CVE-2006-5799

CVE-2006-5799 involves multiple XSS vulnerabilities in the xenis.creator CMS, specifically in default.asp where the (1) contid and (2) search parameters can be exploited to inject arbitrary web script/HTML. Documented impact is partial confidentiality/integrity/availability, with a NVD CVSS v2 ba...

CVE-2006-5661

CVE-2006-5661 is an XSS vulnerability in VIRtech Netquery’s nquser.php that allows remote attackers to inject arbitrary web script via the User-Agent header. The issue is documented across multiple feeds, with CVSS 2.0 indicating a Network attack, no authentication, and partial impact to confiden...

CVE-2006-5632

Cross-site scripting XSS vulnerability in changepass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-5631. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2006-5515

Cross-site scripting XSS vulnerability in lib-history.inc.php in phpAdsNew and phpPgAds before 2.0.8-pr1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to injected data that is stored by a delivery script and displayed by the admin interface...

CVE-2006-5203

Invision Power Board IPB 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, via a forum description that contains a crafted image with PHP code, which is executed when the user visits the "Manage Forums" link in the...

CVE-2006-5190

CVE-2006-5190 affects osCommerce 2.2 Milestone 2 Update 060817. The vulnerability is a set of multiple XSS flaws exploitable through the page parameter in admin scripts (banner_manager.php, banner_statistics.php, countries.php, currencies.php, languages.php, manufacturers.php, newsletters.php, or...

CVE-2006-5146

Multiple cross-site scripting XSS vulnerabilities in Yblog allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter in a funk.php, or the 2 action parameter in b tem.php and c uss.php...

CVE-2006-5129

CVE-2006-5129 affects ph03y3nk just another flat file (JAF) CMS 4.0 RC1. The vulnerabilities are cross-site scripting in two spots: (1) module/shout/jafshout.php (the shoutbox) via the message parameter and related name/email/title/date/ldate/lname variables, and (2) the message body in a forum p...

CVE-2006-5090

CVE-2006-5090 describes multiple cross-site scripting (XSS) vulnerabilities in Phoenix Evolution CMS (PECMS) . The affected vectors are the parameters mod and action in index.php, and pageid in modules/pageedit/index.php, allowing remote attackers to inject arbitrary web script or HTML. The provi...

CVE-2006-4973

DotNetNuke (Perpetual Motion Interactive Systems) has a reflected XSS vulnerability in Default.aspx: versions prior to 3.3.5 and 4.x prior to 4.3.5 allow remote attackers to inject arbitrary HTML via the error parameter. Affected software is DotNetNuke under Perpetual Motion Interactive Systems. ...

CVE-2006-4747

Multiple cross-site scripting XSS vulnerabilities in IdevSpot TextAds allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in delete.php and 2 the error parameter in error.php...

[Full-disclosure] PocketPC MMS - Remote Code Injection/Execution Vulnerability and Denial-of-Service

Vulnerability Report ----------------------------- Vendor: Microsoft and ArcSoft Product: PocketPC OS and MMS Composer Versions: MMS Composer: 1.5.5.6, 2.0.0.13 possible others Platform: PocketPC tested on: WinCE 4.2 and WinCE 4.21, possible others Architecture: ARM Devices: HP iPAQ h6315, i-mate...

Code injection

Tamarack MMSd before 7.992 allows remote attackers to cause a denial of service crash via malformed RFC1006 OSI over TCP/IP packets...

CVE-2006-3564

HiveMail 1.3 and earlier are affected by multiple cross-site scripting (XSS) vulnerabilities. The issue arises from unsanitized input in several parameters across PHP scripts: (1) email, (2) cond, or (3) name in addressbook.view.php; (4) daysprune in index.php; (5) data[to] in compose.email.php; ...

CVE-2006-3494

Multiple cross-site scripting XSS vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the 1 catid parameter to a viewclassifieds.php; 2 id parameter in b viewad.php; 3 eventid parameter in c viewevent.php, d deleteevent.php, and e editevent.php;...

CVE-2006-3494

CVE-2006-3494 affects Buddy Zone 1.0.1 and is described in multiple sources as cross-site scripting (XSS) vulnerabilities. The affected functionality involves user-supplied parameters that can be manipulated to inject arbitrary HTML/script: (1) cat_id in view_classifieds.php; (2) id in view_ad.ph...

CVE-2006-3429

CVE-2006-3429 describes a cross‑site scripting (XSS) vulnerability in TigerTom TTCalc 1.0. The flaw allows remote attackers to inject arbitrary web script or HTML through the currency parameter in the pages loan.php and mortgage.php. The affected component is TTCalc’s web interface; the root caus...

CVE-2006-3388

Cross-site scripting XSS vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter...

CVE-2006-3305

CVE-2006-3305 affects UebiMiau Webmail versions 2.7.10, 2.7.2 and earlier, with multiple XSS via parameters f_user (index.php), pag (messages.php), and lid, tid, sid (error.php). The vulnerability allows remote injection of arbitrary script/HTML. The connected documents do not provide exploit det...

CVE-2006-3029

This CVE (CVE-2006-3029) concerns a Cross-site scripting (XSS) vulnerability in ClickTech Clickcart 6.0 and earlier, exploitable via the cat parameter in default.asp. The affected app/function is default.asp of Clickcart; the underlying issue is input handling that allows injection of arbitrary s...