CVE-2006-1755

SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVE-2006-1756

MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.