CVE-2006-6525

CVE-2006-6525 affects EzHRS HR Assist 1.05 and earlier. The vulnerability is an SQL injection in vdateUsr.asp that allows remote attackers to execute arbitrary SQL commands via the password parameter. The connected documents confirm the existence of a remote, unauthenticated impact with potential...

CVE-2006-6533

The CVE-2006-6533 issue affects osCommerce 3.0a3, where a directory traversal flaw in admin/templates_boxes_layout.php allows remote attackers to include and execute arbitrary PHP files by providing a .. in the filter parameter. This can also reveal full path information via error messages. The p...

CVE-2006-6528

CVE-2006-6528 affects the Drupal Chatroom Module (versions before 4.7.x.-1.0). The vulnerability arises because the module broadcasts visitors’ session IDs to all participants, enabling remote attackers to hijack sessions and gain privileges. The published description explicitly states the impact...

CVE-2006-6531

Cross-site scripting XSS vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles...

CVE-2006-6526

CVE-2006-6526 is a PHP remote file inclusion vulnerability affecting Gizzar (03162002 and earlier) where an attacker can cause arbitrary PHP code execution via the basePath parameter in index.php. The issue arises from unsafely including remote files, enabling code execution on affected servers. ...

CVE-2006-6524

CVE-2006-6524 is a SQL injection vulnerability in EzHRS HR Assist prior to or including 1.05, occurring in vdateUsr.asp through the Uname (UserName) parameter. The issue arises from improper handling of user input, allowing remote attackers to execute arbitrary SQL commands. Public references inc...

CVE-2006-6512

The CVE-2006-6512 issue affects Winamp Web Interface (Wawi) up to version 7.5.13 and earlier, specifically the Browse function at /browse. The vulnerability is a directory traversal flaw that lets remote authenticated users list arbitrary directories by supplying URL-encoded backslashes ("%2F") i...

CVE-2006-6517

Multiple cross-site scripting XSS vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 categories parameter to a index.php3 or b galeries.inc.php3...

CVE-2006-6514

The vulnerability CVE-2006-6514 affects Winamp Web Interface (Wawi) versions 7.5.13 and earlier. It arises from an insufficient comparison to determine whether a directory is located below the application's root directory, enabling remote authenticated users to access certain other directories if...

CVE-2006-6530

The CVE-2006-6530 entry describes an SQL injection vulnerability in the Drupal Help Tip module older than 4.7.x-1.0. The affected component is the Help Tip module for Drupal; root cause involves SQL command injection via unspecified vectors, allowing remote attackers to potentially execute arbitr...

CVE-2006-6529

CVE-2006-6529 affects the Drupal Chatroom Module in versions before 4.7.x-1.0. The vulnerability arises because the module displays private messages in the chatroom’s last messages overview, allowing remote attackers to read sensitive information via the overview. Impact: information disclosure o...

CVE-2006-6526

PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter...

CVE-2006-6532

CVE-2006-6532 is an XSS issue affecting Vt-Forum Lite 1.3 and earlier. Connected docs confirm exploitable via (1) StrMsg/Topic_ID parameters to vf_info.asp, vf_newtopic.asp, vf_settings.asp, and vf_replytopic.asp (and references to CVE-2006-6447). Root cause is insufficient input sanitization lea...

CVE-2006-6522

CVE-2006-6522 affects WikiTimeScale TwoZero prior to 2.31, with multiple XSS vulnerabilities in the forum module and event descriptions . The root cause is cross-site scripting allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. The CVSS v2 base score is 6.8 (MEDIUM...

CVE-2006-6531

CVE-2006-6531 affects the Drupal Help Tip module prior to 4.7.x-1.0, where an XSS vulnerability exists that allows remote attackers to inject arbitrary script/HTML via node titles. Root cause is an input/output handling flaw in the module that fails to sanitize title content. Impact is partial co...

CVE-2006-6527

The CVE-2006-6527 entry describes a PHP remote file inclusion in guest.php for Gizzar versions 03162002 and earlier. The vulnerability allows an attacker to execute arbitrary PHP code by supplying a URL in the basePath parameter, indicating a server-side include flaw likely enabling remote code e...

CVE-2006-6523

The CVE-2006-6523 entry concerns an XSS vulnerability in BoxTrapper’s mail/manage.html for cPanel 11, exploitable via the account parameter. The affected component is BoxTrapper (cPanel 11) and the root cause is cross-site scripting through unvalidated input in the account parameter, allowing inj...

CVE-2006-6523

Cross-site scripting XSS vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter...

CVE-2006-6517

The CVE-2006-6517 entry describes multiple XSS vulnerabilities in KDPics version 1.16 and earlier, where remote attackers can inject arbitrary script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3. Affected software is KDPics 1.16 and earlier; vulnerable compo...

CVE-2006-6107

Unspecified vulnerability in the matchruleequal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service lost process messages...