# CVEs published 2006-11-26

15 CVEs were published on November 26, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-5965](https://cve.now/CVE-2006-5965.md): PassGo SSO Plus 2.1.0.32, and probably earlier versions, uses insecure permissions (Everyone/Full Control) for the PassGo Technologies direc (no CVSS)
- [CVE-2006-6121](https://cve.now/CVE-2006-6121.md): Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run method. (no CVSS)
- [CVE-2006-6122](https://cve.now/CVE-2006-6122.md): Multiple buffer overflows in TIN before 1.8.2 have unspecified impact and attack vectors, a different vulnerability than CVE-2006-0804. (no CVSS)
- [CVE-2006-6123](https://cve.now/CVE-2006-6123.md): Coppermine Photo Gallery (CPG) 1.4.8 stable, with register\_globals enabled, allows remote attackers to bypass XSS protection and set arbitra (no CVSS)
- [CVE-2006-6124](https://cve.now/CVE-2006-6124.md): Cross-site scripting (XSS) vulnerability in SeleniumServer Web Server 1.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-5869](https://cve.now/CVE-2006-5869.md): pstotext before 1.9 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a file name. (no CVSS)
- [CVE-2006-6108](https://cve.now/CVE-2006-6108.md): Cross-site scripting (XSS) vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via un (no CVSS)
- [CVE-2006-6109](https://cve.now/CVE-2006-6109.md): Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) pol (no CVSS)
- [CVE-2006-6110](https://cve.now/CVE-2006-6110.md): Multiple SQL injection vulnerabilities in an unspecified BPG-InfoTech Content Management System product allow remote attackers to execute ar (no CVSS)
- [CVE-2006-6111](https://cve.now/CVE-2006-6111.md): Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) prod (no CVSS)
- [CVE-2006-6115](https://cve.now/CVE-2006-6115.md): SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the fid pa (no CVSS)
- [CVE-2006-6116](https://cve.now/CVE-2006-6116.md): SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the k (no CVSS)
- [CVE-2006-6117](https://cve.now/CVE-2006-6117.md): SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the w (no CVSS)
- [CVE-2006-6118](https://cve.now/CVE-2006-6118.md): Cross-site scripting (XSS) vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-6119](https://cve.now/CVE-2006-6119.md): mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.