# CVEs published 2006-06-22

37 CVEs were published on June 22, 2006: 1 critical, 0 high. Days are UTC.

- [CVE-2006-3136](https://cve.now/CVE-2006-3136.md): Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIR\_LI (CVSS 9.8)
- [CVE-2006-3137](https://cve.now/CVE-2006-3137.md): Cross-site scripting (XSS) vulnerability in productDetail.asp in Edge eCommerce Shop allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-3138](https://cve.now/CVE-2006-3138.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-3139](https://cve.now/CVE-2006-3139.md): Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2006-3140](https://cve.now/CVE-2006-3140.md): SQL injection vulnerability in index.php in openCI 1.0 BETA 0.20.1 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-3141](https://cve.now/CVE-2006-3141.md): Cross-site scripting (XSS) vulnerability in details.cfm in Tradingeye Shop R4 and earlier allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2006-3142](https://cve.now/CVE-2006-3142.md): SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter. (no CVSS)
- [CVE-2006-3143](https://cve.now/CVE-2006-3143.md): Cross-site scripting (XSS) vulnerability in icue\_login.asp in Maximus SchoolMAX 4.0.1 and earlier iCue and iParent applications allows remot (no CVSS)
- [CVE-2006-3144](https://cve.now/CVE-2006-3144.md): PHP remote file inclusion vulnerability in micro\_cms\_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and ear (no CVSS)
- [CVE-2006-3145](https://cve.now/CVE-2006-3145.md): Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 allows remote attackers to cause a denial of service (crash) and possibly execute (no CVSS)
- [CVE-2006-3146](https://cve.now/CVE-2006-3146.md): The TOSRFBD.SYS driver for Toshiba Bluetooth Stack 4.00.29 and earlier on Windows allows remote attackers to cause a denial of service (rebo (no CVSS)
- [CVE-2006-3147](https://cve.now/CVE-2006-3147.md): Unspecified vulnerability in Hosting Controller before 6.1 (aka Hotfix 3.2) allows remote authenticated attackers to gain host admin privile (no CVSS)
- [CVE-2006-3148](https://cve.now/CVE-2006-3148.md): SQL injection vulnerability, possibly in search.inc.php, in Open-Realty 2.3.1 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-3149](https://cve.now/CVE-2006-3149.md): Cross-site scripting (XSS) vulnerability in topic.php in phpMyForum 4.1.3 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-3150](https://cve.now/CVE-2006-3150.md): SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the pa (no CVSS)
- [CVE-2006-3151](https://cve.now/CVE-2006-3151.md): Cross-site scripting (XSS) vulnerability in index.php in AssoCIateD (aka ACID) 1.2.0 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-3152](https://cve.now/CVE-2006-3152.md): Multiple SQL injection vulnerabilities in phpTRADER 4.9 SP5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2006-3153](https://cve.now/CVE-2006-3153.md): Cross-site scripting (XSS) vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-3154](https://cve.now/CVE-2006-3154.md): SQL injection vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-3155](https://cve.now/CVE-2006-3155.md): Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 1.0 and earlier allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2006-3156](https://cve.now/CVE-2006-3156.md): Cross-site scripting (XSS) vulnerability in index.cgi in Ultimate eShop 1.0 and earlier allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-3157](https://cve.now/CVE-2006-3157.md): Cross-site scripting (XSS) vulnerability in index.php in Thinkfactory UltimateGoogle 1.00 and earlier allows remote attackers to inject arbi (no CVSS)
- [CVE-2006-3158](https://cve.now/CVE-2006-3158.md): index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypa (no CVSS)
- [CVE-2006-3159](https://cve.now/CVE-2006-3159.md): pipe\_master in Sun ONE/iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003) allows local users to read portions of restricted files (no CVSS)
- [CVE-2006-3160](https://cve.now/CVE-2006-3160.md): Cross-site scripting (XSS) vulnerability in fm.php in ONEdotOH Simple File Manager (SFM) 0.24a and earlier allows remote attackers to inject (no CVSS)
- [CVE-2006-3161](https://cve.now/CVE-2006-3161.md): SQL injection vulnerability in misc.php in SaphpLesson 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the act (no CVSS)
- [CVE-2006-3162](https://cve.now/CVE-2006-3162.md): PHP remote file inclusion vulnerability in include/inc\_foot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-3163](https://cve.now/CVE-2006-3163.md): Multiple SQL injection vulnerabilities in galeria.php in IMGallery 2.4 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-3164](https://cve.now/CVE-2006-3164.md): SQL injection vulnerability in category.php in TPL Design tplShop 2.0 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-3165](https://cve.now/CVE-2006-3165.md): SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-3166](https://cve.now/CVE-2006-3166.md): Cross-site scripting (XSS) vulnerability in propview.php in Free Realty 2.9-0.6 and earlier allows remote attackers to execute arbitrary web (no CVSS)
- [CVE-2006-3167](https://cve.now/CVE-2006-3167.md): Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that pr (no CVSS)
- [CVE-2006-3129](https://cve.now/CVE-2006-3129.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in NC LinkList 1.2 and earlier allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2006-3130](https://cve.now/CVE-2006-3130.md): SQL injection vulnerability in index.php in Clubpage allows remote attackers to execute arbitrary SQL commands via the category parameter. (no CVSS)
- [CVE-2006-3131](https://cve.now/CVE-2006-3131.md): Multiple cross-site scripting (XSS) vulnerabilities in Clubpage allow remote attackers to inject arbitrary web script or HTML via the (1) ne (no CVSS)
- [CVE-2006-3132](https://cve.now/CVE-2006-3132.md): Cross-site scripting (XSS) vulnerability in qtofm.php4 in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-3014](https://cve.now/CVE-2006-3014.md): Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadshee (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.