rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-5463 
Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary JavaScript bytecode via unspecified vectors involving modification of a Script object while it is executing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-08T22:00:00.000Z
CVE-2006-5464 
Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-08T21:00:00.000Z
CVE-2006-5465 
Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T00:00:00.000Z
CVE-2006-5466 
Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T17:00:00.000Z
CVE-2006-5467 
The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-27T18:00:00.000Z
CVE-2006-5468 
Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-27T23:00:00.000Z
CVE-2006-5469 
Unspecified vulnerability in the WBXML dissector in Wireshark (formerly Ethereal) 0.10.11 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-28T00:00:00.000Z
CVE-2006-5471 
PHP remote file inclusion vulnerability in example/lib/grid3.lib.php in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the (1) cfg_dir and (2) lib_dir parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5472 
PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameter in (1) lib/registry.lib.php, (2) lib/sqlcompose.lib.php, and (3) lib/sqlsearch.lib.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5473 
PHP remote file inclusion vulnerability in Description.php in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via the lib_dir parameter.  NOTE: this issue is disputed by CVE as of 20061023, since there is no Description.php file included in the product, and the existing "Description" file contains documentation, not functioning code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5474 
The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5475 
Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5476 
Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5477 
Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows form submissions to be redirected, which allows remote attackers to obtain arbitrary form information via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5478 
Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5479 
The NCP Engine in Novell eDirectory before 8.7.3.8 FTF1 allows remote attackers to cause an unspecified denial of service via a certain "NCP Fragment."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5480 
PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to execute arbitrary PHP code via the rootpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5481 
Multiple PHP remote file inclusion vulnerabilities in 2le.net Castor PHP Web Builder 1.1.1 allow remote attackers to execute arbitrary PHP code via the rootpath parameter in (1) lib/code.php, (2) lib/dbconnect.php, (3) lib/error.php, (4) lib/menu.php, and other unspecified files.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T20:00:00.000Z
CVE-2006-5482 
ufs_vnops.c in FreeBSD 6.1 allows local users to cause an unspecified denial of service by calling the ftruncate function on a file type that is not VREG, VLNK or VDIR, which is not defined in POSIX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T22:00:00.000Z
CVE-2006-5483 
p1003_1b.c in FreeBSD 6.1 allows local users to cause an unspecified denial of service by setting a scheduler policy, which should only be settable by root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T22:00:00.000Z
CVE-2006-5484 
SSH Tectia Client/Server/Connector 5.1.0 and earlier, Manager 2.2.0 and earlier, and other products, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents Tectia from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T22:00:00.000Z
CVE-2006-5485 
Multiple PHP remote file inclusion vulnerabilities in SpeedBerg 1.2beta1 allow remote attackers to execute arbitrary PHP code via a URL in the SPEEDBERG_PATH parameter to (1) entrancePage.tpl.php, (2) generalToolBox.tlb.php, (3) myToolBox.tlb.php, (4) scriplet.inc.php, (5) simplePage.tpl.php, (6) speedberg.class.php, and (7) standardPage.tpl.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T22:00:00.000Z
CVE-2006-5486 
Cross-site scripting (XSS) vulnerability in Webmail in Sun Java System Messaging Server 6.0 through 6.2 and iPlanet Messaging Server 5.2 allows remote attackers to execute arbitrary Javascript via crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-24T22:00:00.000Z
CVE-2006-5487 
Directory traversal vulnerability in Marshal MailMarshal SMTP 5.x, 6.x, and 2006, and MailMarshal for Exchange 5.x, allows remote attackers to write arbitrary files via ".." sequences in filenames in an ARJ compressed archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-10T22:00:00.000Z
CVE-2006-5488 
SQL injection vulnerability in XchangeBoard 1.70, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginNick parameter during login.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5489 
Research in Motion (RIM) BlackBerry Enterprise Server 4.1 SP2 before Hotfix 1 for IBM Lotus Domino might allow attackers with meeting organizer privileges to cause a denial of service (application hang) via a deleted recurrent meeting instance when changing the attendee's calendar meeting time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5490 
Multiple SQL injection vulnerabilities in Segue Content Management System (CMS) before 1.5.8 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5491 
Multiple SQL injection vulnerabilities in include/index.php in UltraCMS 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5492 
Unspecified vulnerability in Maerys Archive (Maarch) before 2.0.1 allows remote authenticated users to obtain sensitive information (document contents) via unspecified attack vectors related to "grants."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5493 
PHP remote file inclusion vulnerability in template/purpletech/base_include.php in DigitalHive 2.0 RC2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5494 
Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB module for PHP-Nuke allow remote attackers to execute arbitrary PHP code via a URL in the (1) adminpath or (2) basepath parameters.  NOTE: this issue might overlap CVE-2006-6795.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5495 
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_red2 parameter to (a) _msdazu_pdata/redaktion/artikel/up/index.php; (b) addtort.php, (c) colorpik2.php, (d) colorpik3.php, (e) extras_menu.php, (f) farbpalette.php, (g) lese_inc.php, and (h) newfile.php in _msdazu_share/richtext/; the (2) path_scr_dat2 parameter to (i)_msdazu_share/share/insert1.php; the (3) path_red parameter to (j) _msdazu_share/extras/downloads/index.php; and unspecified parameters in other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5496 
Multiple cross-site scripting (XSS) vulnerabilities in Timothy Claason KnowledgeBank 1.01 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) index.php, (2) addknowledge.php, and (3) addscreenshot.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5497 
PHP remote file inclusion vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5498 
Directory traversal vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5499 
Multiple cross-site scripting (XSS) vulnerabilities in Serendipity (s9y) 1.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the media manager administration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5500 
Multiple SQL injection vulnerabilities in the checkUser function in inc/DBInterface.php in XchangeBoard 1.70 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) userNick or (2) password parameters.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T10:00:00.000Z
CVE-2006-5501 
Buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers to execute arbitrary code via the downloadFileDirectory property, a different vulnerability than CVE-2006-5502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5502 
Heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method, a different vulnerability than CVE-2006-5501.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5503 
Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5504 
Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5505 
Multiple PHP file inclusion vulnerabilities in 2BGal 3.0 allow remote attackers to execute arbitrary PHP code via the lang parameter to (1) admin/configuration.inc.php, (2) admin/creer_album.inc.php, (3) admin/changepwd.php.inc, and unspecified other files.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5506 
Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path parameter in (1) inc/prepend.inc.php, (2) inc/lib/boxes.lib.php, (3) inc/lib/tools.lib.php, (4) tools/trackback/index.php, and (5) tools/utf8conversion/index.php in admin/; and (6) prepend.inc.php, (7) lib/boxes.lib.php, and (8) lib/history.lib.php in inc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5507 
Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php, (6) insert_table.php, (7) table_cellprop.php, (8) table_prop.php, (9) table_rowprop.php, (10) insert_page.php, and possibly insert_marquee.php in backend/external/wysiswg/popups/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5508 
Multiple SQL injection vulnerabilities in addentry.php in WoltLab Burning Book 1.1.2 allow remote attackers to execute arbitrary SQL commands via (1) the n parameter and (2) the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5509 
Eval injection vulnerability in addentry.php in WoltLab Burning Book 1.1.2 allows remote attackers to execute arbitrary PHP code via crafted POST requests that store PHP code in a database that is later processed by eval, as demonstrated using SQL injection via the n parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5510 
Directory traversal vulnerability in explorer_load_lang.php in PH Pexplorer 0.24 allows remote attackers to include arbitrary local files via ".." sequences in the Language cookie, as demonstrated by uploading a .gif file that contains PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5511 
Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5512 
Cross-site scripting (XSS) vulnerability in article.htm in Zwahlen Online Shop allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-25T22:00:00.000Z
CVE-2006-5513 
SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers to execute arbitrary SQL commands, and complete a login, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5514 
SQL injection vulnerability in quiz.php in Web Group Communication Center (WGCC) 0.5.6b and earlier allows remote attackers to execute arbitrary SQL commands via the qzid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5515 
Cross-site scripting (XSS) vulnerability in lib-history.inc.php in phpAdsNew and phpPgAds before 2.0.8-pr1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to injected data that is stored by a delivery script and displayed by the admin interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5516 
Multiple cross-site scripting (XSS) vulnerabilities in actions/usersettings.php in WikiNi before 0.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) email parameters to wakka.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5517 
Multiple PHP remote file inclusion vulnerabilities in Rhode Island Open Meetings Filing Application (OMFA) allow remote attackers to execute arbitrary PHP code via a URL in the PROJECT_ROOT parameter to (1) editmeetings/session.php, (2) email/session.php, (3) entityproperties/session.php, or (4) inc/mail.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5518 
Multiple PHP remote file inclusion vulnerabilities in Christopher Fowler (Rhode Island) RSSonate allow remote attackers to execute arbitrary PHP code via a URL in the PROJECT_ROOT parameter to (1) xml2rss.php, (2) config_local.php, (3) rssonate.php, and (4) sql2xml.php in Src/getFeed/inc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5519 
PHP remote file inclusion vulnerability in Savant2/Savant2_Plugin_options.php in the MambWeather 1.8.1 and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5520 
PHP remote file inclusion vulnerability in functions.php in DeltaScripts PHP Classifieds 7.1 allows remote attackers to execute arbitrary PHP code via a URL in the set_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5521 
PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpdns_basedir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5522 
Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config parameter in (1) main.php or (2) user/account/main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5523 
PHP remote file inclusion vulnerability in common.php in EZ-Ticket 0.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ezt_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5524 
Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: This issue might overlap CVE-2006-5321.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z
CVE-2006-5525 
Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL injection attacks via (1) "/**/UNION " or (2) " UNION/**/" sequences, which are not rejected by the protection mechanism, as demonstrated by a SQL injection via the eid parameter in a search action in the Encyclopedia module in modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-26T16:00:00.000Z