CVE-2006-7004

The CVE-2006-7004 entry documents a Cross-site Scripting (XSS) vulnerability in the PSY Auction project, specifically in email_request.php, exploitable via the user_id parameter. The vulnerability description indicates that remote attackers can inject arbitrary web script or HTML, implying potent...

CVE-2006-7003

The CVE-2006-7003 entry describes a PHP remote file inclusion in Fusion Polls: admin/index.php can include a file from a URL using the xtrphome parameter, allowing remote code execution. Affected: Fusion Polls (specific versions/components not stated). Root cause: unsafely including a user-contro...

CVE-2006-7007

CVE-2006-7007 describes a buffer overflow in Tiny FTPd (versions 1.4 and earlier) that can cause a denial of service (daemon crash) by sending a long USER command. The vulnerability affects Tiny FTPd’s handling of USER and is separate from CVE-2000-0133. Public references exist (SecurityVulns: Ti...

CVE-2006-7008

Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it is possible that this issue overlaps CVE-2006-1029...

CVE-2006-7005

The CVE-2006-7005 entry describes an SQL injection in PSY Auction’s item.php, exploitable via the id parameter to allow remote execution of arbitrary SQL. The vulnerability is triggered through a manipulable id value, leading to partial confidentiality, integrity, and availability impact as per t...

CVE-2006-7009

CVE-2006-7009 affects Joomla! prior to 1.0.10. The vulnerability allows remote attackers to spoof the frontend submission forms. The provided documents describe the impact as unknown and do not specify exploit vectors or affected components beyond the frontend-form spoofing issue. There is no rem...

CVE-2006-7006

CVE-2006-7006 concerns Robin de Graff Somery 0.4.4, where a PHP remote file inclusion through upload/admin/team.php could allow arbitrary PHP execution via a URL in the checkauth parameter. Red Hat/NVD entries reiterate the description but also include a note that CVE disputes this vulnerability ...

CVE-2006-7010

The vulnerability CVE-2006-7010 affects Joomla! mosgetparam prior to 1.0.10, where a variable’s data type is not forced to integer when the default is numeric. This may lead to unspecified impact and potential SQL injection, as the data type handling is the root cause. Exploitation details, affec...

CVE-2006-7001

Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the L parameter, a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-7001

CVE-2006-7001 describes a directory traversal in PhpMyChat Plus 1.9 and earlier. The vulnerable component is the avatar.php handler, where an attacker can supply a "L" parameter containing ".." to read arbitrary files on the server. This mirrors the established issue family in PhpMyChat Plus 1.9 ...

CVE-2006-7002

The CVE-2006-7002 entry describes a Cross-site scripting (XSS) vulnerability in Wheatblog (wB) 1.1, exploitable through the Email field in add_comment.php. The issue is tied to Wheatblog 1.1 and is explicitly documented as an XSS that allows injection of arbitrary script/HTML via that input. Conn...

CVE-2006-7002

Cross-site scripting XSS vulnerability in addcomment.php in Wheatblog wB 1.1 allows remote attackers to inject arbitrary web script or HTML via the Email field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue may...

CVE-2006-6999

attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter...

CVE-2006-6998

install/loaderhelp.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERYSTRING, which calls the phpinfo function...

CVE-2006-7000

CVE-2006-7000 relates to Headstart Solutions DeskPRO. Multiple endpoints (email/mail.php, includes/init.php, includes/cron/*, jpgraph.php, jpgraph_bar.php, jpgraph_pie.php, jpgraph_pie3d.php in includes/graph/) disclose the server’s full filesystem path via error messages. The vulnerability stems...

CVE-2006-6999

attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter...

CVE-2006-6998

CVE-2006-6998 affects Headstart Solutions DeskPRO. The vulnerable file is install/loader_help.php, which can be accessed with a q=phpinfo QUERY_STRING to trigger phpinfo, allowing remote attackers to obtain configuration information. Documented impact is Partial Confidentiality with no integrity/...

CVE-2006-6995

mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter...

CVE-2006-6996

CVE-2006-6996 concerns multiple XSS flaws in warforge.NEWS 1.0. The vulnerabilities allow remote attackers to inject arbitrary HTML or web script via parameters in two parts of the app: (a) newsadd.php (title and newspost) and (b) news.php (name, title, and comment). This is a separate vector set...

CVE-2006-6995

The CVE-2006-6995 issue affects V3 Chat’s mycontacts.php where an authenticated user can alter the membername parameter to gain privileges of another user. The vulnerability is described as a privilege escalation via parameter tampering, enabling access to other user accounts. Sources cited in th...