CVE-2006-3950

CVE-2006-3950 describes an SQL injection in X-Scripts X-Statistics 1.20, triggered through the User-Agent HTTP header in x-statistics.php. The vulnerability allows remote attackers to execute arbitrary SQL commands. Affected product/version: X-Scripts X-Statistics 1.20 (component: x-statistics.ph...

CVE-2006-3959

CVE-2006-3959 affects X-Scripts X-Protection 1.10, where protect.php is vulnerable to SQL injection when magic_quotes_gpc is disabled. An attacker can supply crafted values for the (1) username and (2) password parameters to trigger arbitrary SQL execution remotely via HTTP to protect.php. The ro...