# CVEs published 2006-11-06

40 CVEs were published on November 6, 2006: 0 critical, 1 high. Days are UTC.

- [CVE-2006-5760](https://cve.now/CVE-2006-5760.md): Multiple PHP remote file inclusion vulnerabilities in phpDynaSite 3.2.2 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-5761](https://cve.now/CVE-2006-5761.md): Cross-site scripting (XSS) vulnerability in index.php in Rhadrix If-CMS 1.01 and 2.07 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-5762](https://cve.now/CVE-2006-5762.md): PHP remote file inclusion vulnerability in forgot\_pass.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-5763](https://cve.now/CVE-2006-5763.md): Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register\_globals is enabled, allow r (no CVSS)
- [CVE-2006-5764](https://cve.now/CVE-2006-5764.md): PHP remote file inclusion vulnerability in contact.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-5765](https://cve.now/CVE-2006-5765.md): SQL injection vulnerability in rss.php in Article Script 1.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-5766](https://cve.now/CVE-2006-5766.md): PHP remote file inclusion vulnerability in volume.php in Article System 0.6 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2006-5767](https://cve.now/CVE-2006-5767.md): PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2006-5768](https://cve.now/CVE-2006-5768.md): Multiple PHP remote file inclusion vulnerabilities in Cyberfolio 2.0 RC1 and earlier, when register\_globals is enabled, allow remote attacke (no CVSS)
- [CVE-2006-5769](https://cve.now/CVE-2006-5769.md): Multiple cross-site scripting (XSS) vulnerabilities in admin.tool CMS 3 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-5770](https://cve.now/CVE-2006-5770.md): Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Blo (no CVSS)
- [CVE-2006-5771](https://cve.now/CVE-2006-5771.md): Cross-site scripting (XSS) vulnerability in Arkoon SSL360 1.0 and 2.0 before 2.0/2 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-5772](https://cve.now/CVE-2006-5772.md): Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 and earlier allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2006-5773](https://cve.now/CVE-2006-5773.md): Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose (no CVSS)
- [CVE-2006-5774](https://cve.now/CVE-2006-5774.md): Cross-site scripting (XSS) vulnerability in Hyper NIKKI System before 2.19.9 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-5775](https://cve.now/CVE-2006-5775.md): Cross-site scripting (XSS) vulnerability in profile.php in FunkBoard 0.71 before 4 November 2006 at 18:16 GMT allows remote attackers to inj (no CVSS)
- [CVE-2006-5759](https://cve.now/CVE-2006-5759.md): index.php in Rhadrix If-CMS, possibly 1.01 and 2.07, allows remote attackers to obtain the full path of the web server via empty (1) rns\[\] o (no CVSS)
- [CVE-2006-5757](https://cve.now/CVE-2006-5757.md): Race condition in the \_\_find\_get\_block\_slow function in the ISO9660 filesystem in Linux 2.6.18 and possibly other versions allows local user (no CVSS)
- [CVE-2006-5758](https://cve.now/CVE-2006-5758.md): The Graphics Rendering Engine in Microsoft Windows 2000 through 2000 SP4 and Windows XP through SP2 maps GDI Kernel structures on a global s (no CVSS)
- [CVE-2006-5729](https://cve.now/CVE-2006-5729.md): Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to (1) reply to a (no CVSS)
- [CVE-2006-5730](https://cve.now/CVE-2006-5730.md): PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier (no CVSS)
- [CVE-2006-5731](https://cve.now/CVE-2006-5731.md): Directory traversal vulnerability in classes/index.php in Lithium CMS 4.04c and earlier allows remote attackers to include and execute arbit (no CVSS)
- [CVE-2006-5732](https://cve.now/CVE-2006-5732.md): SQL injection vulnerability in logout.php in T.G.S. (no CVSS)
- [CVE-2006-5733](https://cve.now/CVE-2006-5733.md): Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2006-5734](https://cve.now/CVE-2006-5734.md): Multiple PHP remote file inclusion vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary PHP code via a URL in the ( (no CVSS, phpmailer/phpmailer)
- [CVE-2006-5735](https://cve.now/CVE-2006-5735.md): Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbi (no CVSS)
- [CVE-2006-5736](https://cve.now/CVE-2006-5736.md): SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to CVE-2006-3017, allows remote at (no CVSS)
- [CVE-2006-5737](https://cve.now/CVE-2006-5737.md): PunBB uses a predictable cookie\_seed value that can be derived from the time of registration of the superadmin account (installation time), (no CVSS)
- [CVE-2006-5738](https://cve.now/CVE-2006-5738.md): Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to execute arbitrary SQL commands vi (CVSS 7.2)
- [CVE-2006-5739](https://cve.now/CVE-2006-5739.md): PHP remote file inclusion vulnerability in cpadmin/cpa\_index.php in Leicestershire communityPortals 1.0\_2005-10-18\_12-31-18 allows remote at (no CVSS)
- [CVE-2006-5741](https://cve.now/CVE-2006-5741.md): Multiple cross-site scripting (XSS) vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-5742](https://cve.now/CVE-2006-5742.md): The AirMagnet Enterprise console and Remote Sensor console (Laptop) in AirMagnet Enterprise before 7.5 build 6307 allows remote attackers to (no CVSS)
- [CVE-2006-5743](https://cve.now/CVE-2006-5743.md): Multiple cross-site scripting (XSS) vulnerabilities in Highwall Enterprise and Highwall Endpoint 4.0.2.11045 management interface allow remo (no CVSS)
- [CVE-2006-5744](https://cve.now/CVE-2006-5744.md): Multiple SQL injection vulnerabilities in Highwall Enterprise and Highwall Endpoint 4.0.2.11045 management interface allow remote attackers (no CVSS)
- [CVE-2006-5745](https://cve.now/CVE-2006-5745.md): Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on (no CVSS)
- [CVE-2006-5746](https://cve.now/CVE-2006-5746.md): The console in AirMagnet Enterprise before 7.5 build 6307 does not properly validate the Enterprise Server certificate, which allows remote (no CVSS)
- [CVE-2006-5466](https://cve.now/CVE-2006-5466.md): Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is se (no CVSS)
- [CVE-2006-5726](https://cve.now/CVE-2006-5726.md): alloccgblk in the UFS filesystem in Solaris 10 allows local users to cause a denial of service (memory corruption) by mounting crafted UFS f (no CVSS)
- [CVE-2006-5727](https://cve.now/CVE-2006-5727.md): PHP remote file inclusion vulnerability in admin/controls/cart.php in sazcart 1.5 allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-5728](https://cve.now/CVE-2006-5728.md): XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long argument to the NLST (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.