14488 matches found
CVE-2006-6545
The CVE-2006-6545 issue affects the mxBB ErrorDocs module (mx_errordocs) for PHP, specifically involves includes/common.php. The vulnerability arises from a PHP remote file inclusion via the module_root_path parameter, allowing an attacker to execute arbitrary PHP code. Affected software is Error...
CVE-2006-6543
CVE-2006-6543 affects AppIntellect SpotLight CRM 1.0, specifically the login.asp component. The vulnerability is described as multiple SQL injection flaws that allow an attacker to execute arbitrary SQL commands through the (1) login (UserName) parameter and potentially (2) the password parameter...
CVE-2006-6538
CVE-2006-6538 concerns a flaw in the D-LINK DWL-2000AP+ firmware 2.11. The issue allows remote attackers to trigger denial of service, causing either a device reset via a flood of ARP replies on wired or wireless links, or a device crash via ARP request floods on the wireless link. The connected ...
CVE-2006-6537
IBM WebSphere Host On-Demand versions 6.0–9.0 (and possibly 10) areAffected by CVE-2006-6537 due to an authentication bypass via a modified pnl parameter in hod/HODAdmin.html and hod/frameset.html. This remote-auth bypass vulnerability could allow an attacker to gain access without valid credenti...
CVE-2006-6525
SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-6527
PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-6528
The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges...
CVE-2006-6524
SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname UserName parameter...
CVE-2006-6521
SQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter...
CVE-2006-6515
Mantis before 1.1.0a2 sets the default value of $gbugreminderthreshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders...
CVE-2006-6526
PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter...
CVE-2006-6534
Affected software: osCommerce 3.0a3. Description indicates multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. Exploitation vectors involve specific parameters in admin functionality: (1) set parameter to admin/modules.php, (2) s...
CVE-2006-6533
The CVE-2006-6533 issue affects osCommerce 3.0a3, where a directory traversal flaw in admin/templates_boxes_layout.php allows remote attackers to include and execute arbitrary PHP files by providing a .. in the filter parameter. This can also reveal full path information via error messages. The p...
CVE-2006-6520
The CVE-2006-6520 entry describes multiple XSS vulnerabilities in Messageriescripthp 2.0, allowing remote attackers to inject arbitrary script/HTML via parameters: pseudo to existepseudo.php, email to existeemail.php, and pageName or cssform to Contact/contact.php. NVD reports a CVSS v2 base scor...
CVE-2006-6521
CVE-2006-6521 is a SQL injection vulnerability affecting lire-avis.php in Messageriescripthp 2.0. The underlying issue allows remote attackers to inject and execute arbitrary SQL commands via the aa parameter. Documented impact aligns with partial confidentiality, integrity, and availability conc...
CVE-2006-6527
PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-6518
Multiple cross-site scripting XSS vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the 1 pseudo, 2 email, 3 date, 4 sujet, 5 message, 6 site, and 7 lien parameters to a admin/change.php, and the 8 aa parameter to b lire-avis.php...
CVE-2006-6519
CVE-2006-6519 describes an SQL injection in the ProNews 1.5 component, specifically in the file lire-avis.php . The vulnerability is triggered via the aa parameter, allowing remote attackers to execute arbitrary SQL commands. The available documents attribute the issue to improper handling of use...
CVE-2006-6518
CVE-2006-6518 affects ProNews 1.5 and involves multiple reflected cross-site scripting (XSS) flaws. The vulnerability is triggered by unsanitized user-controllable input in several parameters: (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien to admin/change.php, and...