CVE-2006-1576

QLnews 1.2 contains a direct static code injection vulnerability that lets remote authenticated administrators execute arbitrary PHP code by modifying config.php. Root cause is injection via config.php; impact across confidentiality, integrity, and availability is implied in CVSS 2.0. No patch is...

CVE-2006-1575

QLnews 1.2 is affected by multiple XSS vulnerabilities in news.php. The issues allow remote attackers to inject arbitrary script/HTML via the autorx and newsx parameters due to inadequate input sanitization. This is documented across sources referencing CVE-2006-1575 (NVD) and eVuln materials not...