rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-2095 
Phex before 2.8.6 allows remote attackers to cause a denial of service (application hang) by initiating multiple chat requests to a single user and then logging off.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2096 
plug.php in Land Down Under (LDU) 802 and earlier allows remote attackers to obtain sensitive information via an invalid (1) month or (2) year parameter, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2097 
SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2098 
PHP remote file inclusion vulnerability in Thumbnail AutoIndex before 2.0 allows remote attackers to execute arbitrary PHP code via (1) README.html or (2) HEADER.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2099 
Directory traversal vulnerability in UltraISO 8.0.0.1392 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2100 
Directory traversal vulnerability in Magic ISO 5.0 Build 0166 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2101 
Directory traversal vulnerability in WinISO 5.3 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2102 
Directory traversal vulnerability in PowerISO 2.9 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2103 
SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which is not properly handled by adminfunctions.php; or (2) setid, (3) expand, (4) title, or (5) sid2 parameters to (b) admin/templates.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2104 
Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter to main.php, ordner parameter to (2) main.php, or (3) webdisk.php, (4) draft parameter to compose.php, or (5) m, or (6) y parameter to calendar.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2105 
Directory traversal vulnerability in index.php in Jupiter CMS 1.1.4 and 1.1.5 allows remote attackers to read arbitrary files via ".." sequences terminated by a %00 (null) character in the n parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2106 
Cross-site scripting (XSS) vulnerability in Edgewall Software Trac 0.9.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors related to a "wiki macro."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2107 
Buffer overflow in BL4 SMTP Server 0.1.4 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the (1) EHLO, (2) MAIL FROM, and (3) RCPT TO commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2108 
parser.exe in Océ (OCE) 3121/3122 Printer allows remote attackers to cause a denial of service (crash or reboot) via a long request, possibly triggering a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-29T10:00:00.000Z
CVE-2006-2109 
Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables within the program, as demonstrated using the table parameter to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2110 
Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities (ccaps) that allow local guest users to perform operations that were only intended to be allowed by the guest-root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T19:00:00.000Z
CVE-2006-2111 
A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet Explorer 6 and 7, aka "URL Redirect Cross Domain Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T19:00:00.000Z
CVE-2006-2112 
Fuji Xerox Printing Systems (FXPS) print engine, as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, allows remote attackers to use the FTP printing interface as a proxy ("FTP bounce") by using arbitrary PORT arguments to connect to systems for which access would be otherwise restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-25T01:00:00.000Z
CVE-2006-2113 
The embedded HTTP server in Fuji Xerox Printing Systems (FXPS) print engine, as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, does not properly perform authentication for HTTP requests, which allows remote attackers to modify system configuration via crafted requests, including changing the administrator password or causing a denial of service to the print server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-25T01:00:00.000Z
CVE-2006-2114 
Buffer overflow in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via a long request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T19:00:00.000Z
CVE-2006-2115 
Format string vulnerability in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via unspecified vectors that are not properly handled in a syslog function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T19:00:00.000Z
CVE-2006-2116 
planetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T21:00:00.000Z
CVE-2006-2117 
Cross-site scripting (XSS) vulnerability in Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the search page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T21:00:00.000Z
CVE-2006-2118 
JMK's Picture Gallery allows remote attackers to bypass authentication via a direct request to admin_gallery.php3, possibly related to the add action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T21:00:00.000Z
CVE-2006-2119 
PHP remote file inclusion vulnerability in event/index.php in Artmedic Event allows remote attackers to execute arbitrary code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T21:00:00.000Z
CVE-2006-2120 
The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T22:00:00.000Z
CVE-2006-2121 
PHP remote file include vulnerability in admin/config_settings.tpl.php in I-RATER Platinum allows remote attackers to execute arbitrary code via a URL in the include_path parameter.  NOTE: this is a different vector, and possibly a different vulnerability, than CVE-2006-1929.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T22:00:00.000Z
CVE-2006-2122 
PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page parameter.  NOTE: the original report for this issue is probably erroneous, since CoolMenus does not appear to be written in PHP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T22:00:00.000Z
CVE-2006-2123 
Multiple SQL injection vulnerabilities in the report interface in Network Administration Visualized (NAV) before 3.0.1 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T22:00:00.000Z
CVE-2006-2124 
Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prevaction, (2) previd, (3) prevstart, (4) itemid, (5) id, and (6) action parameters in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T22:00:00.000Z
CVE-2006-2126 
SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categori and (2) stranica parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T22:00:00.000Z
CVE-2006-2127 
SQL injection vulnerability in weblog_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL commands via the r parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2128 
Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str parameter to (b) search.php, or (4) artid parameter to (c) art.php, or (5) catid parameter to (d) cat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2129 
Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in set_inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2130 
SQL injection vulnerability in include/class_poll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2131 
include/class_poll.php in Advanced Poll 2.0.4 uses the HTTP_X_FORWARDED_FOR (X-Forwarded-For HTTP header) to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2132 
SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2133 
SQL injection vulnerability in index.php in BoonEx Barracuda 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) link_dir_target and (2) link_id_target parameter, possibly involving the link_edit functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-01T23:00:00.000Z
CVE-2006-2134 
PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2135 
SQL injection vulnerability in login.php in Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2136 
SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2137 
PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2138 
Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.29 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2139 
Multiple SQL injection vulnerabilities in PHP Newsfeed 20040723 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to (a) deltables.php, (2) select, (3) header, (4) url, (5) source, or (6) time parameters to (b) manualsubmit.php, (7) num parameter to (c) delete.php, or (8) tablename parameter to (d) searchnews.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2140 
Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitrary web script via the (1) referral parameter to signup.php or (2) id parameter to members.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2141 
Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the pos argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2142 
PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classes_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2143 
Multiple cross-site scripting (XSS) vulnerabilities in TextFileBB 1.0.16 allow remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) color, (2) size, or (3) url bbcode tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2144 
PHP remote file inclusion vulnerability in kopf.php in DMCounter 0.9.2-b allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2145 
Multiple SQL injection vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) topic or (2) id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2146 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) poster_name, (2) poster_email, (3) poster_homepage, or (4) message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T10:00:00.000Z
CVE-2006-2147 
resmgrd in resmgr for SUSE Linux and other distributions does not properly handle when access to a USB device is granted by using "usb:<bus>,<dev>" notation, which grants access to all USB devices and allows local users to bypass intended restrictions.  NOTE: this is a different vulnerability than CVE-2005-4788.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T20:00:00.000Z
CVE-2006-2148 
Multiple buffer overflows in client.c in CGI:IRC (CGIIRC) before 0.5.8 might allow remote attackers to execute arbitrary code via (1) cookies or (2) the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-02T21:00:00.000Z
CVE-2006-2149 
PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the CONFIG[path] parameter, as demonstrated by including a GIF that contains PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2150 
PHP remote file inclusion vulnerability in top/list.php in phpBB TopList 1.3.8 and earlier allows remote attackers to include arbitrary files via the returnpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2151 
PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2152 
PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2153 
Cross-site scripting (XSS) vulnerability in HTM_PASSWD in DirectAdmin Hosting Management allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2154 
EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 does not drop privileges before opening files, which allows local users to execute arbitrary code via the File>Open dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2155 
EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 allows local users to execute arbitrary code by replacing the Retrospect.exe file, possibly due to improper file permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2156 
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. (dot dot) sequences in the help_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2157 
SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow".  NOTE: This is a different vulnerability than CVE-2005-4246.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2158 
Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by performing PHP remote file inclusion using the include_files array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2159 
CRLF injection vulnerability in help.php in Russcom Network Loginphp allows remote attackers to spoof e-mails and inject MIME headers via CRLF sequences in the email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2160 
Cross-site scripting (XSS) vulnerability in Russcom Network Loginphp (Russcom.Loginphp) allows remote attackers to inject arbitrary web script or HTML via the username field when registering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T10:00:00.000Z
CVE-2006-2161 
Buffer overflow in (1) TZipBuilder 1.79.03.01, (2) Abakt 0.9.2 and 0.9.3-beta1, (3) CAM UnZip 4.0 and 4.3, and possibly other products, allows user-assisted attackers to execute arbitrary code via a ZIP archive that contains a file with a long file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-09T10:00:00.000Z
CVE-2006-2162 
Buffer overflow in CGI scripts in Nagios 1.x before 1.4 and 2.x before 2.3 allows remote attackers to execute arbitrary code via a negative content length (Content-Length) HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-03T21:00:00.000Z
CVE-2006-2163 
Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart 3.33 and earlier allows remote attackers to inject arbitrary web script or HTML via the setbackurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-04T10:00:00.000Z
CVE-2006-2164 
Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php, and (2) prod_id parameter in (c) cart.php and (d) product_info.php.  NOTE: this issue also produces resultant full path disclosure from invalid SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-04T10:00:00.000Z
CVE-2006-2165 
Multiple cross-site scripting (XSS) vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php and (2) prod_id parameter in (c) product_info.php.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-04T10:00:00.000Z