# CVEs published 2006-10-31 27 CVEs were published on October 31, 2006: 1 critical, 0 high. Days are UTC. - [CVE-2006-5629](https://cve.now/CVE-2006-5629.md): Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2006-5630](https://cve.now/CVE-2006-5630.md): Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to (1) delete the virtual directory of an arbitrary site via a modified For (no CVSS) - [CVE-2006-5631](https://cve.now/CVE-2006-5631.md): Cross-site scripting (XSS) vulnerability in change\_pass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2006-5632](https://cve.now/CVE-2006-5632.md): Cross-site scripting (XSS) vulnerability in change\_pass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML vi (CVSS 6.1) - [CVE-2006-5633](https://cve.now/CVE-2006-5633.md): Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service (crash) by creating a range object using c (no CVSS) - [CVE-2006-5620](https://cve.now/CVE-2006-5620.md): PHP remote file inclusion vulnerability in include/menu\_builder.php in MiniBILL 2006-10-10 (1.2.3) and earlier, when register\_globals is ena (no CVSS) - [CVE-2006-5621](https://cve.now/CVE-2006-5621.md): PHP remote file inclusion vulnerability in end.php in ask\_rave 0.9 PR, and other versions before 0.9b, allows remote attackers to execute ar (no CVSS) - [CVE-2006-5622](https://cve.now/CVE-2006-5622.md): SQL injection vulnerability in picmgr.php in Coppermine Photo Gallery 1.4.9 allows remote attackers to execute arbitrary SQL commands via th (no CVSS) - [CVE-2006-5623](https://cve.now/CVE-2006-5623.md): PHP remote file inclusion vulnerability in ip.inc.php in Electronic Engineering Tool (EE Tool) 0.4-1 and earlier allows remote attackers to (no CVSS) - [CVE-2006-5624](https://cve.now/CVE-2006-5624.md): Multiple PHP remote file inclusion vulnerabilities in Multi-Page Comment System (MPCS) 1.0.0 and earlier allow remote attackers to execute a (no CVSS) - [CVE-2006-5625](https://cve.now/CVE-2006-5625.md): PHP remote file inclusion vulnerability in wwwdev/nxheader.inc.php in N/X 2002 Professional Edition Web Content Management System (WCMS) 4.1 (no CVSS) - [CVE-2006-5626](https://cve.now/CVE-2006-5626.md): Cross-site scripting (XSS) vulnerability in cms\_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on (no CVSS) - [CVE-2006-5627](https://cve.now/CVE-2006-5627.md): Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitrary PHP code via a UR (no CVSS) - [CVE-2006-5628](https://cve.now/CVE-2006-5628.md): SQL injection vulnerability in login.asp in UNISOR Content Management System (CMS) allows remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2006-4248](https://cve.now/CVE-2006-4248.md): thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on (no CVSS) - [CVE-2006-5606](https://cve.now/CVE-2006-5606.md): Multiple SQL injection vulnerabilities in BytesFall Explorer (bfExplorer) 0.0.7.1 and earlier allow remote attackers to execute arbitrary SQ (no CVSS) - [CVE-2006-5619](https://cve.now/CVE-2006-5619.md): The seqfile handling (ip6fl\_get\_n function in ip6\_flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial (no CVSS) - [CVE-2006-5612](https://cve.now/CVE-2006-5612.md): PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register\_globals is enabled, allows remote attac (no CVSS) - [CVE-2006-5613](https://cve.now/CVE-2006-5613.md): PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler (mp3SDS) 3.0, when register\_globals is enabled, allows remote at (no CVSS) - [CVE-2006-5614](https://cve.now/CVE-2006-5614.md): Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attacke (no CVSS) - [CVE-2006-5615](https://cve.now/CVE-2006-5615.md): PHP remote file inclusion vulnerability in publish.php in Textpattern 1.19, when register\_globals is enabled, allows remote attackers to exe (no CVSS) - [CVE-2006-5616](https://cve.now/CVE-2006-5616.md): Multiple unspecified vulnerabilities in OpenPBS, as used in SUSE Linux 9.2 through 10.1, allow attackers to execute arbitrary code via unspe (no CVSS) - [CVE-2006-5617](https://cve.now/CVE-2006-5617.md): Directory traversal vulnerability in index.php in Thepeak File Upload Manager 1.3 allows remote attackers to read or download arbitrary file (no CVSS) - [CVE-2006-5618](https://cve.now/CVE-2006-5618.md): Directory traversal vulnerability in script/cat\_for\_aff.php in Netref 4 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2005-4814](https://cve.now/CVE-2005-4814.md): Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, (no CVSS) - [CVE-2006-5610](https://cve.now/CVE-2006-5610.md): PHP remote file inclusion vulnerability in player/includes/common.php in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 2021 (CVSS 9.8) - [CVE-2006-5611](https://cve.now/CVE-2006-5611.md): Unspecified vulnerability in Toshiba Bluetooth Stack before 4.20.01 has unspecified impact and attack vectors, related to the 4.20.01(T) "Se (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-10-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.