Primary
Vendor -- Product | Description | | CVSS Score | Source & Patch Info | 20/20 Applications -- 20/20 DataShed
| SQL injection vulnerability in listings.asp in 20/20 DataShed (aka Real Estate Listing System) allows remote attackers to execute arbitrary SQL commands via the itemID parameter. NOTE: some of these details are obtained from third party information. | | 7.0 | CVE-2006-5955
OTHER-REF
FRSIRT
SECUNIA
| @cid stats -- @cid stats
| ** DISPUTED ** PHP remote file inclusion vulnerability in install.php3 in @cid stats 2.3 allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter. NOTE: this issue has been disputed by a third party, who states that install.php3 is supposed to be deleted after installation and, if not deleted, intentionally allows setting repertoire without an inclusion attack. | | 7.0 | CVE-2006-5899
BUGTRAQ
BUGTRAQ
| ActiveCampaign -- KnowledgeBuilder
| PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the visEdit_root parameter, a different vector than CVE-2003-1131. | | 7.0 | CVE-2006-5919
BUGTRAQ
OTHER-REF
BID
BID
| Aigaion -- Aigaion
| Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) _basicfunctions.php, or (2) pageactionauthor.php. | | 7.0 | CVE-2006-5930
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
| ASP Scripter -- Easy Portal
ASP Scripter -- Live Support
| SQL injection vulnerability in cpLogin.asp in ASP Scripter Easy Portal 1.4 and Live Support 1.3 allows remote attackers to execute arbitrary SQL commands via the Password parameter. | | 7.0 | CVE-2006-5927
BUGTRAQ
FRSIRT
SECUNIA
| ASP Smiley -- ASP Smiley
| SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL commands via the Username field. | | 7.0 | CVE-2006-5952
OTHER-REF
FRSIRT
SECUNIA
| ASPPortal -- ASPPortal
| SQL injection vulnerability in default1.asp in ASPPortal 4.0.0 beta and earlier allows remote attackers to execute arbitrary SQL commands via the Poll_ID parameter, a different vector than CVE-2006-1353. | | 7.0 | CVE-2006-5879
Milw0rm
FRSIRT
SECUNIA
BUGTRAQ
XF
| BrewBlogger -- BrewBlogger
| SQL injection vulnerability in printLog.php in BrewBlogger (BB) 1.3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 7.0 | CVE-2006-5889
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
XF
| Broadcom -- BCMWL5.SYS Wireless Device Driver
Linksys -- WPC300N Wireless-N Notebook Adapter Driver
| Stack-based buffer overflow in the Broadcom BCMWL5.SYS wireless device driver 3.50.21.10, as used in Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products, allows remote attackers to execute arbitrary code via an 802.11 response frame containing a long SSID field. | | 7.0 | CVE-2006-5882
OTHER-REF
OTHER-REF
OTHER-REF
CERT-VN
FRSIRT
| Campware.org -- Campsite
| Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 20061110 allow remote attackers to execute arbitrary PHP code via a URL in the g_documentRoot parameter to (1) bugreporter/thankyou.php and (2) feedback/thankyou.php in implementation/management/priv/. | | 7.0 | CVE-2006-5910
OTHER-REF
OTHER-REF
OTHER-REF
BID
| Campware.org -- Campsite
| Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 2.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the g_documentRoot parameter to (1) Alias.php, (2) Article.php, (3) ArticleAttachment.php, (4) ArticleComment.php, (5) ArticleData.php, (6) ArticleImage.php, (7) ArticleIndex.php, (8) ArticlePublish.php, (9) ArticleTopic.php, (10) ArticleType.php, (11) ArticleTypeField.php, (12) Attachment.php, (13) Country.php, (14) DatabaseObject.php, (15) Event.php, (16) IPAccess.php, (17) Image.php, (18) Issue.php, (19) IssuePublish.php, (20) Language.php, (21) Log.php, (22) LoginAttempts.php, (23) Publication.php, (24) Section.php, (25) ShortURL.php, (26) Subscription.php, (27) SubscriptionDefaultTime.php, (28) SubscriptionSection.php, (29) SystemPref.php, (30) Template.php, (31) TimeUnit.php, (32) Topic.php, (33) UrlType.php, (34) User.php, and (35) UserType.php in implementation/management/classes/; (36) configuration.php and (37) db_connect.php in implementation/management/; and (38) LocalizerConfig.php and (39) LocalizerLanguage.php in implementation/management/priv/localizer/. | | 7.0 | CVE-2006-5911
OTHER-REF
OTHER-REF
OTHER-REF
OTHER-REF
OTHER-REF
| Chris Mac -- GimeScripts Shopping Catalog
| PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the custom parameter. | | 7.0 | CVE-2006-5923
OTHER-REF
BID
| Dynamic Data Worx -- NuStore
| SQL injection vulnerability in Products.asp in NuStore 1.0 allows remote attackers to execute arbitrary SQL commands via the SubCatagoryID parameter. | | 7.0 | CVE-2006-5885
BUGTRAQ
FRSIRT
SECUNIA
XF
SECTRACK
| Dynamic Data Worx -- NuRealestate
| SQL injection vulnerability in propertysdetails.asp in Dynamic Dataworx NuRealestate (NuRems) 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the PropID parameter. | | 7.0 | CVE-2006-5886
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
XF
| Dynamic Data Worx -- NuSchool
| SQL injection vulnerability in CampusNewsDetails.asp in Dynamic Dataworx NuSchool 1.0 allows remote attackers to execute arbitrary SQL commands via the NewsID parameter. | | 7.0 | CVE-2006-5887
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
XF
SECTRACK
| Dynamic Dataworx -- NuCommunity
| SQL injection vulnerability in cl_CatListing.asp in Dynamic Dataworx NuCommunity 1.0 allows remote attackers to execute arbitrary SQL commands via the cl_cat_ID parameter. | | 7.0 | CVE-2006-5881
BUGTRAQ
Milw0rm
BID
FRSIRT
SECUNIA
XF
SECTRACK
| Edgewall Software -- Trac
| Cross-site Request Forgery (CSRF) vulnerability in Trac before 0.10.1 allows remote attackers to perform unauthorized actions as other users via unknown vectors. | | 7.0 | CVE-2006-5878
OTHER-REF
DEBIAN
SECUNIA
SECUNIA
| EncapsCMS -- EncapsCMS
| PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter. | | 7.0 | CVE-2006-5895
BUGTRAQ
OTHER-REF
MLIST
BID
FRSIRT
XF
SECUNIA
| Exophpdesk -- Exophpdesk
| PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter. | | 7.0 | CVE-2006-5951
BUGTRAQ
BID
XF
| FunkyASP -- Glossary
| SQL injection vulnerability in demo/glossary/glossary.asp in FunkyASP Glossary 1.0 allows remote attackers to execute arbitrary SQL commands via the alpha parameter. | | 7.0 | CVE-2006-5946
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
| Grisoft -- AVG Antivirus
| Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives that trigger a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. | | 7.0 | CVE-2006-5937
FULLDISC
OTHER-REF
FRSIRT
SECUNIA
| Grisoft -- AVG Antivirus
| Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors involving an uninitialized variable and a crafted CAB file. | | 7.0 | CVE-2006-5938
FULLDISC
OTHER-REF
FRSIRT
SECUNIA
| Grisoft -- AVG Antivirus
| Unspecified vulnerability in Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors related to "Integer Issues" and parsing of .EXE files. | | 7.0 | CVE-2006-5940
FULLDISC
OTHER-REF
FRSIRT
SECUNIA
| Hawking Technology -- WR254-CA Wireless Router
| Hawking Technology wireless router WR254-CA uses a hardcoded IP address among the set of DNS server IP addresses, which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at the hardcoded address. NOTE: it could be argued that this issue reflects an inherent limitation of DNS itself, so perhaps it should not be included in CVE. | | 7.0 | CVE-2006-5901
BUGTRAQ
| Hpecs Shopping Cart -- Hpecs Shopping Cart
| Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields in the (a) login screen, and (3) searchstring parameter in (b) insearch_list.asp. | | 7.0 | CVE-2006-5962
BUGTRAQ
SECUNIA
XF
XF
| iExpress -- Estate Agent Manager
| SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the UserName field. | | 7.0 | CVE-2006-5934
BUGTRAQ
OTHER-REF
SECUNIA
XF
| INFINICART -- INFINICART
| Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. | | 7.0 | CVE-2006-5957
BUGTRAQ
BID
FRSIRT
SECUNIA
| INFINICART -- INFINICART
| Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password fields in (a) login.asp, (3) search field in (b) search.asp, and (4) email field in (c) sendpassword.asp. | | 7.0 | CVE-2006-5958
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
| iSystems -- Munch Pro
| SQL injection vulnerability on the subMenu page in switch.asp in Munch Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter. | | 7.0 | CVE-2006-5880
Milw0rm
FRSIRT
SECUNIA
XF
| iWonder Designs -- Storystream
| Multiple PHP remote file inclusion vulnerabilities in iWonder Designs Storystream 0.4.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter to (1) mysql.php and (2) mysqli.php in include/classes/pear/DB/. | | 7.0 | CVE-2006-5893
OTHER-REF
BID
FRSIRT
XF
| Jean-Christophe Ramos -- PLS-Bannieres
| ** DISPUTED ** PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: the issue is disputed by other researchers, who observe that $chemin is defined before use. | | 7.0 | CVE-2006-5906
BUGTRAQ
BUGTRAQ
BUGTRAQ
BUGTRAQ
| Jean-Christophe Ramos -- Ban
Jean-Christophe Ramos -- PLS-Bannieres
| SQL injection vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 7.0 | CVE-2006-5907
BUGTRAQ
MLIST
| Kahua -- Kahua
| Kahua before 0.7, when running multiple applications under a single supervisor, grants application access on the basis of username instead of username and database name, which allows remote authenticated users to obtain unauthorized access if different databases assign the same username to different user accounts. | | 7.0 | CVE-2006-5932
OTHER-REF
OTHER-REF
FRSIRT
SECUNIA
XF
| Links -- Links
| Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in an smb:// URI, as demonstrated by using PUT and GET statements. | | 7.0 | CVE-2006-5925
FULLDISC
REDHAT
SECTRACK
SECTRACK
SECUNIA
SECUNIA
| Lucas Rodriguez San Pedro -- Yet Another News System
| Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter. | | 7.0 | CVE-2006-5908
BUGTRAQ
BID
XF
| Lynx Internet Solutions -- Evolve Merchant
| SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneid parameter. | | 7.0 | CVE-2006-5953
OTHER-REF
FRSIRT
SECUNIA
| Marshal -- MailMarshal SMTP
| Directory traversal vulnerability in Marshal MailMarshal SMTP 5.x, 6.x, and 2006, and MailMarshal for Exchange 5.x, allows remote attackers to write arbitrary files via ".." sequences in filenames in an ARJ compressed archive. | | 7.0 | CVE-2006-5487
OTHER-REF
OTHER-REF
BUGTRAQ
BID
FRSIRT
SECTRACK
SECUNIA
XF
| MGinternet -- Car Site Manager
| Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the s parameter. | | 7.0 | CVE-2006-5944
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
| MGinternet -- Car Site Manager
| Multiple SQL injection vulnerabilities in MGinternet Car Site Manager (CSM) allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) csm/asp/detail.asp, or the (2) l, (3) typ, or (4) loc parameter to (b) csm/asp/listings.asp. | | 7.0 | CVE-2006-5945
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
| Microsoft -- Windows 2000
Microsoft -- Windows Server 2003
Microsoft -- Windows XP
| Microsoft Agent on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted .ACF file that triggers memory corruption. | | 7.0 | CVE-2006-3445
MS
FRSIRT
SECUNIA
XF
CERT
| Microsoft -- XP
Microsoft -- Windows 2000
Microsoft -- Server 2003
| Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via crafted messages, aka "Client Service for NetWare Memory Corruption Vulnerability." | | 7.0 | CVE-2006-4688
MS
FRSIRT
SECUNIA
XF
BUGTRAQ
CERT
BID
SECTRACK
| Microsoft -- Windows 2000
Microsoft -- Windows XP
| Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname. | | 10.0 | CVE-2006-4691
MS
FRSIRT
SECUNIA
XF
BUGTRAQ
EEYE
CERT
BID
SECTRACK
| Microsoft -- Internet Explorer
| Multiple unspecified vulnerabilities in DirectAnimation ActiveX controls for Microsoft Internet Explorer 5.01 through 6 have unknown impact and remote attack vectors, possibly related to (1) Danim.dll and (2) Lmrt.dll, a different set of vulnerabilities than CVE-2006-4446 and CVE-2006-4777. | | 7.0 | CVE-2006-5884
MS
CERT
| MWChat Pro -- MWChat Pro
| Multiple PHP remote file inclusion vulnerabilities in MWChat Pro 7.0 allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[MWCHAT_Libs] parameter to (1) about.php, (2) buddy.php, (3) chat.php, (4) dialog.php, (5) head.php, (6) help.php, (7) index.php, and (8) license.php, different vectors than CVE-2005-1869. | | 7.0 | CVE-2006-5904
BUGTRAQ
| NetVIOS -- NetVIOS
| SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the NewsID parameter. | | 7.0 | CVE-2006-5954
OTHER-REF
FRSIRT
SECUNIA
| Omnistar Interactive -- OmniStar Article Manager
| Multiple SQL injection vulnerabilities in OmniStar Article Manager allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in (a) articles/comments.php and (b) articles/article.php, and the (2) page_id parameter in (c) articles/pages.php. | | 7.0 | CVE-2006-5917
BUGTRAQ
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
| otterware -- LetterIt2
| PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter. | | 7.0 | CVE-2006-5863
BID
FRSIRT
SECUNIA
XF
| PHP Rapid Kill -- PHP Rapid Kill
| Unrestricted file upload vulnerability in RapidKill (aka PHP Rapid Kill) 5.7 Pro, and certain other versions, allows remote attackers to upload and execute arbitrary PHP scripts via the "Link to Download" field. NOTE: it is possible that the field value is restricted to files on specific public web sites. | | 7.0 | CVE-2006-5918
BUGTRAQ
| Phpjobscheduler -- Phpjobscheduler
| Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter to (1) add-modify.php, (2) delete.php, (3) modify.php, and (4) phpjobscheduler.php. | | 7.0 | CVE-2006-5928
BUGTRAQ
OTHER-REF
BID
SECUNIA
| Phpjobscheduler -- Phpjobscheduler
| PHP remote file inclusion vulnerability in firepjs.php in Phpjobscheduler 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter. NOTE: the provenance of this information is unknown; details are obtained from third party sources. | | 7.0 | CVE-2006-5929
SECUNIA
| PowerDNS -- Recursor
| Buffer overflow in PowerDNS Recursor 3.1.3 and earlier might allow remote attackers to execute arbitrary code via a malformed TCP DNS query that prevents Recursor from properly calculating the TCP DNS query length. | | 7.0 | CVE-2006-4251
OTHER-REF
BID
SECUNIA
DEBIAN
SUSE
FRSIRT
SECUNIA
SECUNIA
| Rahul Jonna -- GSpace
| Rahul Jonna Gmail File Space (GSpace) allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by (1) a GSPACE "2174|1|1|1|gs:/ d$" message, which injects a new file into the filesystem; and (2) a GSPACE "|-135|1|1|0|gs:/ d$" message, which creates a folder. | | 7.0 | CVE-2006-5903
BUGTRAQ
| RingsWorld -- phpPeanuts
| PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Include parameter. | | 7.0 | CVE-2006-5948
OTHER-REF
BID
FRSIRT
SECUNIA
| SAMEDIA -- LandShop
| SQL injection vulnerability in ls.php in SAMEDIA LandShop allows remote attackers to execute arbitrary SQL commands via the infield parameter. NOTE: the start, search_order, search_type, and search_area parameters are already covered by CVE-2005-4018. | | 7.0 | CVE-2006-5914
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
| SAMEDIA -- LandShop
| Multiple cross-site scripting (XSS) vulnerabilities in ls.php in SAMEDIA LandShop allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) CAT_ID, (3) keyword, (4) search_area, (5) search_type, (6) infield, or (7) search_order parameter. | | 7.0 | CVE-2006-5915
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
| ShopSystems -- ShopSystems
| SQL injection vulnerability in index.php in ShopSystems 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the sessid parameter. | | 7.0 | CVE-2006-5935
BUGTRAQ
OTHER-REF
BID
SECUNIA
XF
| SiteXpress -- SiteXpress E-Commerce System
| SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 7.0 | CVE-2006-5936
BUGTRAQ
BID
| Superfreaker Studios -- UPublisher
| SQL injection vulnerability in viewarticle.asp in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. | | 7.0 | CVE-2006-5888
OTHER-REF
FRSIRT
SECUNIA
XF
BUGTRAQ
| SuperFreaker Studios -- USupport
| SQL injection vulnerability in detail.asp in Superfreaker Studios USupport 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 7.0 | CVE-2006-5890
OTHER-REF
FRSIRT
SECUNIA
XF
| Superfreaker Studios -- UStore
| SQL injection vulnerability in detail.asp in Superfreaker Studios UStore 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. | | 7.0 | CVE-2006-5891
BUGTRAQ
OTHER-REF
FRSIRT
SECUNIA
XF
BUGTRAQ
| The Net Guys -- ASPired2Poll
| SQL injection vulnerability in MoreInfo.asp in The Net Guys ASPired2Poll 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 7.0 | CVE-2006-5892
OTHER-REF
BID
FRSIRT
SECUNIA
XF
| UltraSite -- UltraSite
| SQL injection vulnerability in update.asp in UltraSite 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 7.0 | CVE-2006-5933
BUGTRAQ
| Vallheru -- Vallheru
| Multiple SQL injection vulnerabilities in mail.php in Vallheru before 1.0.7 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) to parameters. NOTE: some of these details are obtained from third party information. | | 7.0 | CVE-2006-5926
OTHER-REF
OTHER-REF
FRSIRT
SECUNIA
| viksoe -- GMail Drive
| viksoe GMail Drive shell extension allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by (1) a GMAILFS: [13;a;1] message with a new filename and a file attachment, which injects a new file into the filesystem; (2) a GMAILFS: [13;a;1] message with an existing filename and a file attachment, which overwrites existing file content; and (3) a GMAILFS: [14;a;1] message, which creates a folder. | | 7.0 | CVE-2006-5902
BUGTRAQ
| Web Inhabit -- A+ Store E-Commerce
| SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter. | | 7.0 | CVE-2006-5959
BUGTRAQ
BID
SECUNIA
XF
| Web Inhabit -- A+ Store E-Commerce
| Multiple cross-site scripting (XSS) vulnerabilities in account_login.asp in A+ Store E-Commerce allow remote attackers to inject arbitrary web script or HTML via the (1) username (txtUserName) and (2) password (txtPassword) parameters. NOTE: portions of these details are obtained from third party information. | | 7.0 | CVE-2006-5960
BUGTRAQ
BID
SECUNIA
| Website Designs For Less -- Inventory Manager
| Cross-site scripting (XSS) vulnerability in inventory/display/display_results.asp in Website Designs For Less Inventory Manager allows remote attackers to inject arbitrary web script or HTML via the category parameter. | | 7.0 | CVE-2006-5942
BUGTRAQ
BID
SECUNIA
| Website Designs For Less -- Inventory Manager
| Multiple SQL injection vulnerabilities in inventory/display/imager.asp in Website Designs for Less Inventory Manager allow remote attackers to execute arbitrary SQL commands via the (1) pictable, (2) picfield, or (3) where parameter. | | 7.0 | CVE-2006-5943
BUGTRAQ
BID
SECUNIA
| Yuuki Yoshizawa -- Exporia
| ** DISPUTED ** PHP remote file inclusion vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter. NOTE: SecurityFocus disputes this issue, saying "further analysis reveals that the application is not vulnerable." NOTE: this issue may overlap CVE-2006-5113. | | 7.0 | CVE-2006-5920
BUGTRAQ
BID
XF
| Zend -- Zend Framework Preview
| Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters. | | 7.0 | CVE-2006-5900
BUGTRAQ
BUGTRAQ
| 
