CVE-2006-5787

admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwords via a direct request, possibly related to an authentication issue in admin/chkadmin.php...

CVE-2006-5428

rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...

CVE-2006-5381

Contenido CMS stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain database credentials and other information via a direct request to 1 dbmsql.inc, 2 dbmssql.inc, 3 dbmysqli.inc, 4 dboci8.inc, 5 dbodbc.inc, 6 dboracle.inc, 7 dbpgsql.in...

CVE-2006-5109

Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for 1 linknavi.php or 2 spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, listdocs.php, popularprod.php, sale.php, checksum.php, and...

CVE-2006-4989

Patrick Michaelis Wili-CMS allows remote attackers to obtain sensitive information via a direct request for 1 thumbnail.php, 2 functions/admin/all.php, 3 functions/admin/initsession.php, 4 functions/all.php, and 5 certain files in example-view/admintemplates/, which reveals the path in various...

CVE-2006-4976

The Date Library in John Lim ADOdb Library for PHP allows remote attackers to obtain sensitive information via a direct request for 1 server.php, 2 adodb-errorpear.inc.php, 3 adodb-iterator.inc.php, 4 adodb-pear.inc.php, 5 adodb-perf.inc.php, 6 adodb-xmlschema.inc.php, and 7 adodb.inc.php; files ...

CVE-2006-4971

CVE-2006-4971 affects MyBB (MyBulletinBoard). A direct request to inc/plugins/hello.php allows remote attackers to trigger an error message that reveals the server path, exposing sensitive information. Impact: partial confidentiality. CVSS v2 base score: 5.0 (MEDIUM) . The supplied documents do n...

CVE-2006-4873

Jupiter CMS allows remote attackers to obtain sensitive information via a direct request for 1 includes/functions.php, 2 modules/register.php, 3 modules/poll.php, 4 modules/panel.php, 5 modules/pm.php, 6 modules/news.php, 7 modules/templateschange.php, 8 modules/users.php, 9 modules/misc.php, 10...

CVE-2006-4865

Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other unspecified vectors...

CVE-2006-4865

Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other unspecified vectors...

CVE-2006-4835

Bluview Blue Magic Board BMB aka BMForum 5.5 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php, 2 header.php, 3 dbmysqlerror.php, 4 langlist.php, 5 sendmail.php, or 6 style.php, which reveals the path in various error messages...

CVE-2006-4772

HotPlug CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password and database credentials via a direct request for includes/class/config.inc...

CVE-2006-4743

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...

CVE-2006-4740

CVE-2006-4740 affects Jetbox CMS. The vulnerability allows remote attackers to obtain sensitive information by directly requesting certain files, exposing the server file path in error messages. Public references (NVD) indicate a partial confidentiality impact with network access and low attack c...

CVE-2006-4588

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-3553

PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php...

CVE-2006-3390

WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the 1 wp-admin, 2 wp-content, and 3 wp-includes directories, possibly due to uninitialized variables...

CVE-2006-3338

Cross-site scripting XSS vulnerability in Atlassian JIRA 3.6.2-156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page...

CVE-2006-3091

PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to 1 /verif.php, 2 /inc/footer.php, and 3 /remises/ajouterremise.php...

CVE-2006-3034

MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message...