote Audit," logs the administrator password in plaintext to LaytonCmdSvc.log, which allows local users to obtain sensitive information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4643 
SQL injection vulnerability in consult/joueurs.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to execute arbitrary SQL commands via the id_joueur parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4644 
PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the repmod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4645 
PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bm_content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4646 
Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Pathauto module before pathauto_node.inc 1.17.2.1 and the Drupal 4.6 Pathauto module before pathauto_node.inc 1.14.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4647 
PHP remote file inclusion vulnerability in news.php in Sponge News 2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sndir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4648 
PHP remote file inclusion vulnerability in bp_ncom.php in BinGo News (BP News) 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4649 
PHP remote file inclusion vulnerability in bp_news.php in BinGo News (BP News) 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T21:00:00.000Z
CVE-2006-4650 
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4651 
Directory traversal vulnerability in download/index.php, and possibly download.php, in threesquared.net (aka Ben Speakman) Php download allows remote attackers to overwrite arbitrary local files via .. (dot dot) sequence in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4652 
(1) Amazing Little Poll and (2) Amazing Little Picture Poll have a default password of "dsapoll", which allows remote attackers to create a new poll by entering default credentials via lp_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4653 
(1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4654 
Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service (crash) or "compromise the server" via encoded format string specifiers in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4655 
Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and Sun Solaris 8 through 10, allows local users to gain privileges via a long _XKB_CHARSET environment variable value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4656 
PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter.  NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4657 
Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 stores service executables under the product's installation directory with weak permissions, which allows local users to obtain LocalSystem privileges by modifying (1) WebProxy.exe or (2) PAVSRV51.EXE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4658 
Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses sequential message numbers in generated URLs that are not filtered if the user replies to a message, which might allow remote attackers to determine mail usage patterns.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4659 
The Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses predictable URLs for the spam classification of each message, which allows remote attackers to cause Panda to classify arbitrary messages as spam via a web page that contains IMG tags with the predictable URLs.  NOTE: this issue could also be regarded as a cross-site request forgery (CSRF) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4660 
Multiple cross-site scripting (XSS) vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll) allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the (1) title and (2) description elements within an item element in an RSS feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4661 
AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll) does not properly validate the origin of the configuration web page (options2.html), which allows user-assisted remote attackers to provide a web page that contains disguised checkboxes that trick the user into reconfiguring the toolbar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4662 
Heap-based buffer overflow in the MCRegEx__Search function in AOL ICQ Pro 2003b Build 3916 and earlier allows remote attackers to execute arbitrary code via an inconsistent length field of a Message in a 0x2711 Type-Length-Value (TLV) type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4663 
The source code tar archive of the Linux kernel 2.6.16, 2.6.17.11, and possibly other versions specifies weak permissions (0666 and 0777) for certain files and directories, which might allow local users to insert Trojan horse source code that would be used during the next kernel compilation.  NOTE: another researcher disputes the vulnerability, stating that he finds "Not a single world-writable file or directory." CVE analysis as of 20060908 indicates that permissions will only be weak under certain unusual or insecure scenarios
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4664 
PHP remote file inclusion vulnerability in includes/functions_portal.php in Premod Shadow 2.7.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4665 
Cross-site scripting (XSS) vulnerability in index.php in MKPortal M1.1 Rc1 allows remote attackers to inject arbitrary web script or HTML via the ind parameter, possibly related to the PHP_SELF variable.  NOTE: Some details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4666 
Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via a URL in the (1) ide parameter in (a) article.php; or the (2) pwfile parameter in (b) delete.php, (c) modify.php, (d) admin.php, or (e) modify_go.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4667 
Multiple SQL injection vulnerabilities in RunCMS 1.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in (a) class/sessions.class.php, and the (2) timezone_offset and (3) umode parameters in (b) class/xoopsuser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4668 
Cross-site scripting (XSS) vulnerability in index.php in Rob Hensley AckerTodo 4.0 allows remote attackers to inject arbitrary web script or HTML via the task_id parameter in an edit_task command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4669 
PHP remote file inclusion vulnerability in admin/system/include.php in Somery 0.4.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4670 
Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter in (1) includes/cart.inc.php or (2) extras/ext_cats.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4671 
PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter, a different vector than CVE-2006-1154.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T16:00:00.000Z
CVE-2006-4672 
PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote attackers to execute arbitrary PHP code via a URL in the (1) proMod parameter to (a) index.php, or the (2) docroot parameter to (b) index.php or (c) mainpage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T16:00:00.000Z
CVE-2006-4673 
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T16:00:00.000Z
CVE-2006-4674 
Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4675 
Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4676 
TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4677 
PHP remote file inclusion vulnerability in contrib/yabbse/poc.php in phpopenchat before 3.0.2 allows remote attackers to execute arbitrary PHP code via the sourcedir parameter.  NOTE: this issue was disputed by a third-party researcher who stated that the _REQUEST parameters were dynamically unset at the beginning of the file.  Another researcher noted, and CVE agrees, that the unset PHP function can be bypassed (CVE-2006-3017).  If this issue is due to a vulnerability in PHP, then it should be excluded from CVE
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4678 
PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the _NE[AbsPath] parameter in (1) install.php and (2) migrateNE2toNE3.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4679 
DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4680 
The Remote UI in Canon imageRUNNER includes usernames and passwords when exporting an address book, which allows context-dependent attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4681 
Directory traversal vulnerability in Redirect.bat in IBM Director before 5.10 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4682 
Multiple unspecified vulnerabilities in IBM Director before 5.10 allow remote attackers to cause a denial of service (crash) via unspecified vectors involving (1) malformed WMI CIM server requests and (2) malformed packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4683 
IBM Director before 5.10 allows remote attackers to obtain sensitive information from HTTP headers via HTTP TRACE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4684 
The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability than CVE-2006-3458.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-19T18:00:00.000Z
CVE-2006-4685 
The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-10T22:00:00.000Z
CVE-2006-4686 
Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-10T22:00:00.000Z
CVE-2006-4687 
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via crafted layout combinations involving DIV tags and HTML CSS float properties that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-14T21:00:00.000Z
CVE-2006-4688 
Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via crafted messages, aka "Client Service for NetWare Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-14T22:00:00.000Z
CVE-2006-4689 
Unspecified vulnerability in the driver for the Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to cause a denial of service (hang and reboot) via has unknown attack vectors, aka "NetWare Driver Denial of Service Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-14T22:00:00.000Z
CVE-2006-4691 
Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-14T21:00:00.000Z
CVE-2006-4692 
Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-10T22:00:00.000Z
CVE-2006-4693 
Unspecified vulnerability in Microsoft Word 2004 for Mac and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word file, a different issue than CVE-2006-3647 and CVE-2006-3651.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-10T22:00:00.000Z
CVE-2006-4694 
Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office XP and Office 2003 allows user-assisted attackers to execute arbitrary code via a crafted record in a PPT file, as exploited by malware such as Exploit:Win32/Controlppt.W, Exploit:Win32/Controlppt.X, and Exploit-PPT.d/Trojan.PPDropper.F. NOTE: it has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-27T19:00:00.000Z
CVE-2006-4695 
Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via a crafted URL, aka "Office Web Components URL Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-11T23:00:00.000Z
CVE-2006-4696 
Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted packet, aka "SMB Rename Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-10T22:00:00.000Z
CVE-2006-4697 
Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from Imjpcksid.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this issue might be related to CVE-2006-4193.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T22:00:00.000Z
CVE-2006-4702 
Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-13T01:00:00.000Z
CVE-2006-4704 
Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka "WMI Object Broker Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-01T15:00:00.000Z
CVE-2006-4705 
SQL injection vulnerability in login.php in dwayner79 and Dominic Gamble Timesheet (aka Timesheet.php) 1.2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-12T16:00:00.000Z
CVE-2006-4706 
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated using "java& #115;cript," a different vulnerability than CVE-2006-3761.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-12T16:00:00.000Z
CVE-2006-4707 
Cross-site scripting (XSS) vulnerability in admin/global.php (aka the Admin CP login form) in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string ($_SERVER[PHP_SELF]).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-12T16:00:00.000Z