# CVEs published 2006-09-13

44 CVEs were published on September 13, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4757](https://cve.now/CVE-2006-4757.md): Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitra (no CVSS)
- [CVE-2006-4758](https://cve.now/CVE-2006-4758.md): phpBB 2.0.21 does not properly handle pathnames ending in %00, which allows remote authenticated administrative users to upload arbitrary fi (no CVSS)
- [CVE-2006-4759](https://cve.now/CVE-2006-4759.md): PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to (no CVSS)
- [CVE-2006-4760](https://cve.now/CVE-2006-4760.md): Multiple cross-site scripting (XSS) vulnerabilities in Benjamin Pasero and Tobias Eichert RSSOwl allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-4761](https://cve.now/CVE-2006-4761.md): Multiple cross-site scripting (XSS) vulnerabilities in Luke Hutteman SharpReader allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2006-4762](https://cve.now/CVE-2006-4762.md): Multiple cross-site scripting (XSS) vulnerabilities in Ykoon RssReader allow remote attackers to inject arbitrary web script or HTML via a w (no CVSS)
- [CVE-2006-4763](https://cve.now/CVE-2006-4763.md): IBM Lotus Domino Web Access (DWA) 7.0.1 does not expire a client's Lightweight Third-Party Authentication token (LtpaToken) upon logout, whi (no CVSS)
- [CVE-2006-4764](https://cve.now/CVE-2006-4764.md): PHP remote file inclusion vulnerability in common.php in Thomas LETE WTools 0.0.1-ALPH allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2006-4765](https://cve.now/CVE-2006-4765.md): NETGEAR DG834GT Wireless ADSL router running firmware 1.01.28 allows attackers to cause a denial of service (device hang) via a long string (no CVSS)
- [CVE-2006-4766](https://cve.now/CVE-2006-4766.md): Directory traversal vulnerability in print.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allows remote attackers to read arbitrary f (no CVSS)
- [CVE-2006-4767](https://cve.now/CVE-2006-4767.md): Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5beta allow remote attackers to (1) read arbitrary l (no CVSS)
- [CVE-2006-4768](https://cve.now/CVE-2006-4768.md): Multiple direct static code injection vulnerabilities in add\_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers (no CVSS)
- [CVE-2006-4769](https://cve.now/CVE-2006-4769.md): PHP remote file inclusion vulnerability in abf\_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP code via a URL in the a (no CVSS)
- [CVE-2006-4770](https://cve.now/CVE-2006-4770.md): PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2000-1241](https://cve.now/CVE-2000-1241.md): Unspecified vulnerability in Haakon Nilsen simple, integrated publishing system (SIPS) before 0.2.4 has an unknown impact and attack vectors (no CVSS)
- [CVE-2002-2218](https://cve.now/CVE-2002-2218.md): CRLF injection vulnerability in the setUserValue function in sipssys/code/site.inc.php in Haakon Nilsen simple, integrated publishing system (no CVSS)
- [CVE-2006-4732](https://cve.now/CVE-2006-4732.md): Unspecified vulnerability in Microsoft Visual Basic (VB) 6 has an unknown impact ("overflow") via a project that contains a certain Click ev (no CVSS)
- [CVE-2006-4733](https://cve.now/CVE-2006-4733.md): PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and e (no CVSS)
- [CVE-2006-4734](https://cve.now/CVE-2006-4734.md): Multiple SQL injection vulnerabilities in tiki-g-admin\_processes.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2006-4735](https://cve.now/CVE-2006-4735.md): Kellan Elliott-McCrea MagpieRSS allows remote attackers to obtain sensitive information via a direct request for (1) rss\_fetch.inc.php or (2 (no CVSS)
- [CVE-2006-4736](https://cve.now/CVE-2006-4736.md): Multiple SQL injection vulnerabilities in index.php in CMS.R. (no CVSS)
- [CVE-2006-4737](https://cve.now/CVE-2006-4737.md): SQL injection vulnerability in index.php in Jetbox CMS allows remote attackers to inject arbitrary web script or HTML via the item parameter (no CVSS)
- [CVE-2006-4738](https://cve.now/CVE-2006-4738.md): PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2006-4739](https://cve.now/CVE-2006-4739.md): Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML, as demonstr (no CVSS)
- [CVE-2006-4740](https://cve.now/CVE-2006-4740.md): Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error (no CVSS)
- [CVE-2006-4741](https://cve.now/CVE-2006-4741.md): PHP remote file inclusion vulnerability in bits\_listings.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2006-4742](https://cve.now/CVE-2006-4742.md): Cross-site scripting (XSS) vulnerability in user\_add.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2006-4743](https://cve.now/CVE-2006-4743.md): WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (no CVSS)
- [CVE-2006-4744](https://cve.now/CVE-2006-4744.md): Abidia (1) O-Anywhere and (2) Abidia Wireless transmit authentication credentials in cleartext, which allows remote attackers to obtain sens (no CVSS)
- [CVE-2006-4745](https://cve.now/CVE-2006-4745.md): ScaryBear PocketExpense Pro 3.9.1 uses an internally recorded key to protect a data file whose contents are stored in plaintext, which allow (no CVSS)
- [CVE-2006-4746](https://cve.now/CVE-2006-4746.md): PHP remote file inclusion vulnerability in news/include/customize.php in Web Server Creator 0.1 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-4747](https://cve.now/CVE-2006-4747.md): Multiple cross-site scripting (XSS) vulnerabilities in IdevSpot TextAds allow remote attackers to inject arbitrary web script or HTML via (1 (no CVSS)
- [CVE-2006-4748](https://cve.now/CVE-2006-4748.md): Multiple SQL injection vulnerabilities in F-ART BLOG:CMS 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) xagent, (2 (no CVSS)
- [CVE-2006-4749](https://cve.now/CVE-2006-4749.md): Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrar (no CVSS)
- [CVE-2006-4750](https://cve.now/CVE-2006-4750.md): PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, allows remote attackers (no CVSS)
- [CVE-2006-4751](https://cve.now/CVE-2006-4751.md): Cross-site scripting (XSS) vulnerability in index.php in Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to inj (no CVSS)
- [CVE-2006-4752](https://cve.now/CVE-2006-4752.md): Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to obtain the installation path via a query to the engine modul (no CVSS)
- [CVE-2006-4753](https://cve.now/CVE-2006-4753.md): Directory traversal vulnerability in index.php in PHProg before 1.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2006-4754](https://cve.now/CVE-2006-4754.md): Cross-site scripting (XSS) vulnerability in index.php in PHProg before 1.1 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-4755](https://cve.now/CVE-2006-4755.md): Cross-site scripting (XSS) vulnerability in alpha.php in phpMyDirectory 10.4.6 and earlier allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2006-4756](https://cve.now/CVE-2006-4756.md): SQL injection vulnerability in alpha.php in phpMyDirectory 10.4.6 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-3739](https://cve.now/CVE-2006-3739.md): Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe F (no CVSS)
- [CVE-2006-3740](https://cve.now/CVE-2006-3740.md): Integer overflow in the scan\_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted ( (no CVSS)
- [CVE-2006-4731](https://cve.now/CVE-2006-4731.md): Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.