# CVEs published 2006-05-01

22 CVEs were published on May 1, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-2127](https://cve.now/CVE-2006-2127.md): SQL injection vulnerability in weblog\_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL commands via the r para (no CVSS)
- [CVE-2006-2128](https://cve.now/CVE-2006-2128.md): Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) (no CVSS)
- [CVE-2006-2129](https://cve.now/CVE-2006-2129.md): Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by ed (no CVSS)
- [CVE-2006-2130](https://cve.now/CVE-2006-2130.md): SQL injection vulnerability in include/class\_poll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2006-2131](https://cve.now/CVE-2006-2131.md): include/class\_poll.php in Advanced Poll 2.0.4 uses the HTTP\_X\_FORWARDED\_FOR (X-Forwarded-For HTTP header) to identify the IP address of a cl (no CVSS)
- [CVE-2006-2132](https://cve.now/CVE-2006-2132.md): SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. (no CVSS)
- [CVE-2006-2133](https://cve.now/CVE-2006-2133.md): SQL injection vulnerability in index.php in BoonEx Barracuda 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2006-2120](https://cve.now/CVE-2006-2120.md): The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr (no CVSS)
- [CVE-2006-2121](https://cve.now/CVE-2006-2121.md): PHP remote file include vulnerability in admin/config\_settings.tpl.php in I-RATER Platinum allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2006-2122](https://cve.now/CVE-2006-2122.md): PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page pa (no CVSS)
- [CVE-2006-2123](https://cve.now/CVE-2006-2123.md): Multiple SQL injection vulnerabilities in the report interface in Network Administration Visualized (NAV) before 3.0.1 allow remote attacker (no CVSS)
- [CVE-2006-2124](https://cve.now/CVE-2006-2124.md): Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-2126](https://cve.now/CVE-2006-2126.md): SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-2116](https://cve.now/CVE-2006-2116.md): planetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery\_admin.php. (no CVSS)
- [CVE-2006-2117](https://cve.now/CVE-2006-2117.md): Cross-site scripting (XSS) vulnerability in Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the search page. (no CVSS)
- [CVE-2006-2118](https://cve.now/CVE-2006-2118.md): JMK's Picture Gallery allows remote attackers to bypass authentication via a direct request to admin\_gallery.php3, possibly related to the a (no CVSS)
- [CVE-2006-2119](https://cve.now/CVE-2006-2119.md): PHP remote file inclusion vulnerability in event/index.php in Artmedic Event allows remote attackers to execute arbitrary code via a URL in (no CVSS)
- [CVE-2006-1989](https://cve.now/CVE-2006-1989.md): Buffer overflow in the get\_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to exec (no CVSS)
- [CVE-2006-2110](https://cve.now/CVE-2006-2110.md): Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities (ccaps) that allo (no CVSS)
- [CVE-2006-2111](https://cve.now/CVE-2006-2111.md): A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redire (no CVSS)
- [CVE-2006-2114](https://cve.now/CVE-2006-2114.md): Buffer overflow in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via a long request. (no CVSS)
- [CVE-2006-2115](https://cve.now/CVE-2006-2115.md): Format string vulnerability in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via unspecified vectors that are not p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.